9dec08da99f66bbb43a72b8d94a5072f22b0c531c2306aeb779f97da08acfe9a

Analysis

max time kernel
129s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260708-na7sfaex3s
SHA256 9dec08da99f66bbb43a72b8d94a5072f22b0c531c2306aeb779f97da08acfe9a
MD5 9cd97d283e875ecb0f30582d47d2747f
SHA1 a763cb475f9194709ceca2b45a1ab3108ae12184
SHA512 26281f8032238e55c6609bb1a5d6f1e0c6c9da5d2ff601f10f917846b062fa9cd24dcb35c0c86981b00b3357ecef4e30a9b28629d4a4eeeaa1e94b163b0c96f2
SSDEEP 24576:9nj3QSV8LObcYall11tmlNQ2OnBdFQtP51llPup33kT:9njrV8LOm11tmlNQ2ayVup3
TLSH
T1E775F01DA3A515FAE5B7D63CC4A24606E6713C96DBB1C28F0361194A2F337E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2644	elevation_service.exe
1904	elevation_service.exe
4380	maintenanceservice.exe
1084	OSE.EXE
5260	PerceptionSimulationService.exe
2028	perfhost.exe
2032	ReFsDedupSvc.exe
1292	SensorDataService.exe
5004	ssh-agent.exe
2172	AgentService.exe
5696	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dfada2812468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000099ced5bcca0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000110babbcca0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082afb1bcca0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052d4edfeca0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000324df7feca0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000770525bbca0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dd9d8feca0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{CDF74A53-43E1-4095-A5D1-BE543DBEEC3C}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{024773A1-DD0C-4866-8EFF-4AD0E9614FFB}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
2644	elevation_service.exe
4360	explorer.exe
4360	explorer.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3204	2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2172	AgentService.exe
Token: 33	5696	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5696	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5696	SearchIndexer.exe
Token: SeDebugPrivilege	2644	elevation_service.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeShutdownPrivilege	4360	explorer.exe
Token: SeCreatePagefilePrivilege	4360	explorer.exe
Token: SeDebugPrivilege	1904	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
6036	sihost.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe
4360	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4288	StartMenuExperienceHost.exe
1636	SearchHost.exe
4360	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 920	5696	SearchIndexer.exe	99
PID 5696 wrote to memory of 1876	5696	SearchIndexer.exe	100
PID 5696 wrote to memory of 5256	5696	SearchIndexer.exe	101
PID 5696 wrote to memory of 5944	5696	SearchIndexer.exe	102
PID 6036 wrote to memory of 4360	6036	sihost.exe	108
PID 5696 wrote to memory of 4640	5696	SearchIndexer.exe	115
PID 5696 wrote to memory of 5460	5696	SearchIndexer.exe	116
PID 5696 wrote to memory of 3184	5696	SearchIndexer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9cd97d283e875ecb0f30582d47d2747f_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2736 2740 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2580 2576 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2736 2740 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2580 2576 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3184

