071975e987ca822de9e34d2cda709b901555bb39522f63d701894fcef38b9986

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260702-jexqtadz21
SHA256 071975e987ca822de9e34d2cda709b901555bb39522f63d701894fcef38b9986
MD5 984b5556188ec82763d06bc6b542460a
SHA1 2305ca04beaf44e8b066c360a333197ae71b2333
SHA512 709504740cd91700fce1edef92b066f3bc9daa24a5d8bb6e9c80adeaac5b145cbab096026c0c9c095b38a53c2e1329f868f935687686861159ee00111dcc8706
SSDEEP 12288:foBBF4BrBqYL2T4qGKGiNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVo8:gBX4ZB8TciSNyBo4kx929bL3Hnx
TLSH
T1E3856AD11ABA8DACE461CE7C8A81CCC9A4DF6D0C463D7ABB0278341C5F7EBD65864D21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4104	elevation_service.exe
1464	elevation_service.exe
6252	maintenanceservice.exe
5588	OSE.EXE
1732	PerceptionSimulationService.exe
1412	perfhost.exe
4100	ReFsDedupSvc.exe
7024	SensorDataService.exe
2656	ssh-agent.exe
1008	AgentService.exe
1344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\da34f022e819cbc6.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_88796\javaws.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000031e0b67f509dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003d658468f509dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006027067f509dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb73a267f509dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000089d7f68f509dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ae8c8a9f509dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1008	AgentService.exe
Token: 33	1344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1344	SearchIndexer.exe
Token: SeDebugPrivilege	5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5900	2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4104	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4704	1344	SearchIndexer.exe	100
PID 1344 wrote to memory of 3908	1344	SearchIndexer.exe	101
PID 1344 wrote to memory of 5012	1344	SearchIndexer.exe	102
PID 1344 wrote to memory of 108	1344	SearchIndexer.exe	103
PID 1344 wrote to memory of 1152	1344	SearchIndexer.exe	105
PID 1344 wrote to memory of 1420	1344	SearchIndexer.exe	106
PID 1344 wrote to memory of 3984	1344	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:7024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3c91a3c4adbd6fcae695897c5c754ade31f5e7ba903a5ada0be54fc223f5d1f3
MD5 c9c9872142a8f4276ccad9dbb907b95f
SHA1 9bfdc083e6d5b9737c07aba49b8ba4ad93b52ed1
SHA512 3bfa70f629318f9d5e51d21c3c8ab832e7c7f42e36fadf6ad615f0039777b840596351561cae0a05253db3022bb99c0cce1c78675ea49a72007127febd81835f
SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxneB+kn3Hnx:93q6sjBl+k
TLSH
T159D59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 30e360675f646a490337d8598a1c2900a3d6737937a6246d2968ee48f6f4520e
MD5 1799c83822eb7568066b4a69b9ea612e
SHA1 bae36e882b0ee2570ebf1cf739a510fa4ab1c0d1
SHA512 9aab4447206bda2cdf4e4f3e38e7cf6c712f616aee03ff9d19cdf8a48ecbc5c4a85947aa5c6f27b0ad6147afc6ca92bdf2352c66f0be94f983059cafed61e36e
SSDEEP 12288:71XLsswWkxy2lRq2czAXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:BXYfDtczAsNyBo4kx929bL3Hnx
TLSH
T14565012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a2d1d8e725ae4467f11023417f4bd188e2660fbb79c68fd93d97f5c8342da987
MD5 154cddcc2aeae524e8a439f8a78e4087
SHA1 de12be2a8187b0033519c64fb002871651e86b15
SHA512 9f3bcea3c85d82f25e5d783082ce95032a387e1d69073b1f5213547b6e004283181415fcdc5807572b240f805ba99c1ebab633da54196c6577e5bdbf4590873d
SSDEEP 12288:jXZNYVLeyUji0h90ZD0wxpGZIVuArHsqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:V0Le5ji0hmxfrMhNyBo4kx929bL3Hnx
TLSH
T1D0859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0cbe2652abec2f04f4916e1eef85ff4a7113661fadeefe437d27067871fefe52
MD5 c4553bcc47db054b8ed565edb8a094ac
SHA1 ce886d138867059cb710b0a8a407fbb637b592fe
SHA512 7c9c0cd4b83acaba459edbe37420397a201ff6cecb089f1c6db88297f597218e5a0a6ce1245120c299d06e3a1dd39ef9bff773c38c24cbc9d1b72163009a3bfc
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWn6q8wyuHNyBo4kx929bL3Hnx:f/ezSC6vUzPveHjyBB+kn3Hnx
