c8a9106f93735ddc6e9a09ad07d75cf447d8d3e3a1ca768787f70715ea468533

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
Size 1.7MB
Sample261102-a7m8eazset
SHA256 c8a9106f93735ddc6e9a09ad07d75cf447d8d3e3a1ca768787f70715ea468533
MD5 b987f99435f6c7db8ee96c9ca5275abc
SHA1 e7b4669076c6fd5cf05ba00280d1a217d21d1ae3
SHA512 c35beb7da75be6826c9dd8bd4f93bfde5271f1b6f4e76dfa8028f04de5206deea016c1190bfd9fceaf3bf0241f3ea862c227a2e437a55e21044513e7abebb1a3
SSDEEP 49152:jBD11SPaAG8h3PLNxL4rQrnaB0zj0yjoB2:jH5KcQOB2Yyjl
TLSH
T14085021BA29505FAD1B7D279C9978402E731780547F0FF8B0394EAA71F276A08E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3556	elevation_service.exe
5188	elevation_service.exe
688	maintenanceservice.exe
4264	OSE.EXE
3672	PerceptionSimulationService.exe
5976	perfhost.exe
3584	ReFsDedupSvc.exe
3340	SensorDataService.exe
5204	AgentService.exe
3404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dcfe8f453ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5868-0-0x0000000140000000-0x00000001401C2000-memory.dmp	upx
behavioral2/memory/5868-78-0x0000000140000000-0x00000001401C2000-memory.dmp	upx
behavioral2/memory/5868-133-0x0000000140000000-0x00000001401C2000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7396952646add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044e7c152646add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cd87f95646add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd593c96646add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e57c495646add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddb9cb52646add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bfaac95646add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5868	2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
Token: SeTakeOwnershipPrivilege	3556	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5204	AgentService.exe
Token: 33	3404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3556	elevation_service.exe
Token: SeDebugPrivilege	5188	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3480	3404	SearchIndexer.exe	99
PID 3404 wrote to memory of 3128	3404	SearchIndexer.exe	100
PID 3404 wrote to memory of 3484	3404	SearchIndexer.exe	101
PID 3404 wrote to memory of 3608	3404	SearchIndexer.exe	102
PID 3404 wrote to memory of 1308	3404	SearchIndexer.exe	104
PID 3404 wrote to memory of 552	3404	SearchIndexer.exe	105
PID 3404 wrote to memory of 4524	3404	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_b987f99435f6c7db8ee96c9ca5275abc_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5976

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3340

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d23273b06b3646a0645004dcd008972660854a583747fbf2814afa3b3613189b
MD5 a31e3a5f0d47fd8518f9c4aa7a18e4de
SHA1 61be2916f2242b7697e2893044898c42bd61ed5b
SHA512 19e1a4a5d78dd59450a8f923db1d75cefe2e1d98fef8876a55d50a4f0dcf77a0aea024971c0fe584f2594fe310ec8b4b29669b23509cb87ff702fef2608f9b5f
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxneaB0zj0yjoB2:y3q6HjBWB2Yyjl
TLSH
T14CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7b20ba5c30f38da8760fd8bb38f67f4c696c85403a0157fe1a2568466ea49d13
MD5 d204d5d82b1f4e497715d42a6c0f7d72
SHA1 2094f7ccff39b63f4fda9fbc58e4a56902fa429a
SHA512 bc702a535d587d8fef94d14c38bb1ac58bdf2792267bf52eea0077b55a22b07c0940c6517842c73d2ac09f6a657d2ae640e94f1f32c0de5bf2b45f71484bdfa1
SSDEEP 24576:TXYfDtczAHatr0zAiX90z/F0jsFB3SQkf:2tcwaB0zj0yjoB2
TLSH
T16A650229779504F9DC67823CC9A18506EB73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8b2e0f34fc410a38a0680858dc905daac1cb1e5db17c43b37a557b558dd30f67
MD5 7e9654cda942cfa0cee34a90f82d4178
SHA1 33708abc5f1a2882af859d79f55b826e879c2728
SHA512 214cdae8b9d30075261e4176918ca009d59bb3104471c0403dc7be908ad544d8f81224fa8be88e67f78850174d7761646bba8efb51518e12a6c31d1f62e155a3
SSDEEP 24576:y0Le5ji0hmxirMxatr0zAiX90z/F0jsFB3SQk1:yPji0AciaB0zj0yjoB2
TLSH
T113859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 84f2e7e42ae39294cb2774f7a9938bd7f56592f1e9ab8f650ca921844c67ca16
MD5 b182499ab4f65163d175ddf00e83aff4
SHA1 10388b276875c9275cb25597ace858012d718c11
SHA512 387c11fcb9acd5c729aff417570dc60e1782fda51c5c20a3188b862f977154ff2dc7e2d38cc233fbb718bd2e901fd57f494eeb43798866951e86f3210b513d4b
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyuzatr0zAiX90z/F0jsFB3SQk4:F/ezSC6vUzPvxHjy2aB0zj0yjoB2
TLSH