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4360

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1636

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6ea507b9fa606cf59d00f6d8f40d091bca8c8d06f3ee4fb8ad5da693685ad815
MD5 0c7fa36ad1be30dae7a597eac0dadc20
SHA1 82e360ffda562574ee03bdfb2c8c022df6d4bb3e
SHA512 88cf58aeb9efc80be32352241aef02e1ff4d0943c081f2dee6fdda5eebf8cce9019299b569ba18317bc782832617d616c1386712bb07a331238d426155837ecd
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxns11tmlNQ2ayVup3:I3q6HjBh11wlNQ1ya
TLSH
T162D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fae4dff02cd4ed23bd5eca2fc22331bbf406700616c0643fd49cc71551e5f243
MD5 89bc157294667377c4d88f14d971e3cc
SHA1 3a74b3239849e6d916fff99ca7c3028ba0c9c20c
SHA512 5ec9e31f1c27f589145673b73f522e13780f0b08ab42af8e7e8b1cc6b6f97046adecd332348af40d2eb24ae016729506164ff9d75bbcb543cc2d8e51f2619781
SSDEEP 24576:hXYfDtczAfl11tmlNQ2OnBdFQtP51llPup33kT:ktc611tmlNQ2ayVup3
TLSH
T10165012837E508F9EC678278C8B2C511EA737C954764E69B03A499251F333D85F3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4d5c4d53a52a32be87363c301bbe5670123ce39507c2c53bf1dbe82c0547c52a
MD5 a21b99e876e933cd2533c60d6446de39
SHA1 18c2b80e76cf3f900a57ef8c643e8ab461592f54
SHA512 49948296ae8cb5c1b72ccf7e22f58b48bcbd4c2bcb02bddb2ba554d21be2bb0935f00a7d8f91e9aff82ac5dc5638fa585b167f8e493a308862166473f5ff0dd0
SSDEEP 24576:80Le5ji0hmxirMQl11tmlNQ2OnBdFQtP51llPup33kT:8Pji0Acn11tmlNQ2ayVup3
TLSH
T1F385AE25F6748735D073C0B9C5D2A68AE97230865B3089CB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f75f7a197cc0e6294406f0bcd6a7ff58b5a99753cbe8310e4a177aacd2c0c44f
MD5 c525e071fe8208768747ad3fb1d57d16
SHA1 2c63891a5d4eb7246016acc2146b71624a5b1ffc
SHA512 6562b83fb1122345a597ffb3162bd3eaa30d6342d6f1d6e95eebe58798fc2252abc0d43bdffc1ff81b23ba6eaa0b37d606278b345d6468a9395aada499a0376c
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyuil11tmlNQ2OnBdFQtP51llPup33kT:4/ezSC6vUzPvxHjyj11tmlNQ2ayVup3
TLSH
T191756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 36f006ad1b7bef52ca8ee161bbec338d341faef66c19fa5a76c2fd649358c302
MD5 6031c5c4ac448b19f8634b3946fb8926
SHA1 8db965d7c3415a2578251b4e6207abbb3e3a03ee
SHA512 3190960ba2ecde983bf820978e619d8af3662323b73fff1e3aedfe2f4f9d5f4344053a29de9fe98f1ec1dad171db34310e79dd9ab4bf3490d7642b588db291ba
SSDEEP 24576:KVbqPb88hv/l+6Tl11tmlNQ2OnBdFQtP51llPup33kT:KVO88hXl+w11tmlNQ2ayVup3
TLSH
T1AE559E65F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6fe783c9d379a677f4881ee7634d8b22e0e726f23d9ab755f22f6d96dc0a47aa
MD5 23e2f517b5605074dfa9d2760619ed7d
SHA1 546c7b79d7c1abfffcf4bae7621e32efdfeeb9ff
SHA512 8237f7bc96d2894335725673d4f9cf26eff758c3a385988ffe415261953c95499267f98a20ebf91b58a9523e9cbb3ca4ee678d0ac873d63b7cbb141e59568ab0
SSDEEP 12288:zRklnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:zRkl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T15445230414961CD5DEA74B7060B38EE0A9DC6CDAFB8E2427870039091ABD77D935E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1db365883ca3fbc0c7dbe69cac9dd387c7e3eacf74f0b567c454f3c9c8c67ae4
MD5 5a0d77b6caf09a32012c2a4f34049787
SHA1 703ce1bd8b8cb2afa0fdf7727fa6d58076482166
SHA512 a1ebb01ab0be4448071c8fb1e731ffb2207f145e7cc913de25b477c8cf7e2d11a7d9572126922040f6d2f7a64bcd743b5224a0742c83b5a61a73cbc74378118f
SSDEEP 24576:OJIUbl11tmlNQ2OnBdFQtP51llPup33kT:OJIU511tmlNQ2ayVup3
TLSH
T13E65D03BAE28FCD2C67A4DB85691C740D7B278704F52A3CBD124820EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ded2250bf7d658d28c9d85e1fbaa8dbdf10f48e475f05456d56ccbb77ff24fdd
MD5 4b92584cbc2f0c0562ad35e54566e908
SHA1 1ba8ed364ac46d599fe211b5a7250df3b42a318e
SHA512 0cb23de145610b37fd9952b567a621aaba327bc9a2eb60b7cf1a7f6d3127b4328447ba4a5d06626c2cf0d72ca6863ad8950ef88a92d85a81add42c05ae7d5346
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:ZQvGAdlCEL8c/yRNw5Ca11wlNQ1ya
TLSH
T1BF267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8ad32e639f6f83891df995ba08fa0775c0c8440a5d8050ca8991eab2f9aadafe
MD5 eb211861c5418cb04a8df4f0bb184cce
SHA1 8cd559c4cc1d78a389edc3d08cac8919c4b1726f
SHA512 477b8123ce6bedbfeaabfeb657e3f674f9ed3a9eb188ef5c75b26d0f28e9926225a2edd796ce58fc6146024c3d375c0e12b17859046f4fb387768dca423d0e03
SSDEEP 24576:AdewsAjNl11tmlNQ2OnBdFQtP51llPup33kT:wlj311tmlNQ2ayVup3
TLSH
T11075F030FE75E436C6BB0DB21B36C716187C79604F5219C3E3A85E9E59342D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0ee9b423bebfcfcf9bebdbf752f4f6defe1824ad1dd2bac4647eb889c3dd06d2
MD5 650bfd6fdb12c3e62dbc8987b3d4bb3c
SHA1 e04b800b6b2baa004f01f5d115b816b77174a268
SHA512 e5b9cb69f0d1cb0004d902a0a67da2d3d37286706651ffe5b7f3f1dae35b9eae50a23dff54c3852c55a122abae5fdad6ee9f7f16e1ec2b2c494a4a86bacee058
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHP11wl2:gUEtQevvqc2W1cpV2EI32DS2
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7b2d8153662d49f76f5a35ba93c9aadcce7ccce7cc8aae00d0ffdc15d24696b4
