b36f28ceb9cea921ddde06a3f4985ab09dd5ade421bd5ccede21a16cd5b83ba1

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample261102-lsla2svs2m
SHA256 b36f28ceb9cea921ddde06a3f4985ab09dd5ade421bd5ccede21a16cd5b83ba1
MD5 c08e0daab736ff86589b7237a4194959
SHA1 aa3e1024b8a20109e08b2d1d564d711ffdc95151
SHA512 275bd148690896ab0f4561b58b1ff16df16a6591705275c7622dd26115686b5d4af7f5bc12e76ed50f63c1c8d9d50c2d95a00e1c94cbee4b540dd0f361736ab6
SSDEEP 24576:6M1mrPSIwwcYqYnQ/tbw/2Mkjy6Fr7g0oQ:6M10XwWQ/lFTjN4
TLSH
T11C75F12DE3A495FAE5B7D13CC8924507E6723C959BB1D38F0791195A2E333E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4516	elevation_service.exe
552	elevation_service.exe
4444	maintenanceservice.exe
1580	OSE.EXE
1188	PerceptionSimulationService.exe
3276	perfhost.exe
4616	ReFsDedupSvc.exe
720	SensorDataService.exe
1480	ssh-agent.exe
2716	AgentService.exe
5096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\58ba010331e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000325c5840af6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005510ae83af6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e538c683af6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d154d841af6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
552	elevation_service.exe
552	elevation_service.exe
552	elevation_service.exe
552	elevation_service.exe
552	elevation_service.exe
552	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4924	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2716	AgentService.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: 33	5096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeDebugPrivilege	4516	elevation_service.exe
Token: SeDebugPrivilege	552	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 788	5096	SearchIndexer.exe	101
PID 5096 wrote to memory of 4176	5096	SearchIndexer.exe	102
PID 5096 wrote to memory of 548	5096	SearchIndexer.exe	103
PID 5096 wrote to memory of 5472	5096	SearchIndexer.exe	104
PID 5096 wrote to memory of 2972	5096	SearchIndexer.exe	110
PID 5096 wrote to memory of 5764	5096	SearchIndexer.exe	111
PID 5096 wrote to memory of 4292	5096	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3276

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2756 2776 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2756 2776 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e1bfd80cfd47919b8f8b3f7301c6491282fe15e84c0368bd749d0da4c559c2e8
MD5 b09e73f782d1229d89be7b92c35da684
SHA1 8c94ff43ec37860407af4b7260f4ffe33b3b00c2
SHA512 754c7487670b36ce60f418e701c4ba58fe0bea542c175665cc45cec3b4a43bf28dc368840b7c1903412ee87be6a053c14550916e6240c3d58bc7224ff88d1a18
SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYQ/lFTjN4:Y3q6HjBsLm
TLSH
T1EBD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9eb9e9747bc1039833b8f3ca89880324bc6b20de0fe21677689e09080abca816
MD5 28f85138e289e775d301937cfd1115e0
SHA1 9343b9803c8abbd32c238605a112240452d5511c
SHA512 07c08bc3f17871e1221808b075c93c7aaaae1a20148f9a327a83662a893c5baf49f8a166cc27dcb1d99e4bf3fb7fc0412e109ea8e9d624f3dcc4bbf4ffd0665a
SSDEEP 12288:n1XLsswWkxy2lRq2czAzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:1XYfDtczAjnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T14165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ea4a71b6e253a55fa575c7e8f709581bb8f6847fdea258c501a22381fab1bd9c
MD5 0b93f2df6a49bb8b779bd7055e04319a
SHA1 3b63a3077c2c1ca975c30e43b51dbd6f2db79156
SHA512 bac3f57b86aca9d44f585b16c239bdf28a6d4d9af2c8d70e794849c1d39bc0fce7e5c85b62cb112af3d261f6ae2606df0051d03dd3d86b7bf4649c0f3b8787a7
SSDEEP 24576:g0Le5ji0hmxLrMgnQ/tbw/2Mkjy6Fr7g0o5:gPji0AlFQ/lFTjN4
TLSH
T1E2859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fbda4eeb4919ee153f5f5c4a13349479648ffbb9db6558917033f4107daa8a6f
MD5 96a152ad4ac18f1897b54f4ce5a39b74
SHA1 b3ddb03217330877cddea2acdfc9c50dfb198ecd
SHA512 9b9b9d9d427a4e82ed7e990df0d71d43436dc77127e9ec3ac6f836d5fb7cbca98bbd455cd927272b3c3aeadefdd43a56e4755ef6a6bf114cb1a23786c058bf68
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuWnQ/tbw/2Mkjy6Fr7g0oD:+/ezSC6vUzPvxHjyBQ/lFTjN4
TLSH
T133755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e240f46c686705b99bb0fc5d4c539e7133c7cfda39dc8685b0ec04b0c3cb7dab
MD5 8d818a24898eaa6e758144a0aea891d9