T1A1755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3018b518133d279579f0f8706ee95a549f9f763e0d5e82168672a3426bb09b70
MD5 8ecc3dcadf2a8768ce4e323e144704d2
SHA1 3315a1a642bcc72b67a721e2403d55f1e419f39e
SHA512 9389e3748c6eb1bee487abd61806e67ac50646d8fe0a3f6fad8aaf334e7b60b3ab12a087d450658e706211fb485f12c36834822e39e7c30fe22a4da416ba1d98
SSDEEP 24576:IVbqPb88hv/l+6Aatr0zAiX90z/F0jsFB3SQkl:IVO88hXl+laB0zj0yjoB2
TLSH
T13755AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 456254b5f78e6c2466fb25487127fac80c922eba6c23c9d99a05f45bdfc238b8
MD5 86e4f90f2abc780dcb57a38fb2ea4252
SHA1 8dac6f64e9e47e6de749921bdaffda079e610d3a
SHA512 749790db0f81e9c842de5c250190248b258663f1de4f19bf995c3e2fe5696a12ef9059a3248fee1ac55daa3cc6e09e6fa7d2f059bfe18936af73c06a8c29d113
SSDEEP 12288:2R9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:2R9atr0zAiX90z/F0jsFB3SQkw
TLSH
T12445230B340E80F2CEC31B3566989C4B1AB99EB065E2AF85E2D13F4F9D3C1C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 942cd481930296f2b50e4d0e945ce6545eb8e0681fd77bf7f16fd68467071f5c
MD5 078fe7c3d5b38f177daa8deebdfa0dea
SHA1 f51ac59635192d0625e2e96f6a95402c9c4a3bf7
SHA512 b869790861875c435deb42244638fdfbf7608eeb79dcfb6510774cb5c27a8194cf75850984aecb99c895ba9dc00b8790d0a3eac85b9d9082aadf8204dd0d66d4
SSDEEP 12288:SeBNUbTVO86UoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:SJIUoatr0zAiX90z/F0jsFB3SQkd
TLSH
T1DB65DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b31cb5fac819cddbe27ed960fef46e8e0dc2acd2d934d5d143e21118b390c9f
MD5 6a5ea1e2acdf07756f7d1541e51e51e9
SHA1 5eb885ee2d9d673bfc1e754430f28b9263b54775
SHA512 964a947ad7f225d535e579aa10cfedb23c43afa27f3b205ae6a34f43edbee40ee3222f52f2d233070fdb807a70212c3dc0405c1ea8254d0025340f6f81167633
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:iQvGAdlCEL8c/yRNw5CuB2Yyjl
TLSH
T19D267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 62958e7b87adbbd313ad48a3270420ddfb9c2519bc932b7eb08c3b00ea298062
MD5 d8e2a09ef55a0ba31cf4d2c1a887eb5e
SHA1 ef8d894f176e98ec4fe10a1b1c81682816e2445b
SHA512 ba6522526e73dce2e02fc51df26206e363bdc6e343373a50c6cc029f475f8004967b29f6c26f7e8150c2eaa50ad0928dffadd47f404273a786b4862f2c61739f
SSDEEP 12288:sAwSfxL/2Dc34DLLmt0LDQewsAjSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHv:RdewsAjSatr0zAiX90z/F0jsFB3SQkX
TLSH
T1CB75E031FE75D032C6BB0DB61B25C706187D7A204BA21AC3E3E85E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5067f91485c60bfb833d98a1d9140a8d4e73d0e2de33b01bd16cf3bd3f90d6c9
MD5 720eba9080ae8420e868ef4fc6289c42
SHA1 d39b33f0dda31db57c58b2975ee737a791fa69f2
SHA512 1917495108a1180262c02269f0e27f933cec62cd4436a878ca78dd8b0dfa53c6bd24ba07486f83e0eb329cf16589c683a1485b808782031b8f00dc0d64af69c0
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNZ:mUEtQevvqc2W1cpV2EI32n
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1a0dc214a2d4b5459e24122f6cab44271243530d2b31588bd362f3c2bf6cda10
MD5 5cf93ea677e18e43077807bacc7c4b87
SHA1 ca63c191dfc458da7f890a4ba8b45fdaabff59e5
SHA512 aa460434377066b704f4c23082acf5a0276b464ad948122088f697631fed9a977bfaface0dcd95541e80f31d440239f6567bbff9c4c6ad83ffc1708f7ad0c18f
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/zyaB0zj0yjoB2:/oqtVjnmKB2Yyjl
TLSH
T1D6D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7c9407cbfd806e56b310a1cbb47b3dce7fdf5000c44f9c4158ae3242e06c1416
MD5 dd207470660d113b8d102150a3d95080
SHA1 2f50b677237970b4cfe1f17589fab236516c33b9
SHA512 a933c482335702385f0f1af87f6fc921a5f60660b5004e13de48d0bd746c66b0b420e19e7620214876ab686a92d77154bdb4b08629ee88b0851ed81e0dd45806
SSDEEP 24576:RAhGLJIFoiwtA5l7S533atr0zAiX90z/F0jsFB3SQks:RAMyFoiq5HaB0zj0yjoB2
TLSH
T1C1359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8577262e9c6613834c455b841a62336b39b8a8486ea5eb6cc90fce5f1481325e
MD5 069e9abe6c5979870aa5d92ff59d94d1
SHA1 ef4fe0d2f1ddb47dfb1230cb4e25062e2fcb1104
SHA512 26f3e93988bda5810defc17ae322f54101104a7469d3692a1ce88440ad96f8e0a6e53c5c1f54de74b0dcfd78b1af5c2b551f92eceafb1dc2789cd960fba5bc2b
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:MwuoOWRatr0zAiX90z/F0jsFB3SQk3
TLSH
T12565F14A36A90CF9E9A342388647C536F7F2B8112A61DB1F1360CB5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 427e393f51720a1a265278e58e1bffd695a4206e61fc1acb79f1397b3078624e
MD5 f1da038dfaf44f6ab39c2e839ca24737
SHA1 5848e0a4b99d4067e26ee9e0cb7539853b2bc3a6
SHA512 e76b7adec5e5e9c661a0405b56099fb8fb1bacd5244385df2aa15e5febc0b3fd4d18def2f8dcd5fcb668a646b6fef47f521c3e82b2237dac9d7c4cb96d78d4dd