MD5 4430132e42663763c96ddb71273a9070
SHA1 2372f274efcdbc39ff0fff2ec25233a95fe80b61
SHA512 de51f7e165bb78f3f7ea2eb8af1fffc75f8f94aa132aecd234970478abd884df255b6ba7c520f59b85041c928600d87350c1fe87fbe547aa24c93ef03d726771
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zX11tmlNQ2ayVup3:PoqtVjnmW11wlNQ1ya
TLSH
T1C5D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0b4fcaa28535fe9da296c44375c8f8f0d6fe01cec2257d5ebab8bcbb98fe97e2
MD5 df1373027d692af1afbb534d2e8187c9
SHA1 996d52ae73f00f59f57dbcd752d8db1b76e77d59
SHA512 94eeb3448bc5a2f2bd51604736e58e7db034d740b9d302bad6e76080830cf6bad7391a06614194f043a65a94257a26c35f1c81aa606f685a2661c72845e7a8c5
SSDEEP 24576:BAhGLJIFoiwtA5l7S53+l11tmlNQ2OnBdFQtP51llPup33kT:BAMyFoiq5m11tmlNQ2ayVup3
TLSH
T139359D80E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 bdfd9ef0b06243d5f7677a65814bfcd859a782531dcc0fbdb4b6d1dae18fc3ad
MD5 1ce1d8bb96085e8243d87d2f60234c88
SHA1 5ce80a378a1b78c4d9d7e12bc934ea42af879498
SHA512 20fe7c5e24d921de8e3501e50f5d6112c3ed40db59fdd4c33a917b37220f5a5e488e85fd466c5ddb7a29a0e234c9b434c88e0dcad2a63ebed27d890a4701b803
SSDEEP 24576:ewuoOWJl11tmlNQ2OnBdFQtP51llPup33kT:ewDOy11tmlNQ2ayVup3
TLSH
T11565F14936A50CF9E9A786388597C536F7F6BC022A25D71F0720C61B6F373616E2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6903803b7fbeaa3a260e9787962d7ebe4e2ce97d8142e51836854d9ac54955b4
MD5 8abb0e08308a2d8375536f23268ae1f0
SHA1 26bdd425dd78b4938ba544d05e315d5b625e0679
SHA512 b0b3f67f5ba2d4e71168cf067c793de85527b82deee884a010282947191c0d3b6fe71028cf6a28dcb277b06fca6b63ab18f861d847d1f17680ee0d1cbbd1281d
SSDEEP 24576:4Zu4l11tmlNQ2OnBdFQtP51llPup33kT:C11tmlNQ2ayVup3
TLSH
T1D155124822E524F9D5A3837898F28A45E7B57897677603CF0710162A2F77BE51F3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 271a963fc0750396c84dee3e74e85d99e31cd1c95da06fefabb5d2a3fd8f4302
MD5 196b27fc1cc56ee2bdedd795ab7ad602
SHA1 039b500cc7991698df9daea57402e338a5e962a3
SHA512 c7087812898e478ac5c4f5230e3bea17954fb2f855c1836b73425149e018a39c0f5b52f1ee1f43f758004da9e58523b08b09fc22b3cc3faaf5cedf4f936df1f3
SSDEEP 98304:CQRQyi36YOcPQLvw2gAf+PN3F11wlNQ1ya:ZQyiKayX+PN111wl2
TLSH
T140667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 208eca4605415697e6229e78df8aa522d49d4ea1d713275372b23df991a7e3a0
MD5 ed8d8afe4ba3c742ed2b1bf748abdb5e
SHA1 6524761691edf9a594adda7128fade72eda2c866
SHA512 31852dc819cbaa4d779ffe072561535289f9bab6072130b977b41a93ce8a99acb1a4225c59c988033ca1899a102e2140d86fc91133e4f5eace4e7a6799637d1b
SSDEEP 98304:MQRQyi36YOcPQLvw2gAf+PN3F11wlNQ1ya:TQyiKayX+PN111wl2
TLSH
T1A9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3196d5d7dd726883250f8631684beecfb69b4af45637a45a00f03e92771b3b01
MD5 5cb26c9b7756ff223539ecc3ed430dbd
SHA1 8750013e9946b011a71f2a00136834da3961fe48
SHA512 dc2eeb65bcbc787eb7d5869403b511e6055b4ad8f4967bb5635dd366c8f6bcc95d70948c0bafef7df3467684cc05b71d1ad9f604eb12c4075e89c5044332eb84
SSDEEP 49152:j68Qg55nhheWu7PNU3/n11tmlNQ2ayVup3:dthWRc/n11wlNQ1ya
TLSH
T17DB54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1e24aa470328e253608b3ec3e7ba0b3c1b97eb4da1c0126b2880abe6d66aa3f8
MD5 193ceeb09c91d9ff26076dc835f5829a
SHA1 cbaf5cada38a9970e3f2f6c797ba284de8e85f9c
SHA512 c6e40ea28593b68a499722bae9f4fa6167c2942156e5f336dc11417668c2b3a5692c69b5f017b3cf94842b86354ee843bc640f95257920d745d620086874c74a
SSDEEP 98304:by5112gYy5azzVvL69nLKnhZI11wlNQ1ya:2LIHmWhu11wl2
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 78fec8be66f0073cb4f0cd09f6159fd69c0e71d45a8d2bcf585d403f3bcd83fc
MD5 a1aea2f4d00cf5db2282ee2d73337fd0
SHA1 e90bd7277217b8a1a9e0caec10f2a9518d73246e
SHA512 25d3de50d0f9cca0b594c7da35a99ff8d63c288cf48cab7f4e5228f1a8711b203dad6e0db6cc5686ca3c6b81c098c8451c6fb633298030601b321e7357fd51c5
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glN11tmlNQ2ayVup3:qu6JmVxd2dN11wlNQ1ya
TLSH
T1B4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7b27da3067ecefe9d779cc41b108611865a0cbf852736e2b98761158673688ab
MD5 2c2cdeba22c5ceee351e9357556e8ae1
SHA1 0ebae12cb08da4c83d6ecd7724ca20a64e691531
SHA512 fc482e5d5651de368edbf85a3a76a6130d5a7976139d9608f1de967d0206be0fe0e1c15dc38a7192f55bf0de94a811a4bfadf366a695402bf54b68b5de835eec
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xZ11tmlNQ2ayVup3:CmifPbRW11wlNQ1ya
TLSH
T1ACB5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9481f9915ea057457b37c0f38916cda19ace123bd5e841348709e95aec6dcaac
MD5 b38bc7d7e240ce04b778b2561f7966e9
SHA1 ee8fc40d48545e2dad748314a062e3378691117a
SHA512 01cf1e68711c3687d466f5cf6655ce9c84abc3287f7b7772e39eff4316324994e1531b96129a497b0f07bf0335d769685ee03550e357a9c5d550a56eae57e4ac
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHq811tmlNQ2ayVup3:x5dKTi61811wlNQ1ya
TLSH
T1ABC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9d9f53850ae61549250dfd8fc9b6289040f98eb1e426dabee212acf56353cc42
MD5 58e354e1cad7ca4a8398dab13021197e