SHA1 aaa03f0912b8db97e3e29e521a08bb9ead328838
SHA512 ca49d51a171acf91b0532bc211b103d50c4daf63cb69909a8c0caff3acd06c36a0a2038c5604f903c8ca002530d440bdd380b6bd81b85f82b87a078941cea713
SSDEEP 24576:UVbqPb88hv/l+6XnQ/tbw/2Mkjy6Fr7g0op:UVO88hXl+cQ/lFTjN4
TLSH
T165559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9f19efeaec8b4b1664f7e6c46f3f24c35a01f36e4fa2f809d11239a2c9ce0a41
MD5 f95a6ed4bc0eae399fbf072d6683d08f
SHA1 1cdd359a425fbe953a0e8c7b08b1e98accac73ad
SHA512 9773df2e03d0b406780e13df04c84889f296bb6f28c447958c43697c6cd9c91c2d42e06c538f4bfc3580fc67dae35a3c59bba5a0ef785da4b72d0e38b19d0eec
SSDEEP 12288:Dz0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:DzUnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1C75523796A24F897FF2B06B15C9284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ea55f642694c5f3cbfaa0f5859aced811b3f4147096897497e2d51983130a5c6
MD5 4ea0e8d946fb43748344b15bb62173ff
SHA1 b350c19c5c86cf1edd16abd8f0b7924ace1c649b
SHA512 9cdcd385ac141934581bca81b628dfb9138a3ba9a77be7680480e096fcd6e5b347684cd9e5d0be9fe948e6d03e0d855451187408526c875832308b5642041b38
SSDEEP 12288:UeBNUbTVO86UfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:UJIU/nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T19375CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e55eeca67bf37fb2b31d0c6fd3365b5922825a328440b7990e0d4df8b583b83a
MD5 f40a0bf5aa72b0dd9289958e05709578
SHA1 199d0cca2047ea737776f82356cb5bbd5d58d678
SHA512 6e178a0a8af118fe20bb528531cb6bbd40fcc5120fe68e99eaa2cec0db991c35776f4b38f7e9fc20f4cc412a7227f6a8eb0e1e8ae2e183d1fb0eb3e3e9cb220a
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:/QvGAdlCEL8c/yRNw5CxLm
TLSH
T18F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d128bc84c1f161a2a5b27d5090ee6fab4b1e6aaf72efdb80d326c792c636b1d5
MD5 6ef60485bd51a931f749d684ca13e48d
SHA1 ce4f3e9e359dc7995b2db5d589685bcfb4f37bcd
SHA512 9a423922b3997e0af86369137044b58d0c3e16c00f264c0260b2d110edd7355983870a6541b136be65e1627197af2bf5a22d1b6e9f5db8e9cb116d3a2e7f2c1d
SSDEEP 12288:mAwSfxL/2Dc39DLLmt0LDQewsAj1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgl:7QewsAjVnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1E475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5d44f35393c0fe44ed3df4db666af4e844f52ad58504b8a8b28a8c294d295fec
MD5 3f008552cb06b4695baee7f42feec26b
SHA1 36a20bd8b3cd72d36ccb0ca359ae72b70fb704bc
SHA512 9f7980fb77d7bb65beaa1f50571f59bd54f4a4c752b16953e0a6c5b76ee13d83abf5d9f1b09a30845dd3cc9d272cd2e837dae693d430e7cec960ddab7f2482ff
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCL:iUEtQevvqc2W1cpV2EI32
TLSH
T1FB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ef20f89e24f25df3246ee2e01113be1ece636a62a7999fe64b205e92ab0a27f8
MD5 e2ceb1a6fda5c62937c2d0af52df7756
SHA1 ea6fa03b3ba95e4f7a4b09d486d0161613bf8be1
SHA512 c62ce96e022d38529ef325ec198440f86c2ff8278f8d1e62f474db2885a2c97bb5823376b4a94781b52f74a4aef8a1673e1c0b1e2e2f5cddf86d1a0b08302193
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/z1Q/lFTjN4:soqtVjnm9Lm
TLSH
T1E0D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 813dc30a3882834876236f73ba5a0e84492d3e309150578cb0b1e8bab6c8969f
MD5 e265dd88ba8f2096412563f3782feff2
SHA1 fa1ee37054b9924cd9049bbd370af0545759974d
SHA512 0402bb16d165fe4781e1f9c2945ab1b8559848e55bf99271e55f2220e269ed730a679b18941d3254e7d5795744e9a908dc4c48f9e96edd2a822b561b5773dd65
SSDEEP 24576:oAhGLJIFoiwtA5l7S53SnQ/tbw/2Mkjy6Fr7g0o/:oAMyFoiq5CQ/lFTjN4
TLSH
T14135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0c530758f09db4cdd14f7e1d468ff08bd230263efb9c7c5a9a116807af4cd213
MD5 d389fe4265e5b98d7254c7e9dd207a09
SHA1 5a236deee842a4d3dae209c78a124f7ce9eee194
SHA512 c313f017a03d8d18fb9d6d73ac42937d85dcd271eb9f89ed397bce4d3bdf998ca1c7acdaa964cdee5b863fa88838672173b07d344c115d0ef531501b104e278b
SSDEEP 12288:fmw5HEjsChN2BFgl0WDm+CWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMn:ewuHOWhnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T19965F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2470c7664ac0affede8f42b57ff55c18c05fccce067668e4c1f8e5a6c39320cf
MD5 ecafc88af9df56110a473b2073179dc8
SHA1 94aa6931abd50cc8d3c11abe005f8337bfb8d588
SHA512 b26e0968318a81bec465020e8157eb18978edf3fa4330f8cc34b756c3f20370be09ee90482e1d33f331d59e05f10fdf8a323f4f38ef9e7ec1790652eb1d2e786