SSDEEP 12288:OBZ1IyCUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:IZuZatr0zAiX90z/F0jsFB3SQkD
TLSH
T13555124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ab2a885ebc4848cd4ae31d77c84674b749faffc33268036d8e31dc2fa1d9a974
MD5 ced972e8acdfaff8f13b2fab19cacfe1
SHA1 76e0206356236cbbb0cdb2acf0d9fb34d1bc53e0
SHA512 540a50ca046ba95ff05bde6db1fae0a6c9aa1b5ff10dd64ac89037b78bcf0be1582730da61a8753a76d4f00d1a1205c9b660f5fcb076a93c209a946f7a324531
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:FQRQyi36YOcPQLvw2gAf+PN3jB2Yyjl
TLSH
T10F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9519436bdb65738ac7422253d07b44f426428e309b373e9378f588ce4e216ca9
MD5 efe4a49e1c537eff0ddf845f03327eab
SHA1 23d635cb900dbd66847ba8bbf80c6afd4f127f1e
SHA512 cee3b0aac1743c0b8e49b474942791d0edfc0afb96f40aee691374fbe1e5d0a68d7acebf1c975fceef897871e6e8b3870560f588d4c87d31efe56aac04fa438f
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:GQRQyi36YOcPQLvw2gAf+PN3jB2Yyjl
TLSH
T11C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 69328d8697a0c7b586e172600121b9ae0581cb0ace2876abdccc28009ad9920c
MD5 dc26178288a5b02af6993faedae02a07
SHA1 138904bda3743216f6b1f720558a3795e2045d47
SHA512 8adea82c5fbc13faa54438d81ba80d96d08eedd24905e2934e7f40a4d4aec537a85b9185ab315644521f065d149fcae0c71aa21c0543700c80f9218e3450bd1e
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0patr0zAiX90z/FS:Q68Qg55nhheWu7PNU3/iaB0zj0yjoB2
TLSH
T17CB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 95cd98154da09caab798b457600e29ad6a9fd3653d2f5d24d112f7a68828b8eb
MD5 63655fb0d172816d08ed1b46d5d7f1a1
SHA1 f502be9984271eb4a591049e4474540b42742b33
SHA512 dd997a3583d5ef9ae2bb6f882fbd247517c68256edd7b4c5647335e231599c19142a40a05a9cf25f4fa656ab9e6279e2a7a99e29535a1cf0acd3873ead354d60
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:My5112gYy5azzVvL69nLKnhZsB2Yyjl
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 53ffb96768e969bda38d42330922ce759cf204d30c55f5bd96f29caaad2bd941
MD5 64891a691f627f46c1cea1a86a1253fa
SHA1 3f203cb77ee4d382543c20fdd4bdcda26e2683ba
SHA512 c3d028d23f089871df8d21247f42db70215a23da3c9dba730688c7bfe79d16f79c2486d455b26e593df98fbdc4ee36a715d35630184616c8756abc32d0ebc01c
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXaB0zj0yjoB2:ru6JmVxd2dKB2Yyjl
TLSH
T1CDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9211e0b45b33653da39fdec1dfa1a52749061c3159d1ae51db48248e4835ff18
MD5 d126de16f1a7189709b57367401e4561
SHA1 ca065fdfcf84383e7feb2e9fdde50e0cab3b8027
SHA512 a66cd364cb3b11978cdeadd7f5c5321c36f88967791897627333954b795dab3c95339369f1a5406417320a79abe3a7323e704d2e92890a606f533c83a1e0128d
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xIaB0zj0yjoB2:DmifPbRKB2Yyjl
TLSH
T124B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2d61e075c4fab898baba83c1db2cee2a8483bdccd3120870022f1e9b55023a6b
MD5 e94f67e9fca94f1db76317dd74937b9f
SHA1 8a6b84a4f131e54c838a47d803cad3485d477f62
SHA512 274e876b040703a50698cb42e0119a0d6afd91683ac83a94334a52551c0c0b0787023317457185ce61148da636889b04b68e7d32ab5f6e703c4de160fd01286b
SSDEEP 49152:hSuZQIY0Be2KRRVtOnks6NMHqZaB0zj0yjoB2:v5dKTi61gB2Yyjl
TLSH
T114C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8b7cfda5ab8cb5f8be4ea7d79e4201af1e3b1b2c42d0da4a466466c24a4f3b0e
MD5 b1a5ddec5b97f805f31f70aa22d8d17c
SHA1 26a2b23a8d1c251bcf582508d6a25a39211b287f
SHA512 120649e54be0554e61c03c3b7591b17d543dbee404f1a4a8b7579c21db4b8998fe6b65dd82206e841fcd32339cfaa8568edd42c13de1c91461f0900036fcc47c
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wkaB0zj0yjoB2:wX2iyphGB2Yyjl
TLSH
T15C95BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bc6a87b95d8a9be73de401fc305c00d40131382973fba033a2a1f654a5d00e9d
MD5 7469fe247b2fb7cd76261a3e11d1e099
SHA1 492996d8c5f1844e1bbc16684351683142f90c13
SHA512 898a2c06ee568a15324471185e00aa2729bb33dd699486bf3e02885dfd247bda920bf5127e551a9fbe2faf3988b729072754d8ef39c68dc7bb56ae17b06ed2ae
SSDEEP 12288:AlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:Alatr0zAiX90z/F0jsFB3SQkk
TLSH
T11145230B341F81F3C8C31B355688984B1AB95EB4B6D36B85F2953F0FDE382C616656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 14945257c15aaa4e190e51637ff454dd1dbdfdc1a1883f178022f6d5e69a0d2d
MD5 97d784f00c0e389471faf95dfa0742de
SHA1 1095fcbb6efa3526a4b0fd0456d32e1822f56e47
SHA512 9d4e41f689f81a3b8f2da69df7be1e0b7d259fea3e68da23ded39ed3860229503ef25626825bb963b8da21a56cfd9e0d312707a59c40d4a7a4b94bc4592b8b2c