SHA1 5ec4402262cca587f13ab3f253aadb6daa882794
SHA512 3fb5c3a1a6bff827123e4a5b89ae03e2d43441b5768d3e695c6fc57af47ef72d33fbc479494435d6479edad23161dd888713590e0d400c93a9a3914a05e69c53
SSDEEP 49152:ahtSn8EApI0figngiDn0AP5wd11tmlNQ2ayVup3:bX2iyphS11wlNQ1ya
TLSH
T1F195BE13F2D900E8D05ED174C7568632EA62BC160B39BAEF0A50B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5ec1dfe59b499e8388aee1071d604bc2954301e298e023039ac721b6b7e6ae6a
MD5 3c514a87ee0e1face30cbf8035675a79
SHA1 d82e884a6f4152d84bb2e1e45920d1688e73ac39
SHA512 ad41c55529fe417e4cce8930f7907ca96ed12f304db1877290be5c3664f40504bf158eaa7d5cb9ec3a45bbd1f3132aa95bb59e0db9227c926760cf5f460cef3f
SSDEEP 12288:sslnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:ssl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T12545230818A70CD9D8534BB090B38AD4A5DC6DDBFB9B2067570034156BBA7BD135E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 344be54fc87766524c6dbbdbe89bc75095544946a6fd1d59ea24d1a953ddef10
MD5 6f94f30a1e603da3687b256a61b9c58d
SHA1 42f911cc037217683e4f4c0f929a4153394c9b40
SHA512 7861633ca87b630a0d57035fd990118da5cb8083c159ae59501bbac0dd47cd750c290169458a534ca6a248da4da9d598bdf2e43a243bcfe623eec33885bcaa76
SSDEEP 12288:1hlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:1hl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T12045230828A70CD9D8538BB050738AD4A9DC6DDBFB9B20675B04341567BD7BD231E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0e316fcb4a7d50196309f4f198f4915240d46129eae94ee683cfca566a1aecd8
MD5 16eebe929a3bf83a9bda5423fc5453b1
SHA1 abfde0575a33f05c20542ce8bb752b90cedb43e1
SHA512 7b239374b2110332a45e793abcb27c5538cf783af78baf0d497c250a53920f5479635461c9cddb288a87775ec8b0c7578f5fa22705eaf57c4348619511ff3507
SSDEEP 12288:njlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:njl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1E245230818A70CD9D8534BB050738AD4A9DC6DDBFB9B20679B0034156BBE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c38aed6494b1bfbadaec722d944eec2e7e01235ce66061f0e87d668abf6c6843
MD5 89d24a537e08dedcd068214949bb778d
SHA1 237d02e2d1662f4f6961167d072708844c806950
SHA512 dcf25ae22de3ccce30cce8fae3bfd7e1b5edf473cee3e14fffa07ea896adbab0a008d3de4fed0cf111fa14e036273a0d2e74354aca4282d441d92d90b615b5d3
SSDEEP 12288:7VelnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Yl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1C145230425AB08D5DCA3C770D0738995E6FC7CDAF76720AF9B0024191FB57A827397A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 766ca0b4b5c86a5ba78cb2bd8f470e18ed538d0c00abde942fb589037fd3c541
MD5 6ac3a877ca44fd37534101e102495d6b
SHA1 2bb1449d0ef54902e7372595bb0802c2479d1634
SHA512 1c88e8808b4d601c6fb479cd1ce14dabc8c380a0d004fe69f22f87b1d184cd8f9874dbea77bd1b36c4461fbabc17bfb8aec6a71b8cc8940b30deb4e682197218
SSDEEP 12288:w2lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:w2l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18545230828A70CD9D8574BB050738AD4A9DC6DDBFB9B20679B04341527BE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5b3702ec0097f8808f03833a953689ec298b69a7fffe94755d789825d6502458
MD5 211682527a3d1d9d840c1858baffdf5f
SHA1 bf9aef7f262f8d2094900e0ae3c69a31131674d0
SHA512 a45cb8f16dfa654f8a499e2214dd99c7ac11dc764fe3e67c763548a9669e7995783231145e740f50afccece18a962d1d68dbf6cbc5ca91b387823a03fa8ecdcc
SSDEEP 12288:n1lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:n1l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18B45230828A70CD9D8578BB050738AD4A9DC6DDBFB9B20675B00341567B97BD231E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1f4aa7db5f93a65d7a6f8c0bee5fc32a1635e9a819b2ebcd26fbd4e05a59bd1e
MD5 19e482ac2af1b3c0593ea249b2c0e330
SHA1 6df001afaafcc61cf91df849fc45ce16fa84e8d6
SHA512 be14ef5a5d034972e0c7756a8804f785b8c6c16ea85fda8ce337261e00cb1daa4e09cd02283759e76117c0d0311521a29c56e5c728c7d46d34a6f24609387f6c
SSDEEP 12288:BZlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:BZl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T16D45231828A70CD9D9534BB050738AD4A9DC6DDBFB9B20279B00341567BE77D231E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 13b0a5df3695bc5c8fe797a9bee5a129bb4181aff10cff60c56080c694a53ae8
MD5 0d2f96eeed103196346fdf98d86bffb7
SHA1 76219b3b6cbf06005f06076af6821e0b4e3829d4
SHA512 f2d6ae62c521d88b041dbbfc731bfa7ec00e967cf094f7983567467aa1ec83d796e02dfaa98b6402f14b1ccee2738909765e64397571151b5e0873e5fe23ace8
SSDEEP 24576:KZMSzFVSOBl11tmlNQ2OnBdFQtP51llPup33kT:KZMSzfv11tmlNQ2ayVup3
TLSH
T1EC65029473901CF8EC678239C8668906D6F27C5A5B70C51F03A4362B5F773A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b5d261313facd7c3d8fef89fb228630b1fe80303a08c74f491c1442a70070a1b
MD5 1fd0d19262bee844a96a11e198994ff5
SHA1 d54914b98249b11671be8297e40d014890e38189
SHA512 3e3779b0c34ed8d1ebedead9884f36c29070a3246df1a69f841cc028d7afbb69b8062a4975474c115520295fed6494745813ffdff5ee2e5e5bcd5ff309c5673d
