8f28df34297751fa60d6745b3fd37f062415af99754de4ea81f61dc463c822eb

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
Size 1.5MB
Sample260804-fgplfa1gld
SHA256 8f28df34297751fa60d6745b3fd37f062415af99754de4ea81f61dc463c822eb
MD5 f75f7d444afc8f25abeae8b4a481f66a
SHA1 b1d8f99143f77626a6bfc5cf086095a6a56a8fec
SHA512 c75c99fcba223834744d815e713ad882e3f0e53bfbd184ad76169aa166fc53d48a441ed618acd08f9278b0be10db32e679b36dd5600c0f560d2b5991aca92e64
SSDEEP 24576:CWomb57GBiOl6a8JTth/RWZvR6wQQ92pN32:CWb5+Pl6bJTIZ5jdgpM
TLSH
T13975024673A920E9E0778239C9D14B05F772BC224B61ABEF47B44277AF272C46D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4500	elevation_service.exe
616	elevation_service.exe
4152	maintenanceservice.exe
8	OSE.EXE
1272	PerceptionSimulationService.exe
1624	perfhost.exe
204	ReFsDedupSvc.exe
1852	SensorDataService.exe
3472	ssh-agent.exe
5440	AgentService.exe
476	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\474f82a2c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a6e74ddcc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054a0ea1fcd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cff6e9dbcc23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa05cddbcc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000800a8b1fcd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b075b41fcd23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000950967decc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5440	AgentService.exe
Token: 33	476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	476	SearchIndexer.exe
Token: SeDebugPrivilege	2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2072	2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4500	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 1544	476	SearchIndexer.exe	100
PID 476 wrote to memory of 3424	476	SearchIndexer.exe	101
PID 476 wrote to memory of 4832	476	SearchIndexer.exe	102
PID 476 wrote to memory of 3160	476	SearchIndexer.exe	103
PID 476 wrote to memory of 2036	476	SearchIndexer.exe	107
PID 476 wrote to memory of 1928	476	SearchIndexer.exe	108
PID 476 wrote to memory of 5912	476	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f75f7d444afc8f25abeae8b4a481f66a_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:8

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1624

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3472

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7bb6cbb6f483017d72b43577199dbe50b76038dcba018fc2eaac34c73f13a7e1
MD5 e96690fc9b587da5e5b184efc6037d65
SHA1 9475d12aa11158b6aafef5226578d94da0c970c2
SHA512 d6041b23b2e3f6714649699401ec8f7d00ffd426e1904961b46934d331bdca21ec57f14b919271d6a8f33938ab53a506626af23f67f14335cc3578948a541e91
SSDEEP 49152:cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnAb5+Pl6bJTIZ5jdgpk:G3q6mjBHslgJTIZ5Bgp
TLSH
T18FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 f04fa2d77281c91991e811988b8a7730e0a726d5412ef3b8e95b69c961700176
MD5 786fe72a13ce40d38f728189bd2f64cc
