68fae44556cf4238f106ab37770ef9fcb4e353c02bf22ca163ffe35bf43ea32c

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
Size 1.3MB
Sample260728-tnvb6acl7v
SHA256 68fae44556cf4238f106ab37770ef9fcb4e353c02bf22ca163ffe35bf43ea32c
MD5 2030313df69d27239523cdafd3a27201
SHA1 c3346f468eccc333ba8d493cfa1a2bcc072b7062
SHA512 e38209e31e6e003dfc3e20d6efb721dbf381c418a04948200920b5c6e706e7133c77031dba2b9f261ef5e7ea0256898daa15f86a03a308fa0ac720a1d51f4b51
SSDEEP 12288:yVWJwPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YWtNyBo4kx929bL3Hnx
TLSH
T1DA55020673A821F9E17B9234C9514605EB32BC160B609BEF47B047B76F7B6D18E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5148	elevation_service.exe
4112	elevation_service.exe
252	maintenanceservice.exe
708	OSE.EXE
5652	PerceptionSimulationService.exe
4856	perfhost.exe
4576	ReFsDedupSvc.exe
5920	SensorDataService.exe
2544	ssh-agent.exe
4368	AgentService.exe
5832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\db429b9a8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000892f7df7ab1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000402a2539ac1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dae31df8ab1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e79a59f6ab1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d928b3f7ab1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000539e0a39ac1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000426b1af6ab1edd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
5148	elevation_service.exe
5148	elevation_service.exe
5148	elevation_service.exe
5148	elevation_service.exe
5148	elevation_service.exe
5148	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	4576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4576	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4368	AgentService.exe
Token: 33	5832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5832	SearchIndexer.exe
Token: SeDebugPrivilege	4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4848	2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5148	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 1984	5832	SearchIndexer.exe	100
PID 5832 wrote to memory of 3336	5832	SearchIndexer.exe	101
PID 5832 wrote to memory of 988	5832	SearchIndexer.exe	102
PID 5832 wrote to memory of 3536	5832	SearchIndexer.exe	103
PID 5832 wrote to memory of 5304	5832	SearchIndexer.exe	105
PID 5832 wrote to memory of 6020	5832	SearchIndexer.exe	106
PID 5832 wrote to memory of 2180	5832	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_2030313df69d27239523cdafd3a27201_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5920

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d7ac4748a8c7ef7998a4d7b15f4cc714a64a0cd92a03125652e3458836113f4c
MD5 13407b1b5739fabc8d08f8a915b4cbda
SHA1 54e5932cb8d8c566725969d420135a1944588b61
SHA512 7c0ba68e2755b1819bd625e9de2a148ffb274814c60248339a4b489578d829a86db8e363353c33423bf48ccf2206d64e798703a184f1d06d1738eecec1bc0f45
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnNB+kn3Hnx:63q6sjB4+k
TLSH
T144D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 446145458def821fdcccecf39877ff3f952917221c61ef39c519453f64ab57b4
MD5 f74bc8e139d02490ae2d94972e0798bc
SHA1 553987248cf2f31a858edfe3869b1ec2ef482185
SHA512 7353f7f91d9752e55e90c7a69a38e1f166c338b78d812ec98ef7706a3b1cdb0e2d7f8363113ce4fa9510927eecd261f95508d2f9d0fd0aa1f138f031da2f55ab
SSDEEP 12288:r1XLsswWkxy2lRq2czAoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:RXYfDtczA3NyBo4kx929bL3Hnx
TLSH
T1B865012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b941298e848e84cb62b86e8af4742cb36e6891b456d8207b53e82d04040a3cfe
MD5 0ef537d22e4da8e03ee951b2aa8b8c9c
SHA1 e3a49833ff3df65545fd8cb3e7e74fbc2c85bbce
SHA512 271456ee823c2c317796b7dc617fefab04a37692c99dfea0c7da3cab9cab268bc4b028dcfb86839674e1b0dcb62fa0c126116c1be093843cb72974bb03f4d3c1
SSDEEP 12288:5XZNYVLeyUji0h90ZD0wxpGZIVuArHsRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:P0Le5ji0hmxfrMuNyBo4kx929bL3Hnx
TLSH
T154859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 82e7ef195649e61e958a884f087a3268870603a54666cc65490e0267ab1427f6
MD5 03eb72f4c1414d3fec0f96029ca4d395