SSDEEP 12288:DOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:DOatr0zAiX90z/F0jsFB3SQkI
TLSH
T1B145230B341F80F3C8831B355688984B5A795EB076E36B85F2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cb97c7f170a0d645acf42720b0922d0886639b2ed6f7d5263aeb352169f25d47
MD5 f42e95163b39033e3abe654afd3c6e91
SHA1 2f6e9972090490d6c6d1d29fc729b730631553d1
SHA512 f6b18867bac2380d7dfa3451f54ce93aa475e1e0b00e74d610609c76b9989afa3fec097f23cd50cade9b3b017611f2a3d41f1f3957738a8f07272e22c5bb1c6a
SSDEEP 12288:aQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:aQatr0zAiX90z/F0jsFB3SQkI
TLSH
T1B145230B341F80F3C8C31B355648988B5AB95EB0B6D36B85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b4fc11191625646695ed092da1aa56af9c0c08d182be0cb069889f86a1535736
MD5 f1d72fa5f100a6fba1dacdb8547a7ebd
SHA1 b2ea283dbb83bb828f27696be0dbfd9fccd25d28
SHA512 0640410e7a7bd5316a92e72426d5f4f57974518f7ade6741feae4991bcf619e0092db35427b345ff675d3d97397b7a490070cd16e3c618292ce28bbaa244cd6a
SSDEEP 12288:aVXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:uatr0zAiX90z/F0jsFB3SQkt
TLSH
T1F145230B351F40F2C89397358694884696B5BDB0A3F3AB9FA2813E0F5E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ae7c5b7b751879a3aaecbb34d97d420ef800e2ae257dccb00cff799d46e15ee1
MD5 01b960e9c32dbbdc9bba7066f6cf5542
SHA1 7c2fea1251c00ae747b572645e51436d08fd0382
SHA512 47517b57485f64172ef46483f501d10a2cfeb2b151d498afffb9098e6e92503e09a0192c6e77cdf1a887033b7654212037a879616419390c3f1482dafe1777c6
SSDEEP 12288:6PUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:6Patr0zAiX90z/F0jsFB3SQkm
TLSH
T16B45230B341F80F3C8831B355684988B1AB95EB476D36B89F2D53F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dc60af196fbf971289a728903e21d2c0132042fdec1dad4f95bac6f5d02168ae
MD5 6c526ba0942da72da41a364c73c1fed6
SHA1 2a626973172446e840ced2cd9891d6f46deafab3
SHA512 ecaf5a1930a24e2a09b34f1e6221a8e1aedbd1ef4d2164c254807c3444cfea18e0457f9027e48592cdc9f9b4cd53ffe1e79e2ac9d539b474822f36d7cba32dd4
SSDEEP 12288:46UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:46atr0zAiX90z/F0jsFB3SQkp
TLSH
T12A45230B341F80F3C8831B355688988B1A795FB476D36B85B2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 91a2cfee6e2d787e29bc79a13086630150ecd276b10401668897e3a7f65dc11d
MD5 645cd3a8a90e809f4c5c0e3a3679b56d
SHA1 a66ce6b1f96c70cbcba9b21ecd0fff57d66941ee
SHA512 0a6c8f2915d8d2e14c9df0d425c403fb1e5b681b1ef0da689692ce049a3542f679b70d421c7efa2b5ea31cd008edc0f2975698039740f037d8d4655ab1d59d77
SSDEEP 12288:GmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8I:Gmatr0zAiX90z/F0jsFB3SQkh
TLSH
T1A145230B341F81F3C88317355648984B0AB95FB4B6E3AB85F2917F0FEE381C61525ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f636bb6cd7870020a92243224c6f770974e3477598ad28ac4f14632173fe2ece
MD5 b8f8c6311c4f5a28fd501dcce0b5b35d
SHA1 03ed19b011d7f833d3b6413320409de3575814e9
SHA512 70374d35faa64ddd506363ec3436d81e1116d0455be8286fc5a70e38e61fd80ddbf178ea2d7b73678203c8b212e5b958bee16991a6832012468d00267d59d7a5
SSDEEP 24576:GZMSzFVSOuatr0zAiX90z/F0jsFB3SQkL:GZMSzfqaB0zj0yjoB2
TLSH
T1AD65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 40d47f288583ae10c2528a9a4bf672d11e0057362f90eb538b60bbab9c7c15a0
MD5 042a67d17e36500d07e5ee304ccff3f4
SHA1 1d3c055015b2edc25b5edda72fa2335527584bfa
SHA512 07f9cc4f21438286c4803a21ca62dc88a1b2ba712ee05b9759eed5b361c3f19a072c40514eacad9468aa6378a4bdc6aff760d17d33ad8ce82ee18d76f583cb9b
SSDEEP 12288:AJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:AJatr0zAiX90z/F0jsFB3SQkt
TLSH
T17045230B341F80F3C8C31B355688988B5AB95EB476D36B85F2953F0F9E382C616256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fc68f50392bcb068b216d93f5a7ee32ad44638f5bf2b110eb89c80973179a8b0
MD5 37b33cc4213766a25bfc18ec31cae192
SHA1 574982553e157b7daac3d70e9818c0aa3239a45b
SHA512 1f06ca4294a16e6a75fc894a78c5a854d6a87af1ac1ad8825b265525f913dcd00736ed5d09ca8fb590bc7a1324a792987b59604700d36340deed877c9ca45c7a
SSDEEP 12288:HtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:Htatr0zAiX90z/F0jsFB3SQkE
TLSH
T11F45230B341F80F3C88317355784984B1AB95FB4B6D36B85F2953F0FAE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a0eba25bf280b5493ae2fa948086590e9d13342b6fd03000e27e1cb0868ae085
MD5 377067235e9a48e5b0d8a0c91031ad2f
SHA1 ec96ddb5c5bc1c86a52ccd362e46d67855220326
SHA512 42aeb6556e1419d06023c0be02cc027d3717b2358e8298e37b8960297c41724180f9cb8d6eec3631ec394bd0a6df86d143c78c2b74b904446099da44ff5e59df