TLSH
T183755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 796c4d028edaa6339164252eb2e40ec57319da4322da03e085262a6b85307bdc
MD5 18ff82b9eb21499036e9c2e96efc8cb7
SHA1 58f72de359389677759a7adc4f4f0975ca3fdd6b
SHA512 058a9e4a14c541ce3def648e3aee0f32bed3fc3b449969496b472a2d9b4856d437b821c96be60abe1d62f9663e701dea383469e13941f2d8d74e377dedd125eb
SSDEEP 12288:BVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98zLDAptNyvUgXZ32dT4ePc7N29CD:BVbqPb88hv/l+YgNyBo4kx929bL3Hnx
TLSH
T174559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 46e7d30de68883a35921901f3839192b5204f2ae73daabbc8cfbdc8fed896edc
MD5 ea39afc5a3b167eee829349ad9527950
SHA1 298da76ad1f9e6e2eade80ef3dff870182555a8e
SHA512 e980af8558167a882feca59a0a9e6b6f52e1258efbf0a1505ba7039913a06def581350526be75eab1314190d172a7b791e5b1ddccd5249790e9d09ebb08463dd
SSDEEP 12288:Rm2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RmVNyBo4kx929bL3Hnx
TLSH
T18E4523134B0C6276FBBD3E70795E8454CC35BC8D0D95DB98DE62ACBB58BC9A2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 52b24397806fc79d80ce8d2870f9d6befce252de1bc4d39ec1d4d79ba66ec85c
MD5 5760ca0252625a716c3dd2735c5d4c7c
SHA1 c9bf8cd2218b183bb58107d6a983e9e2d4edfe15
SHA512 a7771880644a33efa2ed62174a3b846941c8c2247455cbd78432bf5b929d94b3ce50d625bb4cf51103fab4c9b4b878216e57463677c021391a4437e079d3c28c
SSDEEP 12288:TeBNUbTVO86UrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TJIUoNyBo4kx929bL3Hnx
TLSH
T1C465CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e114b6a0d149c94aab6c8a228e899a8a85a9ccdcd8818992dcf960820f816972
MD5 48a76f06bf2aedd23d3ec9d5d4024f72
SHA1 397b5dd6751ab10f36bae27e11b12ac262553607
SHA512 871b8b29f3d346bfe34b3a96a421f902425befae8754afd46deac83d04078e6c6f8ac404362c5a69c98f0f01eb1bbe5665b8e7902871b36d86a615323ad8ce9a
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH5:mQvGAdlCEL8c/DRNw5Ck+k
TLSH
T12F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 13a3349645b5b7b0bca2c8c886359ccc8d2b01f50e50760632139feffe77241b
MD5 2f2a54ef0f048a8d2c8434a0fc530eba
SHA1 bf3ee305f6dfb27fc0c5ace449062aa2f9152f3f
SHA512 a6198e9b26e0eefd840ee2f01eb3b9f391a63d5532aa309865069bddc823a97c27054cf263b44b2b5b29b293ff4181028c25f1ce5176ba701aabbcc51095b910
SSDEEP 12288:lAwSfxL/2Dc3XDLLmt0LDQewsAjZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:GOewsAjGNyBo4kx929bL3Hnx
TLSH
T14F75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b336d6fff2e085716f4f285e0cc3cd0283cd9c8bf5b5eb9a882d0791acba0c15
MD5 a5219aed61a431d9b2c776854e8ab9e4
SHA1 b46fa65c46e89ddb4717ddbe5153fd73287f12cb
SHA512 a68cb10d6aa7ee8811ab2e3d2a7c39a5781638f6bf4a6d85659ce8ba54ec0a9ab63d1e7e80b439ea10d0d9bf0b6f7b8bc0b5326a850b96ae88add3e5734aa617
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHD+k:9UEtQevvqc2W1cpV2tI32D
TLSH
T138474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e47cecb80bac97a6c6c1cfc8774f8412162c71e66cc08dce8d6e9c6dcddb6945
MD5 1d1ea4b87e7725ed6c542820a9a8b4b9
SHA1 259d7123fdb35a356a03f13ce03602baf234a108
SHA512 051b7e67298df156f3a0682c5a1f4404895a113875ee822210ea10b8cabdda734f98b978292ce8a8874a4ef3c9db25a9a48f7f76d5fd202aad9eb92b512c6e66
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/zNB+kn3Hnx:WoquVjnmQ+k
TLSH
T1CDD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1daaf00320d36e2d2fc843699bd297ce78e14168b7232627be2f2617e4df1939
MD5 0c91ac910cb9aeb8f8519cf29de36826
SHA1 81f3f892ba55091965816c3c40d4c9a51859fd7a
SHA512 3a16a53d4474d386b5e3068c1830b5fb4d04103f964f14f78cefd59d540a5ce22e7d7e9708fd67569a77018b1b20debd2f479b147ce6ab72d59a071af81a4766
SSDEEP 24576:YAhGL3IFoiwtA5l7S53jNyBo4kx929bL3Hnx:YAMUFoiq5cB+kn3Hnx
TLSH
T13635AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1f5f910e727b2512a7efd3d5ef174b9719573fb108fce42b8b562657315ef40a
MD5 af6ea12c426092930edaf1e542204247
SHA1 a665c5cdb007d226de96b54cde2fb7c452b1f68d
SHA512 9ebd43b5573afcf772b3da28497b4bf90f6bf5a3896fc4b04aefb54dcc4bed576e0413571008d2cb227f3746e8626c1610ffa6c3865e1ed344766e16fde413b2
SSDEEP 12288:/mw5HEjsChNzBFgl0WDm+C4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:+wu6OWiNyBo4kx929bL3Hnx