SHA1 1f59bb41f530c014c14811f6092f1652db092b9c
SHA512 c56ffaa0e4086fac139d15259600593a8c027b0d5fc7814d5b0ebf67c64d792a254f6f7621c3d2622d9ca82defda4c6cad31d5b270a094eecfeef43906d7bca8
SSDEEP 24576:xXYfDtczA4mb57GBiOl6a8JTth/RWZvR6wQQ92pN35:UtcGb5+Pl6bJTIZ5jdgp3
TLSH
T1EC85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 84e59b8bceb403a09928147da2f630606e578adcabea0c1deca6968ca831a649
MD5 c582c14bd66dbdbd75cb785361b78e97
SHA1 3a5532842963a7bf4d4679ad53fc8fed6417ba66
SHA512 fe37044ba4f5343a438c77950864a74f34aef838fe445b1bd3da2c5e7a7aa62cc7a2e8c7f20356ce2f83e8a5fdf82d8dbef193498d9bd05063e255f013f16686
SSDEEP 24576:h0Le5ji0hmxyrMVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:hPji0AIJb5+Pl6bJTIZ5jdgpA
TLSH
T12495AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4ac31d8a385fcddddca1d4a4075855a6e4e72b04f19fb48d5e5bdecdef46be6
MD5 dac450ecbecc5a98f33c30b2df48835e
SHA1 3a83c0ed8b1d3686d6ef046c276475e9150cb4cb
SHA512 384073b8a6f3e063234ecf818e27af0013d7dc6d58c3608186206c9cff3a0542ab467223c24039fab159558fe1c0c4b921baa7d3ba2a07246ba0b9eb309ee6b0
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWj6q8wyuXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:C/ezSC6vUzPv+HjyFb5+Pl6bJTIZ5jdw
TLSH
T11E756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 60a29ed1d3d00df03f0874aa60569596d2df4cb83ac311665320cd147fc12640
MD5 3195e7f65c686d3fc288ba2cf7068781
SHA1 7196fbcc0f0f44c9a30fd1c9a92cdbeed95e1360
SHA512 0922ffb76403edf0ececbf8d37a012d90f9ac0c5a602253cf4d285800e9fa94e18686b60cc582f7a7e9891ffbbeb30e95c1f821ae0d74a2f531714762a7e7066
SSDEEP 24576:dVbqPb88hv/l+Bkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:dVO88hXl+pb5+Pl6bJTIZ5jdgpF
TLSH
T141559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 72484be7ac617e03e55395208c1e1845b1a8b649e8492ad7ef86b556484b60d4
MD5 18353e7c76aa26f1a19f6dbe197a00ec
SHA1 8f36cf5d72c1e9e09c5b4f8be4c7301ce82fcece
SHA512 3907fc4c0164cc21c614675c430632bc4cea0fff2dc634b746d12c353beb5d820bc288a6e004ef0d0989a222346e139ead4279eeee898738c959cc7d36df0ed5
SSDEEP 24576:YFxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:3b5+Pl6bJTIZ5jdgpL
TLSH
T1F06523834B6930C5E5AB1739E9CDDB00F879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8fbc206d1fedefe9a76c1ea5ca4c63a3b8b6a696baa0c23f67195e97205c354c
MD5 0f2cc26219a5d92f3e1633148b4cb7e3
SHA1 dba6464297602d3170589eddc13719cf99bba917
SHA512 8a97558f446726e821918f2ab652c1125df97af0fefd4e2fc21aedcd7bbddfb782ee17b617faf23c32956d3ebafc6e7deecd8328c4d276dc6abcddb4d0c7a0f8
SSDEEP 24576:WJIU8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:WJIULb5+Pl6bJTIZ5jdgp1
TLSH
T12D85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 348fecf9d818123cb352fb44a85b0c3f274b60566ed5d9be99a0a05d7cfcd4d0
MD5 d0e0b1895a26beb8d1102092b306939e
SHA1 cde960eeeeee175084ba83cf23bbfc67d9040b2a
SHA512 fdafa1e1054450626f9e0cacb658b6c4ec36cfe42781a827544b39d82fb2a4b1eca7ef52d54cbf7641f49b544130e21e866e724369d18859059a873c4ecf9897