SSDEEP 12288:wyPz5L8CUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:BzyCatr0zAiX90z/F0jsFB3SQkq
TLSH
T1F3551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c4b0e73ef064a176a89ca69704dc653a2395019438df520dbf11e461b72a15b0
MD5 6848de80c4d953a72770863ef9e44310
SHA1 6de400f009ffad04f4cb582decce55129f617da2
SHA512 d79099c7f67d7d6d9fef63f01634a6ce191c06a9f7a4c8678e207e65fcb4c90ad28778ac23f28fd8e8f9711739098fa0ddfcdaac63eeed8e62a144ba0d46e593
SSDEEP 12288:4JUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:4Jatr0zAiX90z/F0jsFB3SQk7
TLSH
T1FD45230B341F80F3C8C31B355688988B5AB95EB472D36B85F2953F0FDE381C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 938d98459239174d9284519539ee762420dd78f257ee99a5e90eef91488c16cb
MD5 0ea5b30edbc1f6f9c4a1983ced96a8f5
SHA1 887a946563917029712c6eb5581ca9ef1ec0de97
SHA512 2e1a9104cc606a456adf787a5150f0aeae50072c34913c221cd3ab71e3ca0b8622163810d9ff48ec0c4a53b70b82089b1dac009f5c3c4c966a1eedec489a3018
SSDEEP 12288:1JUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:1Jatr0zAiX90z/F0jsFB3SQk7
TLSH
T1A645230B341F80F3C8C31B355688988B5AB95EB472D36B85F2953F0FAE381C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 26ab86330014bb2926af8b9d72625fc663b87b487a6209744e29dd6d5c2a968a
MD5 95bfeffb151cba334aa5a32585dcd77a
SHA1 3d4459912312227c5e61dca098c86c4e932ec078
SHA512 0341f6ff42b1068127960db310e0e6ac77c3357266f9df1f4fbc387ca839a47a9a9b7da20d37681b87f6bbaaf6ea97765c39066ef3ffb3f930c8fc546b759808
SSDEEP 12288:JyPz5L8CUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik84:ozyCatr0zAiX90z/F0jsFB3SQk9
TLSH
T193551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9c9e1f8158195d858f804d4d7b99173e8d07f1462fdae7b4e70a5f82c551fb3c
MD5 c404e386419862b01f8e7bb119335f75
SHA1 e771fac626b6d0ac3694174252454ba87bdb567b
SHA512 d88b6e62ee4d70314dd5f98b50289452bdc994c0644d1a9ad5cbebc46e2d9001411ef684284825313a6154b84ca9fa7117109f81ffe2d0a0958ebc5d8149e5f0
SSDEEP 24576:eTHaLl3z0zDgatr0zAiX90z/F0jsFB3SQkC:eT6LljzaB0zj0yjoB2
TLSH
T1E2650199735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 24db46d3b5d8148641fb50b033d2edd11a8268f9ebbb6724ae69958dff88f819
MD5 5ac1d5cd7a3056c9a1b1a5aacc73814c
SHA1 2248fa8090cc7a94c3336fcd28c8ba6cdaa9b96b
SHA512 7851096efe9858c4e74324bcc22f24f3ff356cfcfad3ed0316292ab5a88a65f3a445979d7448560c5f4f7d91d3f2d6378972916381a599a0bdd23d8fcdc097f7
SSDEEP 24576:s37d9CHKy7GZMatr0zAiX90z/F0jsFB3SQk8:W7d9CHKyaqaB0zj0yjoB2
TLSH
T10B75CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5a28434af70e988ee5528a8fd54309c69df59b0e7fe8b4eeb74324d7766bd5e5
MD5 71c4e07fe26bd0c9e2f53abdbe57a736
SHA1 c67d29bbe4b53e6650d2d2313b7bcde42d73b4f7
SHA512 5f667f62b4f9e76d28d0a292ed5c366decc7d3a7936ff36faf3f8c4bae3b68eb21b2643d2d2171df61741908234821955662a9d5ec708bf6b6a713bb712891be
SSDEEP 12288:LwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:Lwatr0zAiX90z/F0jsFB3SQk6
TLSH
T1DB45230B341F80F3C8C31B355648988B5AB95EB076D36B85F2D53E0FDE381C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 838f26abf5242d192571fa2b4b56ccae69f50e80164dea04bec0a2dd1b2d0237
MD5 0b15f99556832199ee5c7bc6e8d73c95
SHA1 ad9dee437b333998f64fe2b787de094e4c7a8274
SHA512 bd4f7321ba9f76df4de3048b5b92ace14a66d27831d7c0ce69eba7e696a7f1608ad6874cc91cf98cb341d30bad5475c055c7c2bfd44aad3d553ba39c094debfe
SSDEEP 12288:SiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:Siatr0zAiX90z/F0jsFB3SQkS
TLSH
T12445230B381F80F3C88317755688884B1AB95EB4B6E36B95F2D13E0F9E3C1C616656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f8f90cc6b78bea9c58f21b2194fb7df6e17a40ccd7c9700cd42b5e49abeee119
MD5 26d4e2d6bc50535d0eb2faa17fee2894
SHA1 561162c1c5bb49ef3f790696024c2037d09ca0e8
SHA512 abb661d67b5366ca25f7508bcfae627497ceeec85e18e828c388f56049194880d70d13f59bb91b523e6821ef7e1674637a5ae10734bb5bec0beba388f975bd26
SSDEEP 12288:bLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:bLatr0zAiX90z/F0jsFB3SQk1
TLSH
T15D45230B341F80F3C8C31B355648988B5AB95EB476D36B86F2D63F0F9E381C616255DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8356b3212ef444e6c7e54ae00d3fb06693484b60c21b041d97acceb80dc967eb
MD5 954ba6a5c50bc0b2cec4ee35ca42dab5
SHA1 bd9d104449283aef6cd22d5f606e284daf8854c6
SHA512 f017ce529a4494086cce7d7e5b68bb926930189d5ed9a0e6777cef82882d42fbb621e44b978e2e65960225f6f4e5ae2b0a839face625ca546f0f1d3d5216903f
SSDEEP 12288:tJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:tJatr0zAiX90z/F0jsFB3SQk1