SSDEEP 12288:DXZ1IyFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:bZuonQ/tbw/2Mkjy6Fr7g0o2
TLSH
T11255126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1af03aa94239ac57b5ad18222e7790c4b2d9a8e261479179a8d034300008a154
MD5 d252420adda21a8f00618b5cb312fbc2
SHA1 1c3a348f59f88aaa4ba2851f7f1f8dd438833893
SHA512 d4ef4936343dd8417c027a432c3d6d4805d730efbeb2fe7c1b2ed9a65744a25a7b52320d15b473993fef3116c296bc003855fa12bf09aa3208f589e3ec259b1e
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:fQRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T120666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59bceafead6c4fd9f84024286abbfc9a3e95bbebfa0f1b09ed6c442f9a8c9fa2
MD5 d7e9b13e36750bf257fd63323a2de560
SHA1 4ef7e5575b32c44dfbecc739fe3092a72459edae
SHA512 fb1c3fedf36b6a841a299427055f35bd2b4bde1bba11f17d56be1a8563e140b336fc32c9f4f44293f5e9f7b98401880a38e0e0026397adb58e8fa96f7e0d3729
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:NQRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T1C3666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4c1aad4403a7a25852147f0fc72b1ff408002a64c2f8cb27aff1a3f207da03b1
MD5 cded7b62b2fcfa771a0bb99253a903cd
SHA1 57aa4206baa0f9bcd1b40403302f57a8091dd05f
SHA512 b7559ac5d4d785139eac6a3cf974c3bb277c26ff235731cb28d00ffaf5309a6cd1e3364b199747b5105efaebc486860ef1d1f72e9ac80482d9a68f736b48d418
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YnQ/tbw/2Mkjy6S:068Qg55nhheWu7PNU3/FQ/lFTjN4
TLSH
T1C5B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b61cd64aefb7ada0416df435f91bc876e80807a3f0b61bbcd0e74fbade86c57b
MD5 043c983819a8b5e2a53b86e70b122271
SHA1 bedc7d11ee8150b83b570de00547d2a9c3b2467c
SHA512 742dd111e8c2936a6b77d664e13d4e3b8205560a5bf2bd20fcca3a87dd5b8c03459e32cda58f461d93c74b7baa697f802dbe0d3b9b1a4e525f271c9af778d75c
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:Iy5112gYy5azzVvL69nLKnhZHLm
TLSH
T171167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3afd2b04efa0b1e793f985e53aef87b52c89c31475e1c65082ac6040e01fbb54
MD5 86fe8c0287a9573a5424318de4a31d49
SHA1 102f46ceac44583ac76c9338d087af680b9a9416
SHA512 c6676b3b16279f58f9f60184893d92ef8710716932e1b13cb3ca31a3bf22e16f3511e670e9fbb5a2fcbb3cbb93f3a1dbc00d240ee545a45cabd35857c03d66b7
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTQ/lFTjN4:pu6JmVxd2d4Lm
TLSH
T184D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 561faba7efb925aa00fe36e24dc24a8521032245c163d235eb84ad8dc3022054
MD5 a79cc7de8493a1aeff5e7c25820072e0
SHA1 ec38dfbf7296ff22ac117ea39a83bf6035b95038
SHA512 bca93728b09eb801dee5bb641362a90020c477b5dc5102001eaf920aa38b0fd927075553a8e7deead611bd7951faf7224b4abba4231e04643f4c6bbdcecb18b7
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4xfQ/lFTjN4:imifPbR9Lm
TLSH
T139B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 693208db7872216664320cdcb969d6b40d0bc7cbc2f3eeff1a06d2e1473e8abd
MD5 d800c16fabe0ad0ea4a47be2aa77d587
SHA1 769b27454599980bcf7eacfd8392f2ce7a852782
SHA512 ff58b05cfff6b9d8cfe67b569e42bddf118c91e7f752c47db76ca6514b9967308ccf4bd18c9acf66cd7a5ed5e19a97e21eaf7a584eab45fd7c8b28386440cd97
SSDEEP 49152:sSuZQIY0Be2KRRVtOnks6NMHqoQ/lFTjN4:O5dKTi61LLm
TLSH
T113C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5c0d661ed810932f2a6c7399afdce2719f6083c206f0cbb36affc23eb8953b95
MD5 907a1f7d01378c34b861905826cdaeed
SHA1 33906fb62c76e6e90d011bc469646b95a2034fc4
SHA512 ef6d22f7abc8cfbe8859b188895b51a3e147924c55a1072a247fc212499d70ba3c8fed75847d0296e266a1c57f1259549f8d1b524570564c0a500936c7cae7c6
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5wjQ/lFTjN4:JX2iyphZLm
TLSH
T1EE95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b54c754d89db6bc66a88dbe227d3f079550dc2b405dc526faf0c1e3b51a70e17
MD5 0d0e89537246de169b243eac560a0490
SHA1 effb4dcd35dc08746c42db2f5c00169c58244ceb
SHA512 90ad0ad83b579298af8b28f3eecc5f6698b7b6bd8b37f4646c60833960b4a1a513f9b099e45b8d34aa908e5fe6ef066d3b680904f2027499b30a3dcd5fd13ca3
SSDEEP 12288:fcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:fcnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1A75523697964F98BFB1706F18C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 81a02b56dfa10ad809ba251a444963e8a22b1c956e99633735212c46ac85153f