SHA1 adf66f1c921520701370ae6a4169fe24484d45d7
SHA512 34e6b19d6495473fa0874908342a093fac23db85fc9a0164df8fde4a5aa6b26901723a6264060a0d2568b9b1260bf9aae17241724b9c3e4f4e8e0a7e680a2270
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyu8NyBo4kx929bL3Hnx:z/ezSC6vUzPveHjyyB+kn3Hnx
TLSH
T170755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 42a75b8b8e933f4cb97336c1c0db0fe3e3ba41cfa300f18edb6d5daabb07d94d
MD5 a52e94fed1796e541d1924b0e1b27b3d
SHA1 1ae538d6bb620e519aac6d1cb07796f72677bdf7
SHA512 2ee596ed57bb2e9fb535079388235d5b8cdede8cbb46193086c6ba60c341dd2a0ac90833f4879091a839f7814d89c61f8bba19056a1a41ac094c408c3d5465c6
SSDEEP 12288:GVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98ELDAptNyvUgXZ32dT4ePc7N29CD:GVbqPb88hv/l+YbNyBo4kx929bL3Hnx
TLSH
T1DC559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d604cd35cb2212e839f53b3bcf66aff7db1162d8abce71a439cfa58405d5537f
MD5 600126991ec6ee2cc460fc289551036c
SHA1 becbfdfea600ff8e10ac0f98635ff5f9979d6776
SHA512 86332c3f06aa47269c5a472dd4e88cfa66ad201ed4a36ec9a0b1a0e06bf2fd599f8f5f8ccc126e562fdfda34080507904a277a01f1524f91c9f24ec4ee1e9c1a
SSDEEP 12288:DmtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DmyNyBo4kx929bL3Hnx
TLSH
T1BA4523124B0C627AFBBD3E70755E8458CC35BC8D0D95DB94DE62ACBB58BCD92DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 760ae6bc3c50031a00902443b653a9d883acbd91f60cca7e152a39161b7467fc
MD5 e205cf5a1f66ce30cd9a27f46ee53a33
SHA1 995fd76f5b414b5b796f5ee1aa1842bb55cca55b
SHA512 dbbb72b2b7fc2bdb388b4c38977c1a7837bcdefccf252267bb45322c48a07caffd07fc2eb023bb615cfda6d07a2bbb36f63847dce8834b738845990c4900f8d0
SSDEEP 12288:peBNUbTVO86U8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pJIUjNyBo4kx929bL3Hnx
TLSH
T12465CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 64598553dbb7113c843ba98e89d951fe97014cee05ec792b40cfa223f90a8fa9
MD5 af884d2da3f29479ef85f186a38ca51b
SHA1 fa99e70ab5170eb3cd39b76b5f2b95e858434e8c
SHA512 226d5f9f2f8d1cdc3f50b5b36450dd6bd1de103b9f35dcfffa3e64996d2f8396b694013a97ca6ad7f15806f1a4783a5d6fe2f06c0357fac39be128abe6dc2f9f
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH+:EQvGAdlCEL8c/DRNw5CR+k
TLSH
T190266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e6df3ad6382d129928fc1a2530bc48ab56eb3787fbf9b612a4ff657562704206
MD5 167a50758859e513dc1445cbed248840
SHA1 4052515417e153e98a50432ee0f852429ddf4bbf
SHA512 8abe3228e8b4abae811325310773eb070d043074899753535aaf755aa02f2b32c0c18b641e418b3d0464b498656f59b1d032597159411a4eb191c61cc961606f
SSDEEP 12288:nAwSfxL/2Dc3XDLLmt0LDQewsAjCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:AOewsAjJNyBo4kx929bL3Hnx
TLSH
T14D75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0f8b56f669f3c6a3bbfb2d6605ae6cbfd85ef1c1c376ede41eb6da96d6f57fcf
MD5 2f3d4ee3e436a62958de1f363b203975
SHA1 93654d6769010ec2d8dce6d6e9d159f132ee1cee
SHA512 bcb30c4e85534cabbb651c14c22e4b49c1de2953cb1c08645ac14b53e657be415f739ef608fd60f62ca17626773ff5115f7ec87864e617d4ccb927fe592b2d1b
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHG+k:TUEtQevvqc2W1cpV2tI32G
TLSH
T1FE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dc0613f689d683e6fc4e2895469c8a1180e34bfb2b4271cb4452ac89758db2da
MD5 590cf6e8d90d836cb7897dc29d83bf3f
SHA1 dacf1e37b661564d4d619f3ea984fef4a7a348da
SHA512 4360d7820f231ce6ad09ac696d6a1c22cc09fbe2e78d1c4520f3d7b9cd8570a1178dd07f17c9ed93c9ffa28866c083aae575a659f5edcae64920b517ef6148c0
SSDEEP 49152:hCbRquA/m2yL5zTfFiV+XenmE3/zOB+kn3Hnx:OoquVjnmN+k
TLSH
T1FAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 066f8e5ba74231fdd64d08fd899eb8d7316b4915c3412994dc8c14170debfc7a
MD5 17b048127f08a40bba5b4e035708c56f
SHA1 517bcc7617496bf93ee2760ccd84775e5384e843
SHA512 21a93666d579b076fb9a5871afd469402f313c690c8ea6ae81e75a13ddce14357415bd5e8a2f4d1822e5b6b59540373b429505fd267d6458e1a9ac2bd8674bff
SSDEEP 24576:nAhGL3IFoiwtA5l7S53YNyBo4kx929bL3Hnx:nAMUFoiq5rB+kn3Hnx
TLSH
T19035AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8663433b667bb517c1bb1e7168b0e184393e1da4837ea264b3880cc12d6bd3b9
MD5 8af480ea7daf5afec4cc4f013155b571
SHA1 3f90888b032e6a33d5d959fec29f7ca3befdb2a7