TLSH
T1B065010677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 60b61e0e7ce8ced5a7b1815953acb3a61c8adb75260402dbca8c7bdaaafc1350
MD5 9d30759fac007294f9cad4d5e75251f3
SHA1 c688937eada4ebebeff971fbbb3b0904c0e11282
SHA512 ceba999d59e19a46012e49af11b8f67fc8fe0f736face9e57bbe6d7993f305387c08feec15a5ed50aea6707768d351d9ed8c648b9d813d421d9b998b749fd0a1
SSDEEP 12288:qgZ1IypLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xZuJNyBo4kx929bL3Hnx
TLSH
T1FD551216239831FAF2AB2678D8E58644CB32BC461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 641d480acdb8d77a9b4f22785bac0416fa8e407f471e4f7cef56379e89df2523
MD5 fb6309d9149b06dacd3559179f28c714
SHA1 7b396a94384cb5124942f522ee7fb88ed3b209f5
SHA512 394a69525a7155eaa0823b7703d8926bf001688469d8205b1352b2923312fd30d2f3b7b9a13e09b864dc52ac804e585300b77fa60a699298259b466ce41e5ab4
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:tQRQyi36YOcPbLvw2gAf+PN35+k
TLSH
T1F1666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6c4a5428a40c1ecb3ff81889977582cef2ea0426efa28849c544d2da1d6c3526
MD5 b89793a570b2b48ed7b262d20da57b0f
SHA1 08ad85f1711278640ab5ad5c7579272967dfe96f
SHA512 6f8952daae18f5a190565aa0faae8e5ed89c055017ab5ef252cb4cd426d1ef1fa7f7635b1d8981cf596b2d1a226f5a2e0a5a94880859796a1a10cf0165b756c9
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:8QRQyi36YOcPbLvw2gAf+PN35+k
TLSH
T16A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 95804d0bcf3d5e4a3db711ebd657691f2eecdaf78527bcb3af827cea6ff41577
MD5 d84d81e4911c83c5dffcb64cea3201c4
SHA1 5d880d0618dbab70aa60ac45a646e021c0c6568e
SHA512 9b5f6ce670b0c03e6dbdf914662772fe0402742b143e53dcc0f23834a7740b98603c78de8a1f0040e3330b781bca1c9327d0fcba1784df6dd176d12b1cc1cbde
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ZNyBo4kx929bL3R:w68Qg55nhceWu7PNU3/dB+kn3Hnx
TLSH
T1A9B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 162667042fc760ac79903b518e57fba5a1538df5a83d1c169fbc1809193358e4
MD5 b5767a1d333e4ae8f163a2783144bf4f
SHA1 1657e8ba55a77e9776544419c1ae150b170b0a47
SHA512 9ae32065602b8bac99e374cb200617583fb0327b3a80eb4f008c7a2559b3783ac425ce40a980bf31044aaf904e3a7481e727dbdf66710463b1cbf739de5f6ace
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99T:Ny5112gYy5azzVvt69nLKnhZK+k
TLSH
T164167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 595edb149bfa8c499d1b982e0db7acfb0ab53eee2a468cefee627ad7b6cb4c16
MD5 2bc537fb9e75b60ead733945a366095e
SHA1 f9d1a812a05ffb408fc0bd9d57355491e6fdf221
SHA512 89c63d49b79fed3e1ff2a526352fc8c0666d83907c9d2e0efe30a592be4b3d67d0304862e34f9529ef16fd860231ffdf4e719b3b34a585e7e1fd20d44b3741d5
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnB+kn3Hnx:Hu6Jmdxd2dB+k
TLSH
T14ED5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 41d699453651befc06b83e4677798b432adbb9a014fc238bfd51b14d2093a059
MD5 c003d1ea985dd1d88cec84f79322ab58
SHA1 ccbd175f2f336c0fc2906361e479d938cd453b6b
SHA512 f3ef653c75c7044c9d30022831aa6311a11b5e38bfe49825171e18f190a3185944d79fe8a2aef0b3d41f8265b364e64f30a39b660b2715b15d9f223500c20f2b
SSDEEP 49152:d1hpsNoJpF1A63U44CwH7R4xrB+kn3Hnx:dmifPWRQ+k
TLSH
T14DB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 444ce24f9665ac71259c4b8ac8e238b1531e15ee1f13cf06e879142c24c13272
MD5 0b508bff6262f14821733b044ed66346
SHA1 24f2f64e3db4645f4ebb41db7adeff24b2c86080
SHA512 bc1caff07a5b4fad1cff9b2b41db16d8b2b06a0e7936edbd2816dd01c1d46a05c483acbe6d51462a10650e1fd1f4882e8d3c2b1a153c394ee73199d09ee5e5d4
SSDEEP 49152:RSuZQIY0Be2KcRVtOnks6NMHquB+kn3Hnx:/5dKii61u+k
TLSH
T1FEC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cee7c4472da4c598e7fda8847176c5847a921ff008f4d423ffe02f042ae624c7
MD5 4bb31b7625bcad01ce3ce62f47abafac
SHA1 e341a1063a86ca943bcb95d8990c9d914e5abcd8
SHA512 017764c8b0848c0e2e9b70b5a831df4d7938d00de4dda767b953efe9347adeee744f0f205cb211b79326aee780cec3223a3be162167a7ed58a9de0f7f910defa
SSDEEP 49152:ohtSn8EApI0fig3giDn0AP5w3B+kn3Hnx:5X2imphc+k
TLSH
T16C95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4da62111f2e0c8e2a2dea0301601c9a0973941bdb4d333342020588ac8d0f749
MD5 9eb511f9f24419d8adcb884bc77f3268