SSDEEP 12288:dolnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:dol11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T14F45230824A70CD9D9534BB050738AD4A9DC6DDBFB9B20679B0434152BBE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4b7f295ba679f613a96f90fb2483a4a5bcd0db04b710c203edfb2edcd8973947
MD5 cc5128e3f17cacb9c6e4e074de056cf3
SHA1 32a55d0eb4d0b5592608523e72c1c94eaf711105
SHA512 b1fbb19a2d36a4f8cfb2d055801f4d42ca3c7a5251d1be18be825df72130c97dfff4749b735f18a331a2140b1f566de4f54d5cd429fa0a066ba4bd43ee1d02ab
SSDEEP 12288:bUlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:bUl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13845230828A70CD9D8534BB050B38AD4A9DC6DDBFB9B20679B04341567BD77D231E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f8292a2440ec720868fb6bc3e4cd6ebde6598869271568f3d7b2ab44bb47d69c
MD5 24887efb796fff06f3acda59ea9f9f97
SHA1 d8597412baf920d9ecfa84eff6329a90dd5dd50e
SHA512 b9e6b1e8cc13a4ef21d84c7bea7998cc144d99542ae7f9325381403d9030cfeacb76f1eb5ee1fff29e76755bd765c6f621d8bbfe982b893d3a1a899083b2f720
SSDEEP 24576:1zy9l11tmlNQ2OnBdFQtP51llPup33kT:1S11tmlNQ2ayVup3
TLSH
T10F55020732A230F9D5778234C8A20A42F7B9B8765B2559AF1710163A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b5fef37933b6401d8355d36a23db5f7710148bffcaa384ff58ca9cd0e1038f04
MD5 f2179ff0e85ec812027fb3b40c4d8947
SHA1 2851d14456ad476b379d2c0e1d85c434b04be7fe
SHA512 0689df0d688a1b7b539bd28f5bc9d74d4d2e1d5bddf4f729065e088264f5dbc469b0347d73e369fa2d27c74b27ae8459913ed104d78c75da106c766d3ce36586
SSDEEP 12288:0olnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:0ol11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1AA45230824A70CD9D8534BB050738AD4A9DC6DDBFB9B20679B0434156BBE7BD131E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 17690ed303daf5b89e4a520a3214076a061e65afda65e77fe70ef26ce5f78d9c
MD5 28eb165a6530b83672218ec2671c1cbe
SHA1 95afaf6c84c8e0a8bf3b16f59ccabe20e7dc5307
SHA512 034b65d944133592e27c656333f93c8418bc9ae0789eed04f7dfedd5138c027917d7da127b44944b393e577aab73cda52af692c97db7ebc03e1617edecd5b947
SSDEEP 12288:colnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:col11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1DF45230824A70CD9D8534BB050638AD4A9DC7DDBFB9B20679B0434156BBE7BD131E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 973ce2fa0dbc288ad5c13a6538f01a9882eaf895fe883b633e86c9ea2cf02f01
MD5 3fd9489414863081a1d5c596225d25b6
SHA1 711d78928c8dd2dbd07627b5cb4ab1f1eedc6863
SHA512 b2236582ef94c88988ef425f1a4a7fd63867ae64af4ad4c898af18afc98c4e1f443dbddda2ad79ac0d191e2c90a5b2eb980e6b9aacda2ee45f94bbf5efd74dce
SSDEEP 24576:ozy9l11tmlNQ2OnBdFQtP51llPup33kT:oS11tmlNQ2ayVup3
TLSH
T12E55020732A230F9D5778234C8A20A42F7B9B8765B2559AF1710163A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 5af9e560bbee83dd6cb87ce24385a220c1b084eeb66f7cbf9b01a080de478c7a
MD5 23e08091f8b197b0f22dfdddb735a9e9
SHA1 f22253c83dd38577061b3c45faeccf631eb8b793
SHA512 8d3a3d6b5455000001b2d2c6acd0fb911ce602bf84d2e931a3f95b26b40ec53b7673da6e32a2bb9dcd97b61a2223fa1ec52c741e50958b085ea084550bdaf179
SSDEEP 24576:9THaLl3z0zDzl11tmlNQ2OnBdFQtP51llPup33kT:9T6LljK11tmlNQ2ayVup3
TLSH
T10265029473901CF8EC67823AC8668916D6F27C5A5770C51F03A4362B5F373A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ba97a36fbdd25fad6a81f7bb7adfb38b86200d98216529c5a6683ef1015388fd
MD5 a459fd0055685e1ffa93948910fc1134
SHA1 c20c62ea96c89a3b702b34cc74bff989ec0667f8
SHA512 19c748d4f1b9235660295b1fcbda37b603e0aa11633c5797305ede918a70c1bf66756afa54e9b535a069802e8407d3c1a9ca17bf6f646fb449ed299c635d7e1c
SSDEEP 24576:K37d9CHKy7GZnl11tmlNQ2OnBdFQtP51llPup33kT:s7d9CHKyav11tmlNQ2ayVup3
TLSH
T10B75CF90B3E414E8F0B78A35C9764511DAB67C9A5B71DE8F03A4251A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3030b1e56e38b5ed49febe6c35eb8bba386f7f0b956b30dcb49da7d8a08811a3
MD5 29a71731a28cbabbda1b7d00775dacbb
SHA1 14b861c8a3303d71c604ffe7f4316f6905517423
SHA512 3c9945839de3e2dc2b9d66fd88ec6ce209fef92e76b7b811367382c5d08f4b600417bd88b1704cee84c4b4bc731b7bdeb1e962e44e9e24aaaa201d6ab025a41f
SSDEEP 12288:iDlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:iDl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1E145230818AB0CD9D8574BB050738AD4A9DC6DDBFB9B20679B00341567BE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 105c12c3a78e09537e1c1036d45d95e7a24cae694745124b2e29b446308b546a
MD5 4af30608fd4493b7c3e337c5d19d5337
SHA1 eeefc002de1a64077439342e57e55a6e26710fc4
SHA512 1204a68870dc51d3fdbc53819a187db7bf58a5c30499c1de11436e106f3ba0700c9464c228ec1675a4f5c07b677bfe09962bc9e9bde94c53c7922d94efecf140
SSDEEP 12288:YdlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Ydl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T11045231818A70CE9D8574BB060B38AD4A9DC7D9BFB9B20679B00341527BD77D131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c5c6aafc222a989fc3fd53f16747f1b047f26e83084d03141ac61a6ab0d1b389