MD5 92468439b50ee8baffbec63cde5596fc
SHA1 fce1bdfa862e657d6cdec7a74378c6c954e03766
SHA512 444eadb8a30bb1ae01aeca30c9493f7a82b6ec9615fe199117916751f1dd5febe7c7b4595a347ff38438e49d2c27635f5fff7e6f5eb39c45a7e6838e05cc62a8
SSDEEP 12288:apGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:a5nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1755523797964F98BFB1706F18C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 99d1d0c290582ea1fd336b712e1d651beef2bc95f28140ffbc3818a3d0da3b82
MD5 1329445a7a7babb60466a95f8799065e
SHA1 dcaa9154488abd6a16786904aab10d6fe62a5c44
SHA512 1310420250c8b3815d8628fa8380b3b9ea731c75cc6aba1af9643605f7878e820bee10700a2138c5babde09bfaa91684ad6185c08fd03cf8578c716454114499
SSDEEP 12288:2nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:2HnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1055523697965F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 23765cd61a46a8d6aa423346fd1c4af4fa209f4001c1b9e3a5436a76a2b93ea3
MD5 08ee47e9d2d66c634450e8805af1e687
SHA1 1609111090a6da689942e1d2770ad15bceae35d9
SHA512 613cffb22311976a54379d1d8ce15ce267e5ce875ebe1ebd2c703ba53c76af9df4a37d180f57426cd4cc9968c7b85afa3d78950f2afd4e11d8aede7819f0032a
SSDEEP 12288:JVyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:enQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1865523693A69E4C7FD2742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e0d222cdef788df9fde9d3a92235b951144bdff8e4930782b2d6ef1d14c63244
MD5 dfd5922c5e6b3c2c7a5edd4562440ed4
SHA1 8ce06a853387c9b2388d1419b4c2952dd912cc82
SHA512 f8f906c40e5c5b7c2440a38c6f062432a55566febb8db14a4018d43cf31ed9785ce5f3acd947c1716cfe7cb1a4f645a8d77f5fcc292570d6d27fa15e5e9af22d
SSDEEP 12288:NKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:NKnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1565523697965F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5bcb436b207d355a4d558118fb4fc4c9394f6c4492928f9d62e7f66e3649f636
MD5 e425803eeba0f45744c81c091d54ca86
SHA1 5ab71df9ea495868b81217a138b0529f8fffd1e2
SHA512 6510801dba855b6a1cedee86d49cce7fc2200cea7c9dd952e8fefadc961a1d0349ed8bd066c98fad633b6e6f7bdab4777425d75bbef90a0a79214a97b4ef7d63
SSDEEP 12288:d9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:ddnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T12F5523697964F99BFB2706F14C828182973B0EC7BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ca2bff7640bc2fbc197a0ed443e46ac2b03ebbb0e4b880aa11573fe7de5a679e
MD5 a008ceade225e2bbd6a45e2ea06f7d97
SHA1 03155a69b8c1a67b10ff3c8cacfebf6428e79cd7
SHA512 85874ff448f9ab668d71c25895c29363919cd2a63cf1fdef64ceae13df6a26ccd7281153ff5bc806f2f35ab23d201a78e14cc29877a0961e4efed9a2cae91108
SSDEEP 12288:aBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:aRnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1CB5523797965F98BFB2706F18C828182973B0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 eab041bdaa3729526973325eaf490dddb0a6a5bf141be09eae4c5118dea4cfbd
MD5 d351b7d460e36ddceafab0c19e30ee7b
SHA1 ecdae1d80a0ff1e0d1c4c4a9d3fc5929fa2b65b0
SHA512 c2c25270abeb8e88651699cd142dd84b9b422ac32ae25d27164eb1d7b5e04cb2efd158dd55b03ccb23874a2571f264a22f2e6339124b6e58ffbe4a68fedc839b
SSDEEP 12288:eiZwbDzzFEoS2cPvyJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:BZM3zFVSOZnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1EC7501A5B39058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 20c3e2b8db2b031f2c4a10a5e6347621d055a23675f9e0ab96d5795cd29f81de
MD5 a0d073d92a172043a1401d422e72e65f
SHA1 0df8f7edd4b6c39731c7822e467672b309d04256
SHA512 d159253f49c5f22102de01fa76aa13ed700d5fc67d7173a225e7e93f2de324399317f47b70258e62ca587dffe94dc97ef45262e9e60ea13d2c2dac22827a30c8
SSDEEP 12288:84GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:84nQ/tbw/2Mkjy6Fr7g0op
TLSH
T10D5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 86ad20ecbc083dcb0038c3a3450153ac839177679ac7d033d4bcc5a2e773cfa6
MD5 c6e10bb04749e676f8a6fcc20bfcc82a
SHA1 65414a049f59deaf40293d81a45569b3e64d0977
SHA512 06f0fabe23bbbb38051aba3a1eadd0792d81ab5e4ca419b89a4fb7ac8705c24be6e5bb383529fa2a08e995abfcd2c76c50fad5cb6523d18fcf48ebc03af10d3d
SSDEEP 12288:sEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:sknQ/tbw/2Mkjy6Fr7g0oC
TLSH