SHA1 4dc4b6411b186bab3445d10431a122523c6f585b
SHA512 556dbcd55cda62e81f33ad04586b2e8cda108bf21612e8899ab62dab513e5392bccf6922e30f32a5eef9848240dc4687bb284ad8009fe7438a41dbd8bfebc136
SSDEEP 12288:quLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qdNyBo4kx929bL3Hnx
TLSH
T16A4523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 81797c8cb8bbfb3c69db59e3cf7a8b3565fd3f33d0b5193c5d51235f4fb44bae
MD5 3629d3eeaa9bacb2f5782867d7a26753
SHA1 f5e53b8454733a86c962be6b24eafec143b821e0
SHA512 e137a0a30a7b5605bb7e02d99f086da0c60d647c8486cd8165440b6f74eb5fd98f576a4119eb7218e1db7e47e3f2218ff1a3c4eddcb145e602f10acb71fac0cc
SSDEEP 12288:4lLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:46NyBo4kx929bL3Hnx
TLSH
T1004523125A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e17262d06111f83ead8feed18de4b1018481231466925d5574f84778ec13d461
MD5 ade1a9a23099614b6fe6a13b27a0f6f5
SHA1 94745be6eeb12c50b9cb302571617d4e77981174
SHA512 cb835f9937fb2c6a9aa13b60b2294e020855859ea5523d93d9d24398e7239b6e918663ae0c2ccabc9b246d88f579231912bcc079d06443edf7fe6c42bc253993
SSDEEP 12288:mjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mwNyBo4kx929bL3Hnx
TLSH
T1EB4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 20874cbe2d286c05fdfe49c570d429abecc58d6a784a3ff3ab54ed578d9e78a2
MD5 d70ff8866ba682b38b5df6fe769b86dd
SHA1 656a213cd2e7c192708b997b71f5503b3266ae59
SHA512 31141b06ad96b6802c2733ab8787dabc3dcc94bf023f6804912ce81ec3ea1325b34ae212d8ca074570dbb5ccd758e75fe97d7f51974be59f9b445a77806d229d
SSDEEP 12288:mVcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ONyBo4kx929bL3Hnx
TLSH
T1A44523025B5C12BAFA7E7BB098568054C835BC8A5B7197DFDF124CBB0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 04e005595ecbdeaf860542fa2bca774af06ab02df06beb9173e10de08b9bf479
MD5 a933b2f14ab39891ecb9aba1652b9661
SHA1 4d496500508514cd674feaaacfc753c1947d03e2
SHA512 132bf869727d3ddfb308571e415c181b4a22d30e95c45314c973cd2a038d8b40a7a874fb34c43eac4de0280c963c9399d6043049f9edf433beee3b7a5e28eb1d
SSDEEP 12288:/ELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/bNyBo4kx929bL3Hnx
TLSH
T1464523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e47e9dd22cf68e6ef9f1ac029313294fc8ed2aed07f9325f134a135097bb25dc
MD5 26e1788d5d1b234632892fc8b96e0412
SHA1 acf1491aaab02662d8d49a00f97ee14bdbc3e4df
SHA512 460fd7fbc119dd90ec325becfa482b7a310f70dd9e067dd6c25d02519a53e75e3f008db49f6533e694479e3cd07ce1955499969d303fe143f61d6e980aa2956e
SSDEEP 12288:/xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/ONyBo4kx929bL3Hnx
TLSH
T1694523125A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a28efcdb3f08d77b68e98ce3ebec51281e40e220e03e24ad4db3694a739e686f
MD5 d154621e0736dcc1526f81109014fddc
SHA1 295144c56c4efdb67ceaacc0d2be646579fcbc7c
SHA512 3d8e49f1204fca195b5ee4a45f7da8a188a7cc7fe5a8eefbd3fd2ab6ab5f5d6531cba06b8bc04043ed848f83541edc267f96453b7fa2e341aa40fd17c3cad7dc
SSDEEP 12288:2tLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2yNyBo4kx929bL3Hnx
TLSH
T1184523129A0C633AF76D3EB065498498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 df145c677ba4cb9367ead634af48fb93fa17c3057833d789d5ea25879a7e6773
MD5 e24de818713a69680f8858239f409eb0
SHA1 876cafdf19f4996d7d5ff5d45ccc4dc1a6d45547
SHA512 cc92e76219ede7070f51832db1fb272863f45c0fcd06a7bf49ae2073c061b5094391601e718ceef0178f374a2b6835bbfcc8c93fa59673b5eb205dd05c4eee4a
SSDEEP 12288:XiZwbjzzFEoS2cPvyFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:SZMXzFVSOaNyBo4kx929bL3Hnx
TLSH
T1C8650195B39418F8EC67823DC8158906D6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2e9e1f8d522af496ce05c2e611a7339d83d38a4afa75ca69ab8745b55af18bb0
MD5 c0038da1207f43674796d2ab976fbd9b
SHA1 e6ebccb56f8dc84254ab9d6dfaebe7760b5f4c49
SHA512 33ab8e0df0e9c60649053464fa0b1dd1a08dccfa8df2cae4d9f144e4fb287fc15277bb7869d0989fd479d4a46dfd931b37c84a652e8d233c28e1b87db4d71d14
SSDEEP 12288:DSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:D5NyBo4kx929bL3Hnx
TLSH
T1E74523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d062bc0389e4e29921ceb057c5a189d1ffc084ecd3c91cd34a4af1463224ac91