MD5 ea85dffab2aa70b763abc2a6571ff0d8
SHA1 6b9c80c680753959af59b9e2db71541f69d7bedf
SHA512 871208d8ab443cee8397c8a06e5ebf4eb7d00ea1ed8769f585ca73f4782cf2548d208237bd161a12d8cd3fa4769e54cec110fd70921c824a7a599e9acb7547f3
SSDEEP 12288:galnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:gal11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1C145230824A70CD9D8574BB050638AD4A9DC7DDBFB9B20679B0034156BBE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8e59bc463857278942d9fac33b843ae6237a51ea7eec535cae558f87a249112d
MD5 a78a7afe0f5a5bd42a87dcc6744ce937
SHA1 011a2ca7126356b6aa30edc66828f5f1a8a057ac
SHA512 702b001fb8da56f7bd9f81f154252be1d2c62b61b1a14711d618c3899c08b2785be718b0b8d4dc62fa0daf2c4c77d6eaaf03bcc5e2d32b462724ce914d9ae64f
SSDEEP 12288:LolnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Lol11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T14345230824A70CD9D8534BB050738AD4A9DC6DDBFB9B20679B0434156BBE77D131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c6111e4b3ab122a142851ff7fc73248dd873629043d0b96b41f3d1e823073a2f
MD5 515da905629bd7bb1699c178146a74a3
SHA1 5fa7ff65a10ba23e766534d85c6e2d203751905a
SHA512 ebb3bdef4d27da9d68a1654952c639ce48ae4e2b6dd299cceef59e45d6e02167e4e44930d5ae043304668a3f6493fcd8006bfd97393bdd7554af0ac3bda012d2
SSDEEP 12288:mDlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:mDl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18845230828A70CD9D8534BB050738AD4A9DC6DDBFB9B20679B00341567BE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 57a98161234909e3d9d2ca6f4c3282bbb817c0d4b953aae3478facb217981222
MD5 df763efe87e3c3d9174a809d80949112
SHA1 61eb4279ffc69cc868eb7e5a31bf5cc39849f368
SHA512 5449ecff381485b8890fed902c2acaa7c9df3440447640bb724b28a0c3eaae3dee3ffe4bf15bc29ab1179db95327693237fd6ee45c8265c3c78b3f43092cdbb7
SSDEEP 12288:LglnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Lgl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13645230828A70CD9D9538BB050B38AD4A9DC7DDBF79B20679B0034156BBD77D131E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0b13f0752fbcb0fe2972bfd95db013b3d5b42b91325373586d4c74dde17d7876
MD5 6d07a3fdcdf894e85dbbea21c603cd82
SHA1 398209cf9b38268f350c4435c0a5fe2fb95ea6a2
SHA512 b0e9f235a2a667f27dfef98179cca085569e04228b04124b67c45e1e6120265580d3c25e2a7751b3cbdc12ad7b0066f68e827b9ee71c117207321da1f4edc605
SSDEEP 12288:22lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:22l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T11845230828A70CD9D8534BB050738AD4A9DC6DDBFB9B20679B04341567BE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3a778500cba2ef30a25a762de8d3bc9c1a4355e4463f683c29c977bfdc44e938
MD5 6c0a76edcc0e220f1cf493d4239a5a2d
SHA1 3fc9846b7ff3765d0b5b8cca0229eb679fee9630
SHA512 802128920f48c794c91ed1ab51c051c752c64308508ee8858e82f58ac43279659e2e8593ba3e6e0dfadbcf84316cf2a4f0b2b83e80889f879705eb261a897419
SSDEEP 12288:ELlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:ELl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1B845231828A70CD9D9534BB050B38AE4A9DC7DDBF79B20679B00340567BD77D131E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 82e32cd80a99ed4c7378a431f4e52af4926655699ed1e280176cea636b274667
MD5 bc3cda97596c61b286518d51c39bba47
SHA1 201688b0fe78a60c37ba489308c0e586b76bfb7b
SHA512 2ee209b371154a4d7ac0d464a6a539747fcf2f55bb27ab291a50a641553fc8f3f5db5274bae58f021ed38bee06ddfcefdf52e79c1b45c153d24100508dc3580f
SSDEEP 24576:Kfwvok9RX6wkyAIEl11tmlNQ2OnBdFQtP51llPup33kT:WMnYIo11tmlNQ2ayVup3
TLSH
T10385D029EBDC08E5E1B7923C99B3460AF6B178591B31C2CF025A536D0E37ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 549105b0883f82a8e3656f375f460767d543edf7fa391995bb4bc07df3dc02ec
MD5 0d7dde3ba099ab68db25a97cee024c4e
SHA1 3864edc96b422c7ef32aa4dd293ab4eeab25d68e
SHA512 e8c0a3aa665ebf042273c5ea19a3e29bfcb9256a98e43d15b9b707eaea54e9b54ccc941bbcf3bf758e086144022e3c0c9d0fc884e3fdb7ce4e67438cc3f42227
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0911tmlNQ2ayVS:fySzPl11wlNQ1ya
TLSH
T150067C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 609bcc5672ef9ff11addb31ecbe6485cff1e4770af08fd7019681238ae4fce16
MD5 825fea3664695b45429820d25c72608c
SHA1 b5e366114bf630d38c828d3e2e6093f00c1dfc1b
SHA512 1811ed46f06eb93e7fba6ae5d04742505e832562e4939911e9a53b42b7d6b603311703429830a291866b46c54d19f592c4b3df49defb2cb01e7581c1ac0087b1
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYxl11tmlNQ2OnBdFQtP51llPup33kT:B47JUQj1irIhCnDHUPfF/N11tmlNQ2aJ
TLSH
T1BC65AE1DA3EC01E5E1BA827885154A5AEA71782E5F32CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e193b63f7ef6a7d6f9a4ab22246f9ea68d61602be30256e44d6e400e47884779
MD5 436e8651353762967a1e0f17e106d842
SHA1 e72d714aef9f25fe74722bdd226062abb631bd41
SHA512 28af75684e31a573cff1817977789d02f46edb48b364e8f8039e11499284a41de5b31242f79b29e6ead4799484f231b5d63dfedac4b8f761ab4ca5b0d785473d