T19D5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ed75cc6ec65eb84c5188dcca0433bd66650434928a3bf075a45eb8e7be9e59bc
MD5 fc0c4ea2919ce8f7ac226babd9337f64
SHA1 d1c5ad82ba26521f09dc0352f173ee4b777253f3
SHA512 e6cd9e1e99d486300745119698edbbfa4ff361f5add1f7ae2ba8f3fbbbf2441cc7033ca9f7778317d2b098f8fc224eeae1b23c7ae84f04302275c60b885802b8
SSDEEP 12288:KyPz5L8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:XzylnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1A665021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8a4cfdd68b474671a8a9d0d2c01cf4ea7a01e65a921d98cf2259e8a47c0b08cd
MD5 14b398cb915ec6880c07c35714df2524
SHA1 1afec9a00a8341ccb81ad0239d45be55e3dd00e0
SHA512 2bb2048ef490912e61410c37bbe786cf01f6658debeedc256d2e62feb3bdb510cafe47076ed1db09590687676250e046001ae84a1ed2b73dfcc64c869aa80029
SSDEEP 12288:q4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:q4nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1D45523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b27563c8b774207e4ca64e0519570e84f7838d718f570b9608b89dc290e6ac67
MD5 50a2b2b1f5f590f5e35fbc4bc75a15f6
SHA1 04a34d09780b9b4ec6354d33bacd9933f28d4c63
SHA512 9131addf20dfdedfdbfd9bbcc800787d499abc3fe756b02d26fce0603feb2c1cda972b1284b7b749223f1b887c17a1c56dab360f6b637015663f1f800c6e838c
SSDEEP 12288:F4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:F4nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1C05523697964F98BFB1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 dcaba4c661cf57e23f30a4b292582a7df5871eb4718123ea92928aa76ca34be5
MD5 367db6aab4db54e251027278729a80c7
SHA1 7f7f8d2da00c1390fb060c6ff561793cb8f6d418
SHA512 7f34a48184b8624e01c6ea27602441c021cdecc264a1698f2c22027a5495fcee341828d31f1198578a6e6b5be7c5023f1838b920cb89c10f4d20a4b7febbe05d
SSDEEP 12288:8yPz5L8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:lzylnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T15B65021773A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 655ae3295b9988046011e3db46ce8abb4cf1302ecfdf4b34e866b28bb46fa022
MD5 51cc81695e35e8e1824450ba095b373d
SHA1 9d0619670718f04debb965a3658adbf239f5b89a
SHA512 ec2361b4b193095ffd71b6e6df87ab22c8e7886f055e3f9131229376a8a3fcdb79fc99021db5095641649fce00d9d57e82cd3491aa7f75047f80cfbc68a2ae56
SSDEEP 24576:8T0aLl3z0zD3nQ/tbw/2Mkjy6Fr7g0os:8TDLljWQ/lFTjN4
TLSH
T1D17501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d03e6ddbd921031be40582b83eb8f1c83853474f7c9e07e1821d7ed16126834a
MD5 ac164f89bcbb937dfc5256e2d98804a6
SHA1 d6fa1488a71b9a39a6d4822e879502af8f4725ee
SHA512 9adf54d944713120ae99d2e8e5a5050bb583e9412c1c6af97059ab87712a41e5399bcb2a8ed33af16e218781736a1a66b521dd6758a095bdc515625706db31d7
SSDEEP 24576:031d9CHKy7GZLnQ/tbw/2Mkjy6Fr7g0o/:+1d9CHKyatQ/lFTjN4
TLSH
T1EB85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b84d5b8fcd7ab7448a14071c75a400ea33f90465d8ce0bbd7087428548dceabd
MD5 73bd6a95d77bd3be241f7907e205d09b
SHA1 ed280070003508423cd1663faecd7d23a79041c1
SHA512 86a45835393b330b425afb44f8a0f720f6deb5c8ef23271013817c0a33ec2b6ccd172c9309cf737535d6dd66bf9064fb6531c2bb00986e0721cc976153f317b7
SSDEEP 12288:/HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:/nnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1435523697965F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 72c2524a7982ca0da5256f12caedf4a6af55c871cf84aa396f5a4cc76e23784d
MD5 b5ad6a1388fa43c343642226f655d1ad
SHA1 2f975eec930acbcaf4cb8c2ce80b828ed27c9c20
SHA512 125e2b28f97203c987842eadfcdba8d562a15d9e7f6cc7e16fabe55b4a4e1adb1dfe4bfd5671953d9b9174b5233da04d055e243278b4aacd1a1623c01e0faaf6
SSDEEP 12288:flGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:fFnQ/tbw/2Mkjy6Fr7g0or
TLSH
T12B5523797964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 34eb5b693dbec7fbea5986aa6bec625b553a476baa2b1fde886adb20aed3b820
MD5 9dd3dfa1705d1e1d28be75ef15aab0c7
SHA1 75d160a8860eac21fa73b1da2737216f9e648f8b
SHA512 4b81dcaafa60eb7489fa83cfb89546df5b837071c3e2d9068890532bb23f420f5ab6095d770f1c87fa04004539c734cc38f74a557052ae4e8351a3c7251e908b
SSDEEP 12288:9OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:9OnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1975523697965F98BFB1706F14C8281829B7B0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0d4eb88e3d13cd93f015a108de1dc84a26c7af5830979bd07a7f834cc451913f