SHA512 7cc4bc1390136cfa2eaf35a20f080fc26f4ee8e84019da31f873b69c7095f1ed3707a0a3e393dfbf7208175d222ff02f7a3fe55aa224421755a195d11abedc9a
SSDEEP 12288:Fmw5HEjsChNzBFgl0WDm+CnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:gwu6OWFNyBo4kx929bL3Hnx
TLSH
T1EA65F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 560c97eb2eb74f69a809bdd815eafe23102308d8ba03cba7741e4699551f89e1
MD5 3006bca21236a41dd70fe6a5849b58ee
SHA1 7324ec445760e75d8537a90eeb078500a6d4dd49
SHA512 457d16e13c1eb9ba79fadc37a62ff3936cef9a6473a424747c161e66ba2734667f36a97b11e9d540a2ab2597cd3ede648133b157732a5fe3280ecfc9d9e55089
SSDEEP 12288:+gZ1IyyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VZu2NyBo4kx929bL3Hnx
TLSH
T1E2551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2145BA1F7BED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 04f2dff3c40bc329939ddb58fd370e72b7bc9066f5637b84876d1cb3f9e766a5
MD5 3a1992a79353509ca58c20dba6b9033c
SHA1 d6cf1af5a2c4e52dfd5dbb7bb1784f6d627b839c
SHA512 66220fed305cfdf0b2cc2fc54a86fd2ded8c51c199c6ac68c4e7fd381560f0292218b4b279fa0feef4f0bca703a60232ec5a6eae52ba0604b0c5080ef47bf9fc
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:OQRQyi36YOcPbLvw2gAf+PN3M+k
TLSH
T13E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4f9c614b40e08c76d392c52eae34e18619adac4d5d912920ba576063e68b56ec
MD5 8f142e9ecb8cfdafa7d8f1e47dbf73f4
SHA1 36484c1e7449b97721018c39d46a115ced108d83
SHA512 3e80eac1c99aeb6bff1689c20f9dd37697f948823d0840d176d2a270088f814a39e5b64eb7abf519b8b6ad5160f945d34eef8b082ca061cfcd123db1c7ad0322
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:+QRQyi36YOcPbLvw2gAf+PN3M+k
TLSH
T157666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a957a9e9afc9cbc9bd625c353f459de11bdd0aa0d3fac5d5fd66d95a0742ace
MD5 34b2cfda5ad681689f306dcdbe1d0cbb
SHA1 72a112a165bb47ad288096a93961522d78eebe95
SHA512 6afe983d3da755a9ad0aba4492cf73ad832dc88ea9b14e33fb6788321f43ae89097d4d6400a9649442bc055594e9751c7dd08b935dde151faf801755a17bb58c
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0mNyBo4kx929bL3R:e68Qg55nhceWu7PNU3/+B+kn3Hnx
TLSH
T1E1B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a4121ebd8a3b380449f90136a53c46fb794c69cd6de25251f83bee9d7f17a386
MD5 aa358a80ed156de6640b55b93c31538c
SHA1 aae5934b59b6413df9dd626a577bc6d0eedbc7d4
SHA512 9c1d2fccd41c83a6c06825ab286137c1d1982080de496c7bce1375893c79a3a4d44e84d708eaae036078675a586e535bb228da939d73fb41938d90086d01d83a
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99w:5y5112gYy5azzVvt69nLKnhZX+k
TLSH
T160167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0ea2a9021fd767e873a22f2a6f92b7f36efbd32a2cfbf9753b1172ddf8013a49
MD5 e471123407bd481e3a3cbaad35bf6035
SHA1 3e8972cf5858b8227bed42e6cac03eca5674a99b
SHA512 bb7bdfe247edbe87970f31ee1a30e972d33c90938b82c45d88b8f926406f156509723966de0c59b9e2b9683742c368a770b3a1d4747d15cdb889f9f26268b070
SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glIB+kn3Hnx:Ku6Jmdxd2dU+k
TLSH
T1F2D59D13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6e01dd1eb10b6ba5629539aa6ea9917c7f977f17ec81143f86cf8212cf530ef1
MD5 dd265ae0e63083c1ec2b179adc6b6765
SHA1 8a49126f404ef5888bb1f421f9bd792a4d22861c
SHA512 9476fa3bc1f16d39278a77f4f71134bd92e2b54c3114dd23bbafbcfc618a710fcb8ea4a253187fd0cae126457d618b0d8af6c9385e81bff64ddfd815ece3a6e8
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4xMB+kn3Hnx:HmifPWRN+k
TLSH
T124B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e96fb3917cc69b079836388f49f1bd724fa4fca2a7889001fafc08d17739fecb
MD5 7e7a30ffbd72d6cebff8317a8167de4f
SHA1 172c71b17d1bc34d0c2638afbbf69e5a93422c6e
SHA512 a49e1109787b3a99d9eb00d1b655667217563c31b6749b3419f73490c65972ce0b48ba5c4dda159434ea9b24775b517aa382a7e33a09ef08356918f18dd746dd
SSDEEP 49152:HSuZQIY0Be2KcRVtOnks6NMHq9B+kn3Hnx:d5dKii617+k
TLSH
T1D6C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 709244109dc1d4e4dc32f304f44b3d067aa7d91b87a1c1ed8b73c054ad62d0d1
MD5 7a78de30eb052c7b60023d3668fd07b6
SHA1 5aae1bf5fa65e97f5874afa5458da5734f7e88a9
SHA512 15d4ab68418aada4c46a061ec572322cc3ace7e3e64e6c61c1687e29d70fa1cf5c61c2b7206268441a1bb002c0d10966aaf840ac08a74af0e6cbafd63d86509a
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5w4B+kn3Hnx:8X2imphJ+k
TLSH