SSDEEP 12288:ONsf4lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:34l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T11B550108D29801E8C46F5270C7624A80F37B7C6697E292CB57C0F53E1F7A6A45EEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c06395d18d8bb0b7a5ca3f14b5ae69e1a1f81b152da0d94a2c35c1a84d266333
MD5 40d56149c72b3a44c9326b0acc4e6e16
SHA1 0ee06610cf137db6cb1f752c6acf0ee1352fb345
SHA512 362a9e9cbd93ba62c5fa4bb558ac92cd5037820ce15b70ef97513156f28e8e57dc46c6888176c15ad59b6e2794c1099e918343e3ba146ada9a0db347cc0ab1d8
SSDEEP 12288:FPRx3iV96PCWxrn22vc6nf/0HDoflflaRq7e3Ce1:Z7ik22E6HTfplaRqK3CI
TLSH
T1423516107666C74FC6AD40725E33D5CCAB707D42EE05AB0372C88B2FD576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 14543735e710da48a84aaef8ea589254f7f463893bac28274cc8ffa29fccf13d
MD5 8a3a5219afe505a0925acbe650d67cca
SHA1 176588390595fe4c07b63c8691c1e335daecb45e
SHA512 6c19b8ca3ac09ae79ccbd196e049157635edb49d533455a953f52bbedca458d7e6f0f77343bfb23cdf496041d7d70d409b41471c64dbfda476bea317cb33bcf2
SSDEEP 12288:A1h84irx831hU9RPCWxrpPN6D0JJuMloSJtLT6bE0dG/qvf2TbejGikPj2id8jGG:AOPwvDEhvaUg
TLSH
T1F165C6409537A3CFD6B760B2072A5F4DA764EC03B649AF267388453DD86AB15A0FC3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9404c02bea846f07177bae9803013ec7513e24da79e6b9f4fa1a10cc9c20da42
MD5 ed1d72296ea6fdccbd8ed64236c7331c
SHA1 c1a96d8502ade2a7f19e224d3dcd2abd3d4e6198
SHA512 dd6173f41cd4807c0b46d8afe6eadfc56309bf65165a0ffa36c7bbe84c87ed522494f4c07a76fedf61538295333455d8ec963737010052f72d2dd4fe8ea087d4
SSDEEP 12288:4M7wlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Zwl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T15045231415AA0CD9ECB74BB05077CA60759C7DAAFF4A10E7A70031092679BE81B7E39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 37303b0f0c39714ee9bf6bfe22dae7412d61462c0013e7266fe489f99147c154
MD5 e05767386870194f107a7d354683ee37
SHA1 f022ba0f2770b48778fa03e53579ac669e95a609
SHA512 5bde7f75e66e7a3724423bc76841385ad923afa19d327adb15d3a70e541b3092d66ca50301e720b6d532b161bfe174d4e4a475bd10b69dd3cbea8e8aa0dcc7c1
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYil11tmlNQ2OnBdFQtP51llPup33kT:kgb4mBIBhGFr11tmlNQ2ayVup3
TLSH
T17165AE1E22EC02F5E0F6D2B8DDA64417D6B278161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f42b8b7e842e51915f6aa3304a259d363c1ab7e5acf71d71bd4d85a48a702804
MD5 754e418455ada1f4c9d08c679ef0facd
SHA1 fcae2f32e9f8f49aec94954e19f9ab8fb5f654e4
SHA512 d12a34dcc1ed4591edd5a2e41b5e84f43a24ed864e401082d875d6d2a17ca1ab322357457f2ffc51d27a434276a0c3182a35b23d0f0ea94c0d4ff716362ce122
SSDEEP 24576:vG88u8FpJqH1bzria7/mBl11tmlNQ2OnBdFQtP51llPup33kT:e7ZFPqVea7/C11tmlNQ2ayVup3
TLSH
T17485F12576E101F0D47BD138899246A3F6B1B8251364EBDF07A88B551F23BE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 486421567063ad7875c9061f9a9fd7f5932adab014bf5634844c18c3b88a9bd1
MD5 f78ad72414e3d15c0dcb54fba367c31b
SHA1 f6324cbe3726b92bf996bb956c48801e722a34c9
SHA512 63168d150114dfff6120f7f5d3738322510c5b164586e61169162920430526d5d50a0249dcd9bd29217e60a594c42028fd5c7751378fb9a71f7d9bbb4d1115f5
SSDEEP 24576:/PUr+NQll11tmlNQ2OnBdFQtP51llPup33kT:/JQv11tmlNQ2ayVup3
TLSH
T18765E12E22ED1CE5E676E17C85828719F771B862171291CF0290813E5F67EE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 35140373fbfe714a3701651f609111ca9e659c8641f279137fc8fa239c475f70
MD5 34c4bea8a1aa49dbd2cd1449f540fbec
SHA1 5a5438fd1197787e388acc26bf10218466759c6c
SHA512 769a0b7d45e0d7e68b60c1f5ebd36855dd6bb6060c4082de3d7d180c49d4a31740c80a215f167c7d9dab613a1f0a6884f90ddf26f24b1d4f277f67392111e2d7
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjf11tmlNQ2ayVup3:0G05lO43bA11wlNQ1ya
TLSH
T159D5BF6E62EC11F9D1BBC17CD9C64A0BEBB23815033556CB02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7921671161aa96ca4d8c5f1e76c54505b0407a90f2f9d97793784686043823e0
MD5 d9b8b00869137a9fcacd9e9f08d1af25
SHA1 18a1cfd7ed58e336d1df21574d24b17d2072253b
SHA512 1bd823c2cca43baac24279b8bb80369673099bbbcc2bef2fca51d06e4ce0740ed62c12f5fe78ee45cdf4e57f869369c9797e8035ab87b3817a7423509a40b90a
SSDEEP 24576:Pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/l11tmlNQ2OnBdFQtP51llPup33Y:3a5POZ3+Jt2pasx2+mn11tmlNQ2ayVul
TLSH
T1B365BF5DA6FC01D5D5B9D17CC583861AF5B1342653329ACB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6c40d09af8ec2e9dfc8768d65e71d01a4c8c44c7ad99fdcd05e0745bfe67cfd7
MD5 0160ee6d3927ed0fda462c6be452785f
SHA1 4a0ef2f615a834e81f95e354d823e03b90d2eecb
SHA512 edddc270edeea9a2625b66234310b28ab7a75f1ee47463750e0b25ca27bbba129681866a2e73278bf8232acc18bf4c31c135c52840f4ca8793ca493b26e94869
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fkpl11tmlNQ2OnBdFQtP51llPup33kT:hNc/zEOVHFi11tmlNQ2ayVup3
TLSH
T1CC858B1622E901E4F5BBE1BE89779546FAB17869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fc7da946009200cb484f2eb043cc674b7f4a2728e1dd959872cd6c73992d3ca2