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH:wQvGAdlCEL8c/WRNw5CcslgJTIZ5Bgp
TLSH
T1FD266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 eb0295f0433417315f65e9f6c04fc4877c08e94962d01c56a59f9a19b228204b
MD5 0a4daa3eeb3f235339ea73d3a76ec685
SHA1 fc34019c25cf32e4597b83b033cbf24880ec958b
SHA512 6f2dcad2d3fdbbc8f17839d9af7dc3553d1d7701c2eed223e60af5c96b2de92a252b676d76b984323dcdc25a07d3443c0a89a3a1a43161cfebc4dc789ef38b59
SSDEEP 24576:yOewsAjWmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:hljZb5+Pl6bJTIZ5jdgph
TLSH
T13F85E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5a68d96bbf58f1b1b479169b6fbcb06ae3c2fce2de85299699d4798576959588
MD5 d4c03bb8c77f5aa0e1f2eff2dc2b7688
SHA1 c84e88cb1b45ae4034e123cf09f986c4baf5aa93
SHA512 a2bb4018a98043418cab08c1674402a9bf6cc78ed64d954a64f37d362d00d8da6108c6e387fa2ee38687abecb854584a8efda6cd2f205e2825d28f346b34e9c1
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHdsT6p:GUEtQevvqc2W1cpV20I32ds
TLSH
T104474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6b9e5a2925f127c2597560fd0a5a59eb2b8e821c0d1dce0fcfbf6ab9602c06a9
MD5 254e164d146fd535232f05a2e99e1820
SHA1 3c7a3b2c6465e1d67ec422d04fa2d0e3c4ac043f
SHA512 bfc2666abdf42eed2e86ea351ae79746f20b6a56c071aef537c9efc9ab03526fb56d3c28edf74680124b7005349e56ba91bfc9c8f03ada4167acff0e919bde8d
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/z5b5+Pl6bJTIZ5jdgp+:+oqtVjnmoslgJTIZ5Bgp
TLSH
T1F6D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f431defbb4e9d8c54702ab32cea49c4655eeb0685f308fa38f1d22e92f8a6b5d
MD5 6fc2cfae08b4f4ec3c2c83c677759308
SHA1 8fb2b5d1fed47702f567f365a6b9b05d4225df0d
SHA512 65ce130e3fb8ea0f5d2a6e54b67852e370a3235491262e75b8aaee63bd99aae7f9ca9f3445d4341eb2bc98d03ea66dff6567ea35a65ac075c9b22a6bb1838d9e
SSDEEP 24576:7AhGL6IFoiwtA5l7S53Lmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:7AM5Foiq5yb5+Pl6bJTIZ5jdgpt
TLSH
T1FB359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7777756e3be99ae083061e7ad5c4b9e22d6960282eca5debf06e99b5e242e77e
MD5 bc2196d58641cbc1c3e2ff3e8e81854a
SHA1 e30ee6f4cc2915355116fb9ba9c1aed1ceb39b5b
SHA512 5c4b508cff7235a7f1500f2b7367ce73a13f5773cfb4ad6870927f2154cf713d33d3fad7764007e9134e5a5def1e87b385d5be9ea560972f89912b450a4a3fd0
SSDEEP 24576:zwuGOW6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:zwNOub5+Pl6bJTIZ5jdgpZ
TLSH
T1A475F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 bc79e2bc38b63eee4b64318ec8f4462a911282039cec0d66b3e8f029fe1b1fd9
MD5 d6448122ddbdae5f60c4534b32e9ec08
SHA1 bc4857bef8931efe4e4634e379a1a3fb4b7aa9c6
SHA512 fb79812a13a63deaee7f168b57e9d2cfa3374162aa6a42b9f4b2118f02204d54b17d61fb1d210c55ed21184cb97fa00a49dae82f69f44af7742e80510f76f72b
SSDEEP 24576:HZuNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:5b5+Pl6bJTIZ5jdgpv
TLSH
T10465128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6adc372d5d4f56fee7d83acf848c5e0aa2fc72bbc52ebfc69a7a4c739401fddb
MD5 183733566475051c69063f55c2a4535d
SHA1 9c57fcbdcf58e989204bc2754cfc935bd768e00d