T11C95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 86d91fbdad9c6d19136e571e4fdab1c6bcf8a6fae9989dfa6e1051ab2fe98c1f
MD5 7927ae3cafff136df13674394fb6386b
SHA1 777d3c27a1c30503d18968bf99bf220dabd9ea9e
SHA512 ee5eee0671e9964017d721953626bf86bddd449dfaa10670937c707b497b5ae27e27ac7f36db9e2a10662eb3cc72b20572e3701d66d866827389623ab29a04a3
SSDEEP 12288:UFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UaNyBo4kx929bL3Hnx
TLSH
T18C4523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dfecdbeaea416b21518799a5f322c7a384b647b38542d4fca0ea205a94b94233
MD5 f1b25c382bec1ef44619775224f9d3f7
SHA1 767e6e7cf1cfa1f83b739486373001f979cf888f
SHA512 5bba03e25c91f971b25fe9a6d9b6e6ac4fcbff72795e7459657c8ba49b9262b173afa510ed83671112ed5e4c704e8179be7b672db61147ffb0464162f81491a5
SSDEEP 12288:yOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:y9NyBo4kx929bL3Hnx
TLSH
T1A24523125A0C627AF76D3FB0654A8098CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8899e4b05c59a7da078aa7ef09cae39e4008f5ba8de230c4a0a3923ca82fa564
MD5 433cb2db5d9791f42b0a09f5ccedd8f7
SHA1 eb93a1baa9c9163fd3173f77e4a42df11e3514af
SHA512 83d48a6e3d62473962da005ca9fd1d5e31f2aba93d105db02147eceba8f4f2cd62d380c606df805150565fea24d901c8393b6ff8ce7cd669675cabe354151b56
SSDEEP 12288:GULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GLNyBo4kx929bL3Hnx
TLSH
T1AA4523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6e03853f2b89ff68eea1a99e8f8a10335707401dadace2751eee10934e438a04
MD5 a8592f21e0d86f06bfc879fca86b9eea
SHA1 f4b97e3272bb00a6f713a95f5937c7f72690d532
SHA512 4a9d5cae6b70f04f553a9fe61a30cbc2d05e7786d969f7fd5258ab46f41533c0c8fd2fd54b6bd9552a2489dae41bf72d41f39e12e9307269696f36625dbbb078
SSDEEP 12288:PVbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:iNyBo4kx929bL3Hnx
TLSH
T1234523125B5C12FAF97A7BB098568054C835BC8A5F7297DFDF1248BB0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 47cf12400688b56bcbf70b2aec1e9a1093abfbb736b99c6997c224c53bccd8b7
MD5 c3c00324ea55996e65c483cbb0db18b1
SHA1 0921f0595be1c2f14c0dfc4141e65f0ff1d3d522
SHA512 588d56de305b2e8e16ce4c16dee13b3138af0dfd358974a83cce806fab46db750351f6a42605e8683624ce2cf39aa5a7fcc74c8ddbfef28ccdfcf234a94a8744
SSDEEP 12288:sjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:swNyBo4kx929bL3Hnx
TLSH
T1FF4523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d2ae26765461ff56f447121eac227ae853b4f653f676fc41a289f7154ab4619e
MD5 68fb21e3c8fe6e3a8097ef27fcf8f8c0
SHA1 9087d5b14c39e518ff99b832045270f1c6c49341
SHA512 2d1ea79f99d795a97e667c3582ad4e56d9ca8b7614553ae448b6b841c70ec8cdbe35b866d7422f243ce5948cafb306f54d84865684ef9f7a7e6c830bf7daa532
SSDEEP 12288:QaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QxNyBo4kx929bL3Hnx
TLSH
T1E64523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 beb12e9eb99a301a944f19625e3845170765cb6faee5ef7efae6917a184f3887
MD5 3efbf6118f07893e51cd70144e38d8fb
SHA1 161a4fbe159f5e142afa2bb8374456ae32b402b5
SHA512 74f5ff4c218b4bc5c8b59ec893bb3832d5ffdcfd68cfd67d5129995206a3cd3dcb68aef31f6c0b798a74d2de22057d44870ebccf6be464d5e3d2c6f16ae1eea7
SSDEEP 12288:NWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:N1NyBo4kx929bL3Hnx
TLSH
T1D04523129A0C237AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1abe3868e44ec9385e7e793670c83bb7a685eee57e3c0ebe0f54b4f61879b740
MD5 6caa4350831f11c61320425c37b718d8
SHA1 eb2333f5e7a2f9512beb06b3aa08cffea17c2abd
SHA512 30cc91c3a32850868ef647ba09faea672dc40d14a3cf95b12ac783ff1f02d279f78300d2c7943f1c3285bb7699441d88aa0e9108d4532af21398b5a33abbbe8f
SSDEEP 12288:9iZwbjzzFEoS2cPvyuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:AZMXzFVSOdNyBo4kx929bL3Hnx
TLSH
T11E650195B39418F8EC67823DC8158906D6B2BC4A0BA0C65F07B4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f9b97301cdcbab958840f1a25be2d44e01f5fd298a358db4aee3e27ec114c9fc
MD5 84090e8e92210b1621197fc78d234cd5
SHA1 dae93e21214d00598386da1dfaf668665b21cbaf
SHA512 b799d902f6dc627e611f04a08fd421eddb32ae6c52ccd70e455366df781242539fb62bd6a2c512bce71018de8783c10fddfd0e1ec46ce6d51839ac462457293d
SSDEEP 12288:cZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cGNyBo4kx929bL3Hnx
TLSH