MD5 5a6a5b1fbfffa025eb49f48e1c8424e2
SHA1 83563085b4d069ac9fb2567403507a87d5606c88
SHA512 d8be87306e123377cc17cd3c53c52e06a55e51a8057f437415f0d3826ce1bd67dc60c671de9ce2730833574e4caf85b7b8ee14f877c9a4ce07bf623cb54b1d21
SSDEEP 12288:l4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:l4nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T16A5523697965F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bfdd9dde894e9b98e32babbdb154835be12519aaafbe0c631f51f4a5344bd357
MD5 f65b6f9e041042776d3cfc2ecf809078
SHA1 a4cd4e922078e366920f5981f9a9b77bbae1cc5f
SHA512 06382c7f14c81246d1d25d12bbd4ea09c085f87fa296a87a428c7c9c01d38d5dd66414b88ed4cea294fccfcd7a585af4f887d4b261cddfba54b5bd011e70ef89
SSDEEP 12288:yHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:ynnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1195523697965F98BFB1706F14C838182977B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 eee6b292d705c3851f3df9ef97b19702123681b0ddcbd51e7c6c97bb1e3ccb31
MD5 a56d2c62770336399509a9e76379d5d8
SHA1 2d9871f1b4f66f74680fc4f8119e024afeee9465
SHA512 10dc6d98fae791419582e944a3fb957903296beeff69c28d4405ae4d98983e85ab7480c3a68a7327b8705afe8228de4230248a4c4b57fc66b9e1e0710f57d220
SSDEEP 12288:EwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:EQnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1D15523797965F98BFB1706F18C8281829B7F0EC6BFD1938F7B481128967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5cc2deefd112b5d1e7a0b2fb0e6e50e0c0313eb4e1651d703ee607e6a99b0db5
MD5 9874adea148a2ffc9393bb2feeb32c6c
SHA1 922b952a97a16256db32632a98053e32f5d43a8d
SHA512 81f7698b20637202996acadd906730e140b2e8e3ef0b4cd0f0b9b45271a1c9e1b3394ea4c2f4729ae90900619f28dda92425e894395e3f604ec69b97f13bd79a
SSDEEP 12288:HKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:HKnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T10A5523697965F98BFB1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 6ce4923439f6ff218d7fdf061bdd39ff02e004c7be6315b46d7ef6421cf1ff33
MD5 3f4d98727b00ead17e3bcd79b46e8643
SHA1 38b16a8d5a37d995eca8c422b864a2ffe0c2e278
SHA512 327a027a97017a31fee5539d27d6866558e77ae51fa3fea48feb01ae03ee4ea358ad7679585f804386b0787f5cf9423f4c16233acb7220ce305bbd83266da9d1
SSDEEP 12288:QvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:QPnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1005523797964F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4c2dfd01643b9dd3306d59bd3fb96162773f6a7dc98d73f12aa4a88abac6c7f4
MD5 dbcea1b643a5e9dd7073c76036a1db2c
SHA1 98ce1733a5b313dd7560055f96a9a0d27c454d49
SHA512 c138c5b53d2d8a4ae647515a2ae44cc9cd35298d057783c484d1b9f566c1d531b2ca713e3be9adac7e6417fa5168fbab2b5a8a872a42759f1ac0bbb25558e5f9
SSDEEP 24576:xfwv/k9RX6wkyAI0nQ/tbw/2Mkjy6Fr7g0ol:gMnYI0Q/lFTjN4
TLSH
T1BB85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bce6d380da2c9b6445450a289301bd5af495bbaa1c750240c42e13db2813d9d2
MD5 50b962d312ae20a80be3e0f6ae9b5263
SHA1 ba250c5d48ad8faa6a9d0e7883d9eac7cbf33dde
SHA512 47d232e947c94eba7ecf2a3f6fc22afcc822f55136e4442305bb18d57a53c7d568e8644dc93397ab9cb1dae6319fa9bc07d480183f3dd64dafad9330d2f30f8f
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DQ/lFTjN4:OySzPALm
TLSH
T110066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a6ac22daf47784110c82f00e2c9685121a2f2c6c7c2b33bdc0d15c7cf40e71d4
MD5 9b5ac136d42a3af37ea09ba625eb44c4
SHA1 61d1a311b97eb341fc4b926ae5263492431cfa41
SHA512 c18e03c993a484e52c8a1f3799b821f9acb59ef93a08cde9b127541e6ae4e2ec48dc6731fd1bf5bf41f30e0f74d4b1c8b87b2a44ac78f893126a38434af4bfdf
SSDEEP 24576:n47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpnQ/tbw/2Mkjy6Fr7g0or:n47JUQj1irIhCnDHUPfF/TQ/lFTjN4
TLSH
T1AF65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 73a4b493472c2fc8a86d9e6e9eed7d8856eeda90bf9208a35f7fc496839b8798
MD5 7a0278da63bdfe2bf8b4618946096899
SHA1 89208611b314fb269cd72e70b4a80f26204be311
SHA512 5d4ca5d680b15a1e89faec2e1abbb878266cd1402372d438a40824cc424dd9d3e02e34252077e060bdee12306033f086c94df9aefb641e651cfd48042697f4ad
SSDEEP 12288:KssfoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:MonQ/tbw/2Mkjy6Fr7g0oY
TLSH
T17365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 087b92a0cf910dd587e0dc97c826628daf9dd4817a3ca722a9fa82277d7b6bb8