TLSH
T17D45230B341F80F3C8C31B355648988B1AB95EB4B6D36B85F2D53F0FAE381C616256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3f1a8f90e7647118a6ba0906fdda299351fad1ae433315dd858a34fa6c9feba3
MD5 500e42475077d20ec0fd443c38f70d0b
SHA1 e2e5650eef2f4b4cefc5d68dc6a805a43646ff94
SHA512 55c751a9e4f7d6aa6d5fa7e371bfd66ac96e9cea6c75bc15571f72bf78caed8f7d04e745c2c749fbaeedd3be066969e0c7f58325a721e13d2b06647248e67c00
SSDEEP 12288:pwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:pwatr0zAiX90z/F0jsFB3SQkv
TLSH
T13A45230B341F80F3C8831B355644888B1AB95EB476D36B89F2D53F0FDE381C616656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 19e54577316d54d29b185a81f6ea63792a7af14ee142f88598a7015312268b07
MD5 a8121b75dabc898d3d9789569967355a
SHA1 7f50f5f9887fbfc50a0743c7e51d4ef8b192609f
SHA512 c38a50f6b0b4f25b7c1d6077355cbf7c8b00d33a68f3703610f22705a57f854a606871913405975d85f7932e388eb412216fa20830178e61f516ac97ae980471
SSDEEP 12288:NBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:NBatr0zAiX90z/F0jsFB3SQku
TLSH
T18F45230B381F81F3C8831B755688884B1AB95EB4B2D36B95F2913F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0a37dae3cec2bd53f29b00cf43353a649943a915d36c38203e538ceb30382eca
MD5 679fabc90779172f63c2b029bc54d6a9
SHA1 77e8e562e760da1f81e4a414bb8d34c58e393cc1
SHA512 5f5554dd3903d76217db706eed11e30701b0eafdb97110bdabbe05303ebb1fd64b8ffde0fc8349c03d9ef59792cbb9381f3143ca95189d0a629072cb66efe3b9
SSDEEP 12288:7PUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:7Patr0zAiX90z/F0jsFB3SQkq
TLSH
T1AC45230B381F80F3C8831B355684888B1AB95EB476D36B85F2D53F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 73b91be8b5f3ea4f7e103ff2d7b217951641098d2f74138e16a69105531c54f8
MD5 3b0d5cd331b65e2b2ff9b504efc0793c
SHA1 7d08b371ac1b6383bbe8e69060f82154371dce23
SHA512 6ada115fb2f47ead82f23304b43e59345911cf26bf99aa10bd29e1848dcc479b34f62241b66978533a7f40581e2f914398257cf594f9181fb7681cfcc7959726
SSDEEP 12288:aYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:aYatr0zAiX90z/F0jsFB3SQkV
TLSH
T19145230B381F81F2C8831B355688884B5AB95FB4B2D36B95F2913F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6822c9d3ae336927b64098092c916dcce98e34100c5167e74979321f67ee0a27
MD5 eb0f77eb2905b8856ad6d3b66146414e
SHA1 e741b0eaa49b3a3cb60fc12ee7d6deb35422f5a3
SHA512 c4710dda70297d2b2c057a9c8ded4b33d2e6a7cbbd939fba6ccba3b23074c9298c62fb104739f6ec687307d1eb120f5fc07ca41616475a422affbb70cceaf441
SSDEEP 24576:1fwvok9RX6wkyAIKatr0zAiX90z/F0jsFB3SQkV:zMnYIKaB0zj0yjoB2
TLSH
T15C85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1a7c7a1060a4919452818eb5c3a92cab37a86ff571b9cf561a1f0b9383769589
MD5 901b0027c71397b43d3ec016d729ad36
SHA1 417444614ed389e46b7e1bf3b4109271ccbb6f28
SHA512 698ab9c2945211253ddaff7b95f489b45c2903dc0af67d3daf7120be9b93a6b00d897eacf46b7d8d11092639f7033e31ab8ba0a7062b3ffd7bc72efec734cc39
SSDEEP 49152:zYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EaB0zj0yjoB2:3ySzPDB2Yyjl
TLSH
T163066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b4f83d5deb0c0ae5a2e3be947afbc860ef96810c4bd36283b8ab643c421fe275
MD5 9295d992b81070b7d526b7ac5d3dc59f
SHA1 64a9c74002d87191acc6744c8396632329046ecc
SHA512 c906a35e182620ef5357926d235080801a753ae51716cd69acb7b6b84861433a2ec7058de7d0e31d62945c56b5a853786f7f8966ba8659df2a3ff139a21bdeba
SSDEEP 24576:b47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYeatr0zAiX90z/F0jsFB3SQkQ:b47JUQj1irIhCnDHUPfF/0aB0zj0yjos
TLSH
T1CA65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0a1283141c54b64d41b4bd8902e8b87ed184f5680eafe27096cff7fe3c2473ea
MD5 ec9cb1bcaab7f48b4818eed001bf5379
SHA1 07473785f3259c491bc8805c9729463171b3e38d
SHA512 c43ef1036a5906773f9d14f8921706d4837f7f7e3ec045b5f2fdfe63b8f70ede343ab75a96931a40c60f3ebb02fed5eb7f9699a6ee332985e1bf276067ff572e
SSDEEP 12288:9NsfZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:SZatr0zAiX90z/F0jsFB3SQkz
TLSH
T17F55F00AE25802E5C0AE6235C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a161c7ed1050c049d3572fe01ddc2aba979c54c3ef6d78d4617084cf441c392b
MD5 c89cd5901a5756a4ca89400f9b30390f
SHA1 5788320542235ffe7fdcc1f029ef1ccc57cf172a
SHA512 2afde62ee31eb6282b51852beff1d96e60ab1fc22199e0488c5dc6276eeba0da9327f8c0ea10fba16e04063bc875c576ffd9fc4fdb85a45f6227af06747f692d
SSDEEP 12288:qeZBZFcVU3f1DDKurE2NMI+yzSUnjoIxnHL88F:quHF8UP1xrEfye4joI1HL88F
TLSH