T1E24523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b1002b82d47705018e8569a4d9703b259b3bdca39f598e782d3b5421438b7053
MD5 53c10b34493fd8eb5640780121e7e613
SHA1 0c91f7b99cbdfffad9227d2b5c89f95d5e3ce6e2
SHA512 947d36fa3c86d8de5957567c4ec9ac967c46cdf7a8e973ae2d92f6a1b527e33476e7c549823941fdbe7702c387f3ee6991608be1f48224ba8b03728dcefe372b
SSDEEP 12288:wdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wCNyBo4kx929bL3Hnx
TLSH
T17F4523129A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759BCEA25B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bd3e33e28f5416cbcfaf976aa22e3fa82771bdb601a38598441b64d8705187c9
MD5 7dc334b91f23d4060af35f0823db401a
SHA1 82aa9fdd207ece260da04828f1c4269a0cef86f5
SHA512 94af474af393028b33b091f10c82d2060a5bb60bd12540a6252a7c7bf9b134b07849f9aa1570adef26072ac0678da66a0584b98726896d37f497ec88237d6b60
SSDEEP 12288:nyPz5L8yLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KzyZNyBo4kx929bL3Hnx
TLSH
T1F855120777A831F9E17A6234C8960905E731BC360B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 611334fd5cfe9217220e589a059dcc5ee0bec3a52d6377d605b24d9ebe55eefc
MD5 d9ddddc3d67e2257382f70306c35b1fa
SHA1 cd5f62c48ca722ed56ce5e438ed04a9e3ef26eb7
SHA512 ad528ba45a9960e0cf9799793d1e37dcb0a703945156f80d60175f9e3c75f8d102663b0f426e281c1f524d07fbceacc0c9e0989321328d2b9328725d2752c8b6
SSDEEP 12288:QZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QGNyBo4kx929bL3Hnx
TLSH
T1B54523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 461bb0bc67e645f204dd04763fe5656455f2dfe399937f9be8c5189f2ebf43da
MD5 eb5a4039c853b1dc0dc9358cbb4b0d7e
SHA1 bd6b180c2cef8cc31327bd49b307db9fb40d519d
SHA512 b2ab747d4d9fbccdadb949b41a175ae21652ad7deb3fc3e297e1a28713aa65ef6fce34027bba6467c3e84d183b2e5180556d538daa9b2aeda587e9d9a3210c47
SSDEEP 12288:KZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KGNyBo4kx929bL3Hnx
TLSH
T1B24523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4b50da82cab65ad83f3ecf3479da6e61f9ce21be40d5b0d60670496f1cb65dae
MD5 9219e50d8442e6620ebc305dc533364b
SHA1 be38b4a3aba1140fe0583fdc3061829781e71f21
SHA512 a0ff09de3edf59a7b3195cc15595a998c0b15beeb2f846e8bda8466ba9a78edbec92d7712f1d884b717708e4d7d00cf799f2167915d9d3a770aa89d18192e0fa
SSDEEP 12288:FyPz5L8yLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MzyZNyBo4kx929bL3Hnx
TLSH
T15E55120777A831F9E17A6234C8960905E731BC360B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 4335e223e2fb5f114fe58291ea9a3841b3d4b39e5ccff9040f9fac838bc06ee0
MD5 44a3bfaa59d4bb26876d2b041c543ac8
SHA1 95dfc0feced1fbc7bea783aad824fd28ec1e3d16
SHA512 2dc016f86a10531082b7680732e5da1d8f9cf718c8a8cc0063eef8a57693d731125dbc0b43adfdba4908b1cf0b64e781b198062d844d0d713be8a23999672477
SSDEEP 12288:UCd98WYoaLHF3z0z04PDvhkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:tTtaLl3z0zD7NyBo4kx929bL3Hnx
TLSH
T13F6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 47371f07b7c0926220b2894467826a79dae2421efc64a6e332e8906da587cc72
MD5 317fd401033cf0b64d86ae66501bc5ba
SHA1 faffa791ffb6b688bfb511bf5cac585fd0c55403
SHA512 42ebd6746450e71b4a17cdc0c8958c5fb3f81008d98f9ebcca0890c0be41528e69a004346b2e2aef759b7720d405c8183d48c65335959d9f953a37a68a48621a
SSDEEP 12288:mi4e7ARdTfgwCHKy7GLbbdIvPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:m3ld9CHKy7GZ/NyBo4kx929bL3Hnx
TLSH
T1A575CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 083ae22b4a57f8201d7e7411ef130f112dc8b2db5562a486b06f705e9bb65bfc
MD5 b35987eb0484ca5e5e83a046e49bd062
SHA1 54614267cf717280821209c3c266b333835237af
SHA512 43aee6f0cc8c30beb089401f3c5be83936b735e2958c05c6ac1f28531b5d145add4539454ade0640a369e3bbad4bc2410b9c7b169e1ee2cb575a283bac578390
SSDEEP 12288:B0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BrNyBo4kx929bL3Hnx
TLSH
T1E54523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 62a3e456f83639dd29b1ae095389872eb87f3df66af8124f1c1efa868dcba6aa
MD5 8b0f6331470a84be87892b24c95081d1
SHA1 93f41af42fe29b709f35120ec8075c08a2db0e7a
SHA512 5a03d3870b5dbb1065ca6b0e01de8b4e7541731b4c84b1284a4b686bc7ac3a55db3d0a466e80e4b79d8df4ee23bc662a202fb274ff6f150fe9466f54156bbc41
SSDEEP 12288:eSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:e5NyBo4kx929bL3Hnx
TLSH