MD5 4b52dbfde339e7f97f3f9561fe55ee65
SHA1 e9171e4986971a5fcd64d8c5331aef6e00c7831c
SHA512 76c7e461709125b7590a471d3d612132b3999e44f3fdb3de305264555ec1a12921bc5b8572a70d1d9f935443dba58854d04aab532fb3b8946fd7dcc274867776
SSDEEP 24576:k8kNvNnaFeYhJNtmZBmLl11tmlNQ2OnBdFQtP51llPup33kT:k8MwBtOmJ11tmlNQ2ayVup3
TLSH
T1E755AF2E7AF806E4D1FAC6B4CD238512EA727461173252CB5390C13F1E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4036df639649e3e6bcca9668906c3242fb331c0f5a8b9390845b0bed2c5712a6
MD5 f9a55f4b911b9571e706df5a56db6508
SHA1 9aa4b2d2892af0510c11dde237767e3dd409647b
SHA512 531afa75aaca3510d5000d126be1fefef81df008f389031e21fa11cc9ada2a3df524552694463548be8113e730476de5f7a1535d4b0b8e2102c6def09962d9a6
SSDEEP 24576:RD3FHshBIYQgAMl11tmlNQ2OnBdFQtP51llPup33kT:RDVHeBIAAQ11tmlNQ2ayVup3
TLSH
T11575E13DE69D04E4D57BC2BCD6638A06E7B138A9032265DB0294817A1F6BEE43D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-279-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1084-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1084-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1084-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1292-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1292-101-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1292-107-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1292-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1292-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1292-314-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1636-453-0x00000238041A0000-0x00000238041C0000-memory.dmp

Download

memory/1636-416-0x0000023801D50000-0x0000023801E50000-memory.dmp

Download

memory/1636-407-0x00000238001E0000-0x00000238002E0000-memory.dmp

Download

memory/1636-439-0x0000023801B90000-0x0000023801BB0000-memory.dmp

Download

memory/1636-414-0x0000023801930000-0x0000023801950000-memory.dmp

Download

memory/1904-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1904-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1904-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1904-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1904-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2028-310-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2028-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2028-84-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2028-79-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2032-95-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2032-380-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2032-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2032-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2032-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2032-89-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2172-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2172-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2172-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2172-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2172-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2644-22-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2644-21-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2644-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2644-15-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2644-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3204-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3204-77-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/3204-318-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3204-321-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/3204-1-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3204-8-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/4360-575-0x000000000ABD0000-0x000000000AE2F000-memory.dmp

Download

memory/4380-40-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4380-46-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4380-50-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4380-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4380-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5004-121-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5004-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5004-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5004-115-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5260-295-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5260-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5260-73-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5260-67-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5696-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5696-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5696-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5696-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download