T15035F6007626DB8BC6A950321E36D6CCAB70BD02FE05AF1372C9473FD476659B6F1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 cfb9d993c8cf65edafd73b9254f41c65f65f3bc6adb70c569dc1c994dd33857e
MD5 a12c09cd6f2a8d21cdbc5ef9e30e625b
SHA1 7dc8d520cb670195d47528dccdf14098b6899d66
SHA512 2e39b07eb5d9b52568f2df6a86db728ea381bae3544476c2f488252c632fb5a9c6cb2e40e38aae659ad69268de43903b10993dde9d0bae14ad38b05bb4e409b9
SSDEEP 24576:15CxuCfEEqdup6zplJcTmhy3TGrmaTHvRMkJzGQ:axuCWzt5lJF
TLSH
T17B853A015577DB4FC9BE4037463296CDABB8AC02FB443F027385893998A795EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 c543b3d791c4f39277b2eb7694f6871925be1da498750119211b6db48e4f5f2c
MD5 9ebb8fa1358cd9b744a138f9ddeb138e
SHA1 40e91734d89f5c9878da9f7dba05d8cf3b1fd897
SHA512 0f78f9b68ba7ed631aafcadb299685d776094f26608324ad7f022ee281abc81d635d90b965b2fad0c41d548900fb7feeaf0cf4931f7cba4716b70416ed338481
SSDEEP 3:OlH/lboStol/EGUKel3y8Dl63mCllltGlslslslslslsl69l/l:Km/l/MHMmCtEEEEEEEql/
TLSH
T1288192240F9217A0CB279CB4006487A81B16E386388A879B8926A07A5C0096A0D01A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4b02ecf1f13215253810ddb7262a228bd975649392ef4fe3355a3a266aee568a
MD5 7b95aad3cf177cc59dc4586d42e9c99f
SHA1 a5311b88f52308087e8059dda820ff047d903254
SHA512 036cb1ca9b5c3228ba97666309c28f5727f710fa6b26e1c51e7f5bcba1b1266a8c41f822f967b45fc38f4c8c52ea96fcf3aa5c8c80cad052915f453f97864128
SSDEEP 12288:3M7mUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:Mmatr0zAiX90z/F0jsFB3SQkQ
TLSH
T10F452307351E80F2D8A32B3412588806267EBA746BD29AC7F1813F4F9D386C65D75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dd15c63fad85064f892c2405f598f0593fbd99915c884f2c08f942dfbfeb0e85
MD5 f90d1a9530b4576c839637cc27fa395c
SHA1 d82cd6356d646c3c70cec1f6bc40d318d64d1fed
SHA512 9734a1ec310ce0148666d61292cbb572336c05674dca85909db77bf03622ab2dfd645ec6b5ae09ecae51bd28fc519bd513ba0c19a814704aee5a99bf1349ff3d
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYzatr0zAiX90z/F0jsFB3SQkY:Vgb4mBIBhGFeaB0zj0yjoB2
TLSH
T19C65AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b8745b3cb51731c08bdc176ed9fe598f2a897bd3bcd1f47bdcd88fc1f72ebfd6
MD5 8a045a813422687dbd55ac79a00e6951
SHA1 fb540c3c02afec7fdaa2bbd962d132fcf5928e56
SHA512 4457edecc7e89a16e9aa6639c1d19e6f655927c1bc5defac4cb0bff238be254de43a9cef9c0b50f1e3c7b70f46bbdc91552045f9ae0110d3958fc00723d75234
SSDEEP 24576:iG88u8FpJqH1bzria7/mJatr0zAiX90z/F0jsFB3SQkZ:57ZFPqVea7/4aB0zj0yjoB2
TLSH
T1B885016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 233e9a67bf99cb779fc951ffb1d675cb0f7e439a98d6e9d18e7ae34c9224fe5a
MD5 cbe65305c58e1128ce8f5cbe7e557a21
SHA1 490066543f5e9c4ba86ad842c1cd2a13c0c840f9
SHA512 89fd07caef380f87a25e8103b4d77988a431232256f9411c7026316b30f7fbf9f3ff168841f041df06f84201dff4f0ba8820e6e2a1b0d28d18021909814b02fd
SSDEEP 12288:aHvUrBFrEjwaQNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:aPUr+NQNatr0zAiX90z/F0jsFB3SQky
TLSH
T17E65E11F22AD18E5E677A13D85818609E771B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5fc9d417cbeaaa09a846464afae95c8aa3daa5944ecd655a00cd74e257f346b0
MD5 09b213a39ff012e669f43f04d5bdaffe
SHA1 5441f06ae27330018c85a8cb5cf1217dc8c5e122
SHA512 28f8dd86e3975b50557d9bed7644aad5e34dfe6f4f0cc26158f8bcbc441378430e94ff21daa7ad3316ac7deef7c661c952bc96c96e4d67a682661705587895c1
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdaB0zj0yjoB2:DG05lO43bFB2Yyjl
TLSH
T1A6D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dd0ee8a75f66f686694dd0fcf63799f572ea842ea518711b4a0b3e237004d86f
MD5 f6cc42956d41af6a451f416cc880738d
SHA1 bc0d762f0cefc79e386f98d3903d065477a210a4
SHA512 372066bdc481f3f6a41966e7b4bfbda7b772550f09477d40acf7c4e869be18a5acd7ebd1a2f336f80f846b85d36d32b1eb75848b39b47201cd48af0e21fe3487
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnEatr0zAiX90z/F0jsFB3SQk6:Ea5POZ3+Jt2pasx2+miaB0zj0yjoB2
TLSH
T12265BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ea4e84286a5c41a78d338956bb8f15606d6423b8575a50ea6a3c72c87d708f45
MD5 97a8053735fedd48011a3645da98b4dc
SHA1 7bfa3018710c9c7ed9ad5af19035c01a811f7264
SHA512 116d53d89764027b50291e6cc1c2194a2b2950251d81a7d0fedc5ea83aac9e11d328a355cae1fc7f5f61d99551684ad0172996594771acb4582957172597293b
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fkxatr0zAiX90z/F0jsFB3SQkp:TNc/zEOVHFYaB0zj0yjoB2
TLSH
T11D858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7b7236c63aa585290f9fd2336c3585b691986bf955d913770c9be1bf5be9d151
MD5 7730f6f8b4a66b9520b438a1c07c67ef
SHA1 debed61ded64afbf6bbdc13bd21a3d064a5d154f