T1C04523125A0C227AF66D3FB0644A8598CC34BC8F1E9597D8EF679C7759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e84517ecb52c3824ea10cac2a41f857799f588b74608dc4b6e528bcadf3f749f
MD5 1b10f9d54cc05dd1159012ab658c2e02
SHA1 5e5c6ad0ae409602a3b15e68d1bcdb0db4a099c1
SHA512 099deb52afa2053cd9cc668c78d8e29a21a00e7873b43e707e6a7ed5b9b4342be45f1a6ab340b164fd377777ad211e1b7b74d2ba688af5ba3774ccafc8c54379
SSDEEP 12288:gPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:g0NyBo4kx929bL3Hnx
TLSH
T1F44523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a34801d86d7e16651d3eaaf2ca0cf11c980edd91834938f9cf8a04ddb68385bf
MD5 e74755030ae9e893b7cbcdedcab2cc7f
SHA1 ad8e008d6e9e9067bab68d726a8d466b35159996
SHA512 acd6f69058bd22e106df27759647794046c878a018730b5c8fc2a93a80ae018dfa198b4dd8d9e8c56dc8aa76f19983ebd086bc5a2e5f4135a645c632ed351fa7
SSDEEP 12288:LZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LGNyBo4kx929bL3Hnx
TLSH
T1E94523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 51bc2a5987e1915ef7d883d7156dd3a5b9aa3a35f6ade0411f6aa52942c25744
MD5 b237f0cbc1e15dba658a5a5447f9d51b
SHA1 360faa3242b640bc2881fcdfa912f776ac3cba8f
SHA512 59e48ffcf2882296c783d6af449999279d077b03988535e8c1d577520885f127bb699d01938378d6470c8ae5bea52bb2c3dcffa433b5bff54bf09574c1e8a49d
SSDEEP 12288:60LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6rNyBo4kx929bL3Hnx
TLSH
T1344523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 74ae712ba0d2854817fe07c410c2a71aacf94795d92482d7f87706a24df20dfc
MD5 cc030d86fcaaf4fb94d842f98ee5201f
SHA1 03bb5b1d906e33e3dccc0aaf9ffa20a5e5c5685d
SHA512 21a7f7f8fcda0d4204fa41661781fc13ce5c7e4dabc52eee2079bc64ad2d6170a9bedf4be79d5ffc28b8df2e11671fd37bfebd3b4ad4cee97162d541ace0541b
SSDEEP 12288:7hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7eNyBo4kx929bL3Hnx
TLSH
T1E64523125A0C237AF76D3FB0654A8554CC34BC8F1E9697D8EF27987B59BCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2d5ed8b0c3d66ffc73c36439de432939cad9bcfcdf9c34d1305c5f0269363b94
MD5 3faa684df5268f264e383f4636e9ac89
SHA1 5c4a40af37495ae2d0987cd7128e9a1ca9078956
SHA512 768b684aa4706ac8683b398e7d6b55fba35e534e91f606b6038568cc97d5ede9f499f1dfb2c71be5940de71f87bcca5803b162ba5504decb104488c4200af2b6
SSDEEP 12288:tjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:twNyBo4kx929bL3Hnx
TLSH
T1A24523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f6f182a34eaf32a76bd7c676e6fd9ff68a9671662e4c356489b29889fdca16c5
MD5 c34316813f3a7c5911092b903b15caf3
SHA1 a4bf65c97126e73810d20e65de04bdfbe6b94b04
SHA512 11e744ab626413ad6367f399844319a8c06686a42ea19f1af462255d9ab721a1e1fc9d1d1b9aa95696f146a64e7aaaf9cd3462135dea26517fb778fe5897a62f
SSDEEP 24576:yfwvqk9RX6wkyAISNyBo4kx929bL3Hnx:sMnYIxB+kn3Hnx
TLSH
T16685DF29EBDC04E5E1B7923C99B7460AF6B178591B31C2CF029A53AE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1b18d4bed51387d0440bc99f96a32e9eb821f38bc02c960953b06447905d7fce
MD5 9ede92a3a5bcf37e7cf7fe90899b1a77
SHA1 d192ffa0a0cbf702af4fb4350b7a7a05bf350aca
SHA512 15fe51649b5b5a1bb5e440a5f172715368bcadd17e5ee5f059182c0948070690811193c7bcf0f4c95491a8e0731ab1f992cf65f701b22a2e1c1aa11b51be9146
SSDEEP 49152:yYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YB+kn3Hnx:pySzPs+k
TLSH
T1D7066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bc080507ebdddc523b68b1c1deb129401a2d20c931218799ef75c5b8fab56f4e
MD5 d32678cc7d83f915c296327a32b64751
SHA1 4d8cdc67fb346530db2f74b26ad49133704427e3
SHA512 bb8bf28c845958bf7a161755837bb527f31171c6934e460ce209ed938751eaf2b2405c7df80fc9f1d14294954835cfd247743879dec50f9b21d5a5fd5fe37858
SSDEEP 24576:N47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYtNyBo4kx929bL3Hnx:N47JUQjTirIhCnDHUPfF/IB+kn3Hnx
TLSH
T14265AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 87369217bb40ace321407fbc53ba19140a7a2953aa443aa35aad85d08a6f010b
MD5 7f15d9a4a7c959dded2a7016e5f9b592
SHA1 7e25ee577d558ebefeb266cf6570bb7f7b8f6783
SHA512 e2162b0c0b9473f6d0bfc9b997c942a2e623084cbe838f0994b742239504d6f1c8538f2d83a931e04a281904d547c0685e612a2bd66e9faed89cda821df52641
SSDEEP 12288:TpsfpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:s2NyBo4kx929bL3Hnx
TLSH