MD5 d944971cacd4b9ebde81f1ae23a9dcfe
SHA1 a3d53af87c00cf544b62b49b891b1613933fb28c
SHA512 6a4db14a53df135939e3053c2016676d0a014bf58ea91ff3ac71dc3027189a69580d46a676a3df626ed0a7e368918f619c37681a1d77d68f07a85302774d3a72
SSDEEP 12288:0GLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0FNyBo4kx929bL3Hnx
TLSH
T1D14523125A0C627AF76D3EB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a4d67ea4298a5405efa6d89d43a8bb5e42d5a160110ba2aa17673bdfed4f46c3
MD5 e3532f295b99675eb0d82e626fb34f79
SHA1 d2f105372e1278fa21b2fb996c8f7f733e7eb508
SHA512 f9f6a944b6430315f8f5c8a67434e09b9029ce6c7de79eb28db0320f79a87d4c49d8175805834bac08311b2f579c965a41ef3bdb6c5701aef71b558aaa7923d1
SSDEEP 12288:5yPz5L8pLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4zy2NyBo4kx929bL3Hnx
TLSH
T12D55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 603d6f1f040d087b7063b1958a068901c609b29fe2a50907b18d5e2faa109065
MD5 6f159dc6da2a33365c2773e3fc799ac4
SHA1 ed7f52f2c514f0cd211724a9c9e4cc9352c98b8d
SHA512 d9c448501d67a19414b1b6fd59af3ef791335625a435e8cec602f898e0b6b9078fe3cc93d6c826aa457d2cfb20a57a0f14f2a1ce6b994b5dc9131bea9ae7283f
SSDEEP 12288:mSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:m5NyBo4kx929bL3Hnx
TLSH
T1714523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f2626dc584aafc135d0552628f97a0b27709df33ab5f9b0eaf71dadbe15fbdee
MD5 1faf5848166d53f294281ce04139f515
SHA1 0e35ead9a142c0d149a9bcf5b1f8fef3ef732188
SHA512 5dcd396fa646d0bb9fa14ea46338750e64e4e4efa33b8f94ce7fa867cb2880f99f6df5b58ef164c1c37876dcc5c2fd0f59d68917f3196a393fc1c9075baddfd3
SSDEEP 12288:6SLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:65NyBo4kx929bL3Hnx
TLSH
T1FB4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8e9187156dbbffbc82b9df354c648a75e039dadc0d95fd98e491c5422355433b
MD5 7c8b5e73a90a752b5a6aeb273cb8bac7
SHA1 2c21325e4d6a0a16a9a5375ae2e3d79e25712cd1
SHA512 a2ff0b71a4bd24001a5144a92b84fb61b4f6d6a771cd785ca00140aedf57c75ab5363477d3baf390b1314cfcdbc2f39d1a7125575504358dcee6a5a6a01c809a
SSDEEP 12288:wyPz5L8pLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Bzy2NyBo4kx929bL3Hnx
TLSH
T1A355120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3406132b17f4b617cf9995a6d1dd1bf1b0f2ce07916a9db7967ba1fe564e8de2
MD5 0d13310a1341d17a9cd75162ddfb33ff
SHA1 209cd58cac9f5fd41f343275ecadc68e665750f8
SHA512 dc5b649a2a69af7e18a74029fbe0878eb2683a4fa60e6a870d01ac338b80f0f6d5fe489f08dca8e0966f55f45ec8cf6535d4189c0879ca3ac17a1f1cf9e60e85
SSDEEP 12288:ECd98WYoaLHF3z0z04PDvhTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:9TtaLl3z0zDANyBo4kx929bL3Hnx
TLSH
T1D36501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 911c1b5db4529ee8286f9299c7151abe5a88b60b24cc51a1e383b92b610ac0c2
MD5 13d4590d57e42fecdad1f91917a7600f
SHA1 cbe02423c6462334b3cdbc8e33b27d1e56250a26
SHA512 54d01db776f8b1c5e2b26cb4c744c90c2603c4bda7635e06904a9cde6f91ff4e90cf89e01d4967394196a49c56a6f399191ca28d8ec81a881deea0637114b883
SSDEEP 12288:ii4e7ARdTfgwCHKy7GLbbdIvgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:i3ld9CHKy7GZ0NyBo4kx929bL3Hnx
TLSH
T16475CF90F3E810E8F1B79A3489764511C9767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a830f77572f5b24f04a99820a386f83b31f75270ec3726546e4031f0a4bdf4b5
MD5 14ca9d1427a5fd3c7d4b7f7f39444d5d
SHA1 47756cd0d09b512c33d7bec7c4214c1f0c146642
SHA512 813b2f0a8f28d5d12257c32f8946026b4c1235c43e5dbffd4977788858a015e59556bac08723e03c1a84a8a33700b3377a507174737b700d7ebcc25711561d94
SSDEEP 12288:VDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VQNyBo4kx929bL3Hnx
TLSH
T1714523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 df80f5f8896e10ba08841db94fe399f5eff8f27d3768e3f2298702259ca5cac7
MD5 75652dc6b3eea6a1d809e2b4dc0b35cd
SHA1 4835eca4fb9d88c5d72e29b12d586afb48bdacd2
SHA512 824030f3b63cc06e597fb99820efe9a73aafd053ed591021fdf9e5aa09c05c5d6fd2c60bf91a8bff404bd35b9a9aec5797849cecbff25878a908dc9b4d50c39b
SSDEEP 12288:cJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cWNyBo4kx929bL3Hnx
TLSH
T17C4523125A0C627AF66D3FB0644A8598CC34BC8F1E9597D8EF679C7759FCEA24B20103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fe2d8ddad05c021152d67e8db5eeeb1f0181395db8e0e5a577ad3d2b69732400