SHA512 ff4c84e6f73e9e0db6c19ab72ff0cfaaffda1a5f0aba736a6ec0ceb13534fd8625834fbc4e8ad432473acf15635fccf49096be440f6ddef5b489d4a0911f6262
SSDEEP 24576:28kNvNnaFeYhJNtmZBmTatr0zAiX90z/F0jsFB3SQkG:28MwBtOmTaB0zj0yjoB2
TLSH
T1B755BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8c143c187241fa6c14a84c9692e8bbbe19dbcf3345534b9b58f728a105433c48
MD5 3019d8b45ea172070d96f6b06f09f0bf
SHA1 2dd5f4702c6ff259aea2d52875b62a84fd596f43
SHA512 b8440e5b7fe422b93f20e76ce8f5b0ffea12c42a97baebd51071c59d6baec2ec1d7352ecd3546558c6db011d73abf122f083a24d242c73caa0383f781f117dd4
SSDEEP 24576:lD3FHshBIYQgAyatr0zAiX90z/F0jsFB3SQkB:lDVHeBIAAyaB0zj0yjoB2
TLSH
T17575E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-49-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/688-56-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/688-55-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/688-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/688-60-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/688-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3340-116-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3340-326-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3340-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3340-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3340-122-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3340-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3404-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3404-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3404-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3404-329-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3556-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3556-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3556-30-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3556-31-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3556-24-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3584-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3584-342-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3584-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3584-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3584-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3584-110-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3608-340-0x00000143D0950000-0x00000143D0BDB000-memory.dmp

Download

memory/3672-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3672-81-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3672-322-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3672-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4264-294-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4264-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4264-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4264-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4524-415-0x000001B912850000-0x000001B9129D3000-memory.dmp

Download

memory/5188-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5188-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5188-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5188-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5204-148-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5204-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5204-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5204-142-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5204-150-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5868-19-0x0000000002B70000-0x0000000002BF4000-memory.dmp

Download

memory/5868-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5868-133-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5868-0-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5868-126-0x0000000002B70000-0x0000000002BF4000-memory.dmp

Download

memory/5868-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5868-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5868-127-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5868-78-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5868-12-0x0000000002B70000-0x0000000002BF4000-memory.dmp

Download

memory/5976-93-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/5976-92-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5976-98-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/5976-323-0x0000000000400000-0x00000000005D6000-memory.dmp

Download