MD5 ec6d7f1906671a7a6df03395b26ee766
SHA1 3c8e1fc4ba0176db49e9059f8660335b5cd4c0c4
SHA512 7e43b36d08f4a44b3a88e20e8875a0a55762e740c339cff8af961be60193d25b2f2855b5530746f9f3e9c8ab13e6c9da54983b623e10dcbe14524a497fc9c430
SSDEEP 12288:LaQfQU3fhaqdAafmZo4DjrcUoZBlFCOXmulWPOmf:LaQYUPhffmZfTKMOXxlWH
TLSH
T11B350610B666CB4FC6A980321E77D1CCAB707D41EE44AF0773C9873F9576658BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 48aa873ac369a5a40f53ac16ee0e498b637546330843e67fc559830592923701
MD5 833a4a6c6780030a757e6bb5142ffa18
SHA1 50864fc5b9f4bd95858ae01cec8cc6c04d11779d
SHA512 806105b9188a6f56c96a3331e52e96d8fb647fd53ae08dc8910ffc472339318cbfe8feea9c0a3a67a6385d8b34abafb18b608ec85cdf10e4c3eda6ec50e3bc7c
SSDEEP 6144:WfeJs/W72ehxs0ssLa7izp2w3rq6DJjvtMx0jvtMxKy1mBpPFvCOOxZZnt2KPEN5:WfeHsrOauvrpD1c5RtdEn
TLSH
T19D550A80A436E68FD1B76032071A5B8C77A4EC0777496F26B3C9053AD82BB15E4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 35643061328fe2632bbf8852d4b06125f93eb781a21d9d93d1262a500bb5784c
MD5 e25d4014f84c97a58a71a4bcf74a1ff3
SHA1 942f7218e44620f7a439be535cb64e02ab4d32e7
SHA512 b5d22ed53a0dbb990160116ea8101202d8f26d339e4e35254af351f966334a2d41e62ba0691eca7cad3096bc64568a1e7cf8dfa2b8e74ad23e854fe397615c22
SSDEEP 12288:h67gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:oAnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1605523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4b8215ce63cf39609423e6f7ccb3c1c6b4c92c6016df182bca1a964be67106b7
MD5 375dda138c357d14542427189c1ebccf
SHA1 581904452a8e5c6ad083b60b8776f54cadc36345
SHA512 f900653a68c30b633cc7771eaae17873e98ecb676bc6948a6be44eeb659c4feb0f6ae3ff288e4ce922f4ee5c62d7d6765e25153cd4c74a9f85f5b7a47e1a5187
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYWnQ/tbw/2Mkjy6Fr7g0oq:3gb4mBIBhGFpQ/lFTjN4
TLSH
T19C65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fa98b94deca6b2c48dc9d0d8a5f9b177049f0ea3c1de5153338cfe6bd78033fb
MD5 f5748f3e0966a90aa86caea9ce67ddf2
SHA1 825852afda2202e2c0e4616c7e4f8adb95574e2a
SHA512 640631631738a80cb03acb17b4fabab5eb75053861497c63cdaf0e124d62cb645a9a91728d78779a4402e34de8a6a5bb2c37efb7a19afa27831f8e9729cd2fb7
SSDEEP 24576:7G88u8FpJqH1Qzria7/mZnQ/tbw/2Mkjy6Fr7g0ol:a7ZFPqVva7/uQ/lFTjN4
TLSH
T12A85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8c8fd0208426472447f566fd40779ee91cffbb3a35fd29059442f40739fed471
MD5 e33b722833885ce305e3e2f119223603
SHA1 fbad9860facd4b7a67064ff7e3f6b5af3893bdb0
SHA512 b3df80b6fbc73cb299f04f07c832336bea23b31539acf8f6f3deb4049ab55342ab88c1e628ba223906b4adb95a158acedab2592da7138453208812760c00e1e7
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdQ/lFTjN4:HG05lO43bPLm
TLSH
T197D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e47489b00def4588895a93b69d20a30ccffa839de325f373b3d0d1843b3bc7b5
MD5 1bca82d30c218d8765e0a9dd6170c913
SHA1 39ec1ecdbb110f8162262aa31ff940810ebe4bc6
SHA512 3811d991d9572726ac3627ec900f926783c962df4fc6bda621d3ce52c67d45633d6c58c21c99ff8b90e966f790e1f05b25c1156a65114c2822c0848d4189b5d3
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnDnQ/tbw/2Mkjy6Fr7g0oc:ka5POZ3+Jt2pasx2+mFQ/lFTjN4
TLSH
T11A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 351d34641fd0e394cb657ed8f729fe2b16bf6e96936a322b65ce02f8ca0ec4d7
MD5 3da3a0c33a8f8685cbd5fbef15b49f65
SHA1 2d7cbe1c5cc9847bad18a6c8b2b6f60a741c8e67
SHA512 5eea7612b7977356a80316cd37cfc315bede83145a6d30ddd4bc7da3ea0c5e661fec047a6cd2b42d29793e2253a7cfdce07b8235b98171d3d627e9d6ed062847
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkBnQ/tbw/2Mkjy6Fr7g0oE:tNc/zEOVHFOQ/lFTjN4
TLSH
T1CC858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 806d98fa4cde789e2f25bfbceb141486d9516c36899d03e926e0fc47ba735678
MD5 756bec1222d46018650c470e3f93f560
SHA1 939ae3d9ccbea02bf58680f1d6a1a21b38ff0fd6
SHA512 7af9a984b9780a863305bf054fa3b30ae3df0265c4ec6dbaa371305e03918d36074702e64a0e372327736e94464497b0b0d31c0dba14582c2f094e27d860d561
SSDEEP 24576:L8kNvNnaFeYhJNtmZBmPnQ/tbw/2Mkjy6Fr7g0o6:L8MwBtOmPQ/lFTjN4
TLSH
T1BC55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d5ba31b590de7e1c320347c1f2696fd71a6c0caac3670bb88988df5f51a96b62
MD5 a51ef1123aacca8a78df32a6edd37824
SHA1 22c06fb8820ce917e9706961458b4cd86ac59773
SHA512 f03741763cad9c00a491950df4d3b1b1c94e26858a18f1a7014d14c9e0158b98fac36dcc64be883cb5572dc06bb4d204763a1e3184be5a76635be0b74505283c