MD5 53d017c2466cef8405158f43b5f977ad
SHA1 175f04d02b3dacddd12559164c172ce1e4be1d7e
SHA512 0b21e9eb5ae3f169a9ab34bdde2b37b6412e1958676a863d0a45b066cf0f6493c2e26ab8426a9d405ac846401ca4865376d4e64a3627d78319a7e2f505aac549
SSDEEP 12288:QgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QfNyBo4kx929bL3Hnx
TLSH
T1AA4523125A0C227AF76C3FB0654A8598CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9f4685f971928b6c49c0d2b19189d04fb44febc76fd5ca2babd6e6f55a536544
MD5 de2cdeca7f4e803d710c08f4db3b1e0a
SHA1 36d432292c1859c798417354ec95ab23b07ff4aa
SHA512 8b5e236caed085867d78d75e6f65c6769928ae8d8c7bf0f264c6dc719fe746781520854d2820d2e8eecb910cd24123c8a0f55666b8b8657a3593b031fa64e5ad
SSDEEP 12288:1SLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:15NyBo4kx929bL3Hnx
TLSH
T16A4523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5658d94ac80a03b3263752063f7b8f6827d79dd38885786f023c375e00eb00e3
MD5 483ca10ebdbcd8a1ac26c311328cc630
SHA1 bf5153d611b0b6bca84a185f86661af9f3e3b296
SHA512 dfad34bc08e1629f70937bb3426a952badf8ee8f21381af34dd1017db6a4cefe3af2af3ddf022f6a9cae1ebd1caef72e42e890d1727de1557da4b702938e771d
SSDEEP 12288:vDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vQNyBo4kx929bL3Hnx
TLSH
T1154523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 34d17207adcbbd54f95fd323719e6ecb9d1372f3ec3004b071086cc461cfe4d1
MD5 dbfb0ed7ad15d321456382fdac45204f
SHA1 71535a20f8d77ea67d5b5b7db79e629776a20f38
SHA512 0ab005714f9955568842cb881d55edda05a6223e5cf9fe9902ef349af625fe28da64f898d488f6685923c7430e5cb51b82cea321660e69bf6795411ac0c06d0f
SSDEEP 12288:MaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MxNyBo4kx929bL3Hnx
TLSH
T18C4523125A0C227AF76D3FB0654A8554CC38BC8F1E9693D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 606de45eff245e4f1159744162ecdf5e99b4f92c2bb808bd11b9dd2ec7942052
MD5 e35c02a9e6b28de744151794603fecd1
SHA1 e66dfca2ef6d9d502cabd35f9640859564b74a22
SHA512 6f3dc7a7e779ff1dc111c1b64d07a64dbf6e594c2c55dcd7c5310431e7baea509b3d5bd7d378bce026f46e660c4fa200472f53178039a1a54b8f8b7b0abe0516
SSDEEP 12288:CELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CbNyBo4kx929bL3Hnx
TLSH
T1B54523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 92e916982d43e99578d412859023d14170d345af7dcfc42a2972c1dd28f90c14
MD5 25d5be6d4d0dc0fa11dfe916381c0747
SHA1 aafbf8d1cdc3d9fdaada27c85c3f0a4e7af05fba
SHA512 e6b7f4b472e2d5a65930d140389c7a87824a6f56bac4f45d741fed993beae9fe1689a37c393bd2d6ad1e2d1711bb7fce0dfaad0af5a2518ea14b17ad3540577a
SSDEEP 24576:Dfwvqk9RX6wkyAI1NyBo4kx929bL3Hnx:HMnYIiB+kn3Hnx
TLSH
T1A685DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a9486e56dadf05af0301365dcec4ac067bdb6272e19be124b8e1099f8718ea56
MD5 70a6bbb1fd313bd37c87b02dd4e93709
SHA1 339c1e207be6aaa9bfd656a82ac1e89d58dd6e61
SHA512 4049e35d2abe7b01c5d808909097bb14b716b2b3a0914ddd3a3162d854840d3e1ca8bd4aecc3b70b7113ee6956e5ed21429523c65ca4c67bd5c255921b65c5b7
SSDEEP 49152:aYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XB+kn3Hnx:hySzPZ+k
TLSH
T141066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2a2985c70e3a55c47c47217ef2ac2081a8a3d4d231d08486e496c83fa8a3bec2
MD5 d681ac41a61e4280fc4bb92f7fad0be1
SHA1 cd60cb0e996b4a58a9c2d4148ffcdf71ca008bbd
SHA512 078f2afe24b1858a730366c315b8dcd4c29f2744e0e15c7604130f2d0fbcf1ab3dde7e8e333dbb1a4a096ee491f6098a3e3f689d3d90f65fce4fe4d90dc21631
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKNyBo4kx929bL3Hnx:U47JUQjTirIhCnDHUPfF/nB+kn3Hnx
TLSH
T1D565AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 55b5023d7252d15100752aefd8d77d9e88edd454051d9dd62a1ab6d78e29b693
MD5 6760e276d85436bb50a3e4872debcfda
SHA1 f12cf60f5dba5c5123c0f6b484b38d51ff2134a2
SHA512 70018c85ebe559610186491817c968a13b04d76ec53fda4564fec331cccd29e50d307d4219260761317c93a35d333ece14f52bee07b0d463515c42e5959799b8
SSDEEP 12288:OpsfCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/JNyBo4kx929bL3Hnx
TLSH
T1EC55F00AD25812E8D16E6274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 5a2dcca9b5dd9e34026a05d549e1860da3337147ab1bf7c8b5ae334582f46eb6