T1AC55F01AD25812E8D16E2274CB468A40F7337C5947E1D3CB96D0F87E1F7AA909EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 932KB
SHA256 af7895b04a7018c89ce0caa306b114c777902b609f57e556a9ca69a0047af92f
MD5 69ba5eeccb3b876577451ba39a829492
SHA1 36c3c562209bbdb91c93ff4928b677e880a98708
SHA512 66949e19dc48de5cb7b169c8ff45665c9a65b43be1f44aac088955e0ae4e2c7dc843f91df8cb492975d864c1b44a1924721290f7e377272a6b3c5329b1c095a7
SSDEEP 12288:F80PU3f8xt1Y7Qw9iMga068yGV29S3lPCTLRMjv:F8SUPuY7Qw9iMz0pym2s3lPaLRMj
TLSH
T1C71508117666D75FC6A940321E32D1CCA7B07D01EE45AF0373C88B3FD576A58BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 86e476d61016651ac2b7240125995bc6b928d32af5d8516d49857a05f9fe0b3f
MD5 0637dcd62dfb3d25224223efb975acf4
SHA1 89734c55f47276017facb4e058e5fba81b15cf57
SHA512 9f36af6eaeb9fb6ee1334085b7e4a49eeda7dcdc8598730ef7dec681f69eb90738cf59e5b051e8e25a7b91658dcf1604d61e935a3eabedf8611bb9734e6b2456
SSDEEP 6144:HRbTkCvnB2DA1DFSf8lXf+Gei3wN0oLA4ucYetgbVFb3LdL5sSqtMxZSqtMx3g4L:JNN1ChEN3CDMCme
TLSH
T1AC75E9416437A38FD1BA6032072A5B4CB7A4EC16B7056F27B3C8453ED86AA15A0FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 16e558662cdfe6e73d5d3a8c018a9500df101b6681d4e6d6af14e83ec3f5e506
MD5 2a66a8189dc0aefc4a9d16dfed076f23
SHA1 f0da556e0d20a1f71f127b695c40b1c660ab2688
SHA512 57a38c242f68c9ace76ef8d93977ea2b734f1070ed273373bffc32f598257947107e9d4d47f7c1fd4e88a58eb2481dc9643a5ece647093e7a4f8ec2c8976bcbb
SSDEEP 12288:+y7xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9ONyBo4kx929bL3Hnx
TLSH
T12F452312975C663AFA7D3AB0645EC024C839BC8D0F50D6D7EE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 367c9d5c8ef0a05f3a89a05c6441de606692c79d120b79f40e4cc445ec98db3f
MD5 ac34fe9d943204a83d8234d76aa10a09
SHA1 3ebdb5328078ae8a1ff97444708f3d9cbf7a3f3f
SHA512 a808659127e0321beb58691b3b73889b5fc4101ef00d6462d67cdbe129d24147ef3b29c0ca5ab59d2b431b098af6f66a9ffba3b0e3f02b18b058ed5cccaeb450
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bY8NyBo4kx929bL3Hnx:Sgb4mBIBhGFKB+kn3Hnx
TLSH
T12265AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bd71035ae3dbb30f455232b6ac58d0da03c689ab3ccc8c10c81c8c2adbd1d302
MD5 8542ff55aae06db3374fc9cd90c96b15
SHA1 617f05eb7cadc5caa1104f18fbf9eae37a3d52a7
SHA512 44f142b46cb7990c5366467ed5bf126f12e963eb3516e788b573a7a701559dcb04458d2af51335df66b23f017e52bf8b59c7adc02219e1e0473976fe500c64ca
SSDEEP 24576:tG88u8FpJqH1Jzria7/mdNyBo4kx929bL3Hnx:g7ZFPqVAa7/vB+kn3Hnx
TLSH
T1FD85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 52463c8911578a2f6395a7e546bd2d4195575a35858774c48cb8a50f2a904e81
MD5 f3a3a740096ec72dc6954bbb95c5834f
SHA1 28fdbd1d03df67653841b6e5fafbce321402aa19
SHA512 0a8a6d4729c32f745bce0bd9ecb288c69b83cfb62c1ea718ff0d584d58fe7514ef4be7d7b65fdd5931a898afbf8ec29432bf8b2605eb71e577c3e0d4af9ab997
SSDEEP 12288:hHvUrBFrEjwaQKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hPUr+NQBNyBo4kx929bL3Hnx
TLSH
T18A65F22F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f82c1f61e731de45eae5c43c51a5703077f4f0f3880cea2465f4677b65634afd
MD5 2d52549a92d647e079bc9669806ad785
SHA1 a2ac6132bd2acfdc768729462c735a0b354efd73
SHA512 f8ae328f539bbaca618961a2d6b5fa51d89e669d14f43a7c9098acef2f472b55058c4711311b7af288945aa0a513873812ddfddbb7916fe90f6801676e78ca55
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmB+kn3Hnx:UG05lO43bv+k
TLSH
T15FD5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 907992a4afb0582d783860f224e6722b635695b94aae5c70aea4a800cb17cb66
MD5 745c2ddd2605f3ccb514112ffbd5efb8
SHA1 0639da37290b7a0103da2be1f1fc479e4896888f
SHA512 366792a1ef3591ceffbe5fca809315727bd419133f72cfdb07cc9661f88b0bdc5f5386e92d6f3ef7a89e17509e891cd631b292511554ac25dc8e7e0bfe12dda1
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXNyBo4kx929bL3Hnx:Ua5POZ3BJt2pasx2+m+B+kn3Hnx
TLSH
T1B865AF5EA6FC01D5E579D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 50c4395cbc504a0cc1c548593e144a59376c8411d4f0afee16d024ba2b45081d
MD5 8b4c76c8942be59503c2a55691f88c63
SHA1 30c3635ddfa02356eb687b75ed1801f59baf9967
SHA512 676d712829ae9157ae5658ad37ab4574f76d9bc783cc8713b6296dd3cf3423ade6d99c2af922fdcb3e692325d5429606155229300aa85b2142857efd8149af71
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FklNyBo4kx929bL3Hnx:3Nc/zEOVHFPB+kn3Hnx