SSDEEP 12288:JHvUrBFrEjwaQNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:JPUr+NQtnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1EF65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4a96224c3cf8f5073a0c27d894f5c11c148a0dfd9cf148ac441df8c71007201a
MD5 d23995a79455cf5650d57c2bfd69bc61
SHA1 e624222f3a6eb54370fe0e1510e86e0e474f8d5d
SHA512 5baa5cd1c6a6b57341423eeb2ccea61e01d1d290faa279e79c27073c2e6eecd2376b03904129d3f43205b611ba08d22a9cfb7972ab3ecad0bf7dfc00241bdd00
SSDEEP 24576:8D3FHshBIYQgA8nQ/tbw/2Mkjy6Fr7g0o8:8DVHeBIAA8Q/lFTjN4
TLSH
T18A75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/552-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/552-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/552-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/720-312-0x00000000013C0000-0x0000000001663000-memory.dmp

Download

memory/720-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/720-313-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/720-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/720-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/720-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/720-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1188-293-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1188-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1188-66-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1188-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1480-123-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1480-113-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1480-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1480-119-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1580-54-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1580-60-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1580-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1580-277-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2716-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2716-126-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2716-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2716-137-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2716-132-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3276-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3276-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3276-78-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/3276-83-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4292-411-0x000001EB67B30000-0x000001EB67CFA000-memory.dmp

Download

memory/4444-39-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/4444-45-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/4444-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4444-48-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/4444-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4516-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4516-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4516-15-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4516-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4616-382-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4616-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4616-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4616-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4616-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4616-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4924-8-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/4924-321-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/4924-318-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4924-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4924-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4924-76-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/5096-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5096-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5096-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5096-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5472-372-0x0000019773CA0000-0x0000019773DD0000-memory.dmp

Download

memory/5472-401-0x0000019773CA0000-0x0000019773DD0000-memory.dmp

Download