MD5 2d222d27d037a34812219fd3c6417992
SHA1 2246987b85104a87dad9bb1f7a0149457f5b979d
SHA512 e848d117fb0de11a7cdcdc2d5119f41adad116666488e11781197d64906aa802b92441eaa6382a34409142143918cc2a0a99c06b98c204c611263f694d750721
SSDEEP 24576:agFFDUP0hPODuFaI+oRYcyE0d4lBjhckQ/A:nFDUluFByE0d4lBja
TLSH
T1A0351744762ACB4FCAAD40325E36D1CCAB707D11EE046F0773C88B3F9576659BAE2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 95615cba6a1aafe58294912bb06fc9e0051b70afefe864e31f80a7b85ffb32eb
MD5 60f30a3522242ad769bde4a9a131d137
SHA1 316c766667dc16065fa5670897d228577180b00d
SHA512 f964e46f3e164922bc9481eba34ed9fb8283aea0697e68b0a22e90636d013b839e1f3dfedb112201b3ab4136c5013ff34b296d0c3121c112e42b8ed1b2f3c4a6
SSDEEP 6144:OIddnC8HoTDQ2IAfc+Y+uH+JJHqoVGMOLtMxEw5jYqOLtMxBlSZS3J0UEOkcq5e:OIfnJoTc2BfchRHGJHdVGUY3kl
TLSH
T19155E9409537E3CFC1BB6032072A6B4D7774AC167B457F267389853ED82AA16A0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 77d02648f47475335f6d1d3372a88fe7a5640b6bb35096d13805a0f844e0690b
MD5 376e295e26d30300f0986165e42c1561
SHA1 0a71621c632308c8fe32c4797201c126bc80b258
SHA512 683b276a04935ddf14545a64b8c1278b64f10badc230a27cd1966a64af327dfa5c2ab1c4e1305230e31a5934ec67f750e5d96a394fff87a4ec8409754d8f82fa
SSDEEP 12288:Fy7KLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cBNyBo4kx929bL3Hnx
TLSH
T1F8452312974C663AFA7D3AB0645EC124C839BC4D0F50D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fb94b7065de2a2d89783b74faf224b52ea4110996423bb7158472c770a77d878
MD5 08ddccc7f737cfa26ca712b786709af2
SHA1 6b88dbfe9948fea3c64fba730a2667205386ad37
SHA512 63510efef144dd3c3a2eb24d4a5c4e04550e9d4d98f5e33f3ba07c0eb168e508bd23f2a74886cdff39e1b4260b5ac30e64cae62156b4bec5c416a8af68de0dc5
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYHNyBo4kx929bL3Hnx:dgb4mBIBhGFZB+kn3Hnx
TLSH
T1FC65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 42a3b6744da3ff5a0f4fc69b307070f5aa8f53a4584fa61b2d7fbc46d140a90a
MD5 8be63b0b082135824e9e3a381d10414d
SHA1 2d2f1dd37d30f10146ee9cecde85e41f717dc4c1
SHA512 6b9f5cce0ae2d35beecef1de64fe9fb3f280f4a21a650f854004d5bfa8bf61634da5a0efcb8eb1f4f42fcc5a66586b1a75bb80ae6aee847f3aa15ce1dab56130
SSDEEP 24576:2G88u8FpJqH1Jzria7/maNyBo4kx929bL3Hnx:d7ZFPqVAa7/QB+kn3Hnx
TLSH
T18F85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dbd8d8a817afdf41d916500bd1b79f44481a8555574fe7b7b24efd809cb80fec
MD5 a9d900a15befe37792617c2f1af3b7ae
SHA1 a4514eb338db86d22d353b0f97d002379521f760
SHA512 152f7092b9975b675cdf74686b41ead7ec33da86d039229ce06098d9d0a457c91db2c2d56d6787c718f97f3f11bdbb7ddd3d2e3b4b8416f72ca894369b37760e
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlB+kn3Hnx:dG05lO43bi+k
TLSH
T153D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5400fb033845ad5460efcd76673b25b2abb9d41d0a0242eb0cbab5ed04aafd6b
MD5 075d7c1984b6505ca841731d33a4e31e
SHA1 aff43785207ea5566fd003749c86c9fc733eb5ed
SHA512 38a5987b87ee4e87490cd9ca2594eb81e094a3a9dfe95eb80cb36c8522f7b675b7fa04bfe701372fdc7e1e722e24b92b10bd11cae2c502c5a2c04e9c3302b3a0
SSDEEP 24576:4fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnMNyBo4kx929bL3Hnx:Aa5POZ3BJt2pasx2+mdB+kn3Hnx
TLSH
T13365AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e067dd29f6e13649d0805930a32cf0efc606bff849deea1841c16f4490149928
MD5 84e3401d6a7ce65b757558ef53c65ef7
SHA1 cdc55c6656c98579951b41883459eac57384ac58
SHA512 af5c0475ba691762ba8196b88e62d75d50169420e890365d74919304403293cf36074a26e02da6c0448fae0fda819e448d7b60dda16f51852490d1406a8e97bb
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkCNyBo4kx929bL3Hnx:HNc/zEOVHFwB+kn3Hnx
TLSH
T1AC858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e923fad9006e17664c0422bfc19c40b04de193b94f159e8f913228a701f3ba63
MD5 2d33551eb82294ae672da2ef23ca8a79
SHA1 1355084dc590d6c19dee1aaf85574da2c6cea62c
SHA512 dd0f4bf57fb183b81fbee1ad3f910240a6aa97382d6ffa604bb6d9e2dca96d0c8d55dc0b9143d31e0b3b97a351635874695a511b9a6769461190f229c04198d5
SSDEEP 24576:ATkNvNnaFeYhJNtmZBmYNyBo4kx929bL3Hnx:ATMwBtOmbB+kn3Hnx
TLSH