TLSH
T1EF858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 54e5b2b364164b46ffb67099626ecc68161999fe1cf2d8e0e9ff8de5ed1b54b4
MD5 0f07b31ab3d2d071174e309d3fa482de
SHA1 c2604ed719a4c1430aad6375189311480cdc38ab
SHA512 2cd8f98fc67e0ccb9ed60bc02e063ab863474f25d8743be1311357a2f8162ddd5e5785b95982c1649b25664f99fefd84ac34cf2c48ddab5813ddc1885725a632
SSDEEP 24576:LTkNvNnaFeYhJNtmZBmzNyBo4kx929bL3Hnx:LTMwBtOmcB+kn3Hnx
TLSH
T12955AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a237a989f6777c46313529545ad860f0745b241cc8f47d2416e32b66b3662c94
MD5 3215d29c15178cc58a80b84dbe06608b
SHA1 9a8acd94941ed050c108a07c9c9b9001a0c94e33
SHA512 af4ae8f23f394f9fee65597510928e59552b2b9ebbcdda8b468aac2419bf3db530895fa8742fe010884ba385c329888aa3d5d54848e9ed87c4f1a84f63986dc9
SSDEEP 12288:1QcMxWDXN1Dp/fshBItT1IQgAlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:5D3FHshBIYQgA6NyBo4kx929bL3Hnx
TLSH
T1F475E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-50-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/252-48-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/252-46-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/252-38-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/252-37-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/708-54-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/708-60-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/708-53-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/708-181-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2544-107-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2544-289-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2544-113-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2544-105-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4112-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4112-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4112-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4112-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4368-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4368-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4368-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4368-120-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4368-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4576-81-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4576-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4576-271-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4576-87-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4576-318-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4576-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4848-0-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4848-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4848-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4848-76-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4856-78-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4856-240-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5148-21-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5148-14-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5148-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5148-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5148-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5652-72-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5652-65-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5652-210-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5652-67-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5832-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5832-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5832-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5832-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5920-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5920-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5920-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5920-292-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5920-291-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5920-282-0x0000000140000000-0x00000001401BA000-memory.dmp

Download