T12255AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 529e6215533791591975722c52e5df6cb25f413822f13d629b1a94f761b2bd17
MD5 c56d06c99bcf71e8699f74dc67682c54
SHA1 ec4dc9f572dc90768b81e3a6ca8233a6726c9a58
SHA512 f31b35f64c1ee3bfc3138222f99ba25a80d3980c654bfb091146551f3c0c556c3c52066c51da9526cedb4982f3936d3f86c20596825ead5bd357eda7bf0fd882
SSDEEP 12288:AHvUrBFrEjwaQBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:APUr+NQ+NyBo4kx929bL3Hnx
TLSH
T19465F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ec6adac4682e95d554c51624d2fcce301eea7751842ac8f2023ad8deda420d80
MD5 3d9ecaf6eed28c78e5adc220f399a955
SHA1 8bd260b25b5c1aaed2ac13910ae381514e29e56c
SHA512 b81df816a5d7b6395d0e7cb865cac7e37a2a981290cf5bf30944be94c5527a43f5a609625cf700d36a01583c8253339e5784535494fa5915caa51e36b6df4f85
SSDEEP 12288:rQcMxWDXN1Dp/fshBItT1IQgAOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:LD3FHshBIYQgA9NyBo4kx929bL3Hnx
TLSH
T12275E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1008-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1008-119-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1008-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1008-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1344-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1344-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1344-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1344-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1344-308-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/1412-77-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1412-301-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1464-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1464-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1464-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1464-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1732-73-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1732-67-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1732-65-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1732-300-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2656-107-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2656-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2656-304-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4100-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4100-82-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4100-329-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4100-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4100-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4100-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4104-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4104-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4104-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4104-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5588-285-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5588-54-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5588-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5588-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5900-80-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/5900-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5900-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5900-8-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5900-0-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/6252-52-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/6252-50-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6252-40-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6252-46-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6252-39-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/7024-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/7024-305-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/7024-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/7024-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/7024-100-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/7024-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download