SHA512 b0625b3343cf9486717d94f28cf3b58d462feceaf49f14882f73241c6b25bdc9b18bd46c77e50724dcb84875adae7248542eb53d66cd18b83dfc04373a7c9763
SSDEEP 98304:CQRQyi36YOcPDLvw2gAf+PN37slgJTIZ5Bgp:ZQyiKanX+PNLsT6p
TLSH
T158666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 15d08acfdbb820767cdb814cf0209b5c2a13e6aa2a9be6f9b65da63dd168b781
MD5 64d408d18b9e3c3fff958fb1dd132317
SHA1 2c66adc75d30cd6e26838221e4df1334c90597cf
SHA512 972f6bd6f2bb151eac61dfa51f355fa43dbed82c2e096059f017dbf69644d148d84eb567b6924c4544ece8afc4e401d7b7b9dceb5efb4f032e1fbae6ee25e617
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN37slgJTIZ5Bgp:xQyiKanX+PNLsT6p
TLSH
T1F0666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c95714c79bafcfbc9ab40d63a6b62cf402e0bf36523dfa1715256576d117590
MD5 0f15fde87e0b9edf7a57adae32334e07
SHA1 b39ae6cf9881b0c3f6b7dea33bc8c33037b2de08
SHA512 95a39ab972fa76ac12457622846da6204bb73ba35f0af9c8d8bab6149924f36a2474f7f5d1491bfc59a12dd57fe62bb98d80ff65e794d7d70530279c46479f91
SSDEEP 49152:668Qg55nhkeWu7PNU3/Jb5+Pl6bJTIZ5jdgp5:othTRc/VslgJTIZ5Bgp
TLSH
T107B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d299d1c36452d23f4897ccafd2a2f3f6935358e60fb74455bbe28d2d91310ed2
MD5 a17a7541b344297bae7128e7da64a617
SHA1 20d3421a9cdd84d0b85ee6efdb27355fb8f8ae55
SHA512 9bd8f42489d4889539c218ecc7e2545fbcee08709d3fab5cb05edd386662181f24def667898774fa3bb850b860fe35382ca754a657e1887526e4ddcb9e727919
SSDEEP 98304:Gy5112gYy5azzVvU69nLKnhZqslgJTIZ5Bgp:3LIHRWhAsT6p
TLSH
T1C2167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 161ff7118b164df59a925ad58afa2fa025e7825c2948cc484cbbf0886c74f82d
MD5 33bc315c95022abed51ca301410ef4f6
SHA1 26fcce3a07f0b77e5ecb0dc187923dc4a9ae1153
SHA512 ff5fe0f56a6d850a178139b8a2526ede63ab4b558fc933733d673b4bc9c1800ddc1172cfdf839bfed863b0d9f5dd3b5fb1f3cf62e0027790f46182081f39fdf4
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glfb5+Pl6bJTIZ5jdgp5:Hu6JmIxd2djslgJTIZ5Bgp
TLSH
T1E9D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a910bdd93b2dd5f882d3b06998ed2c1cf8511d43c5b6340d9e9fb13ae6705bc2
MD5 0d6fd74e8cea3895ad94fe4d36ebe890
SHA1 bffc161e803fac6bc556b7ec43f6f494cac13b55
SHA512 da0fdfe561d536501de112e80cd5a34c6c0c49200b0f8e92aa7ac6634338f3df23989c8acab418f51147d1d57c7d059d074e085f56c0a104559fc0f48d137d65
SSDEEP 49152:11hpsNoJpF1A67U44CwH7R4xrb5+Pl6bJTIZ5jdgpt:1mifPqRoslgJTIZ5Bgp
TLSH
T1C2B5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 13c35abbafdc7f1392972ca303fc84263395d78e3a40e9882660d4c52d2c4a02
MD5 2bcc0bf955ecf0c469832a8b5a261737
SHA1 797e09ed826727de06518ce9e5c78551c0e57a0f
SHA512 10315157baefa6f6311c66c507bd110ea31f037e983fbc8db51bb8786edbda909f75da3635a064df5d79924cea17ad6338e7f15a23dc23be701a0c2243a9a4d2
SSDEEP 49152:iSuZQIY0Be2KkRVtOnks6NMHqQb5+Pl6bJTIZ5jdgpg:85dKqi61eslgJTIZ5Bgp
TLSH
T166C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e327e84f46671a948c44a716ffac837a6a5f7a2fe7ed99d7cc92afc122b76fc3
MD5 442c9faf201b6a892ac2583062853d50
SHA1 86ee864a445d5f8d2b04e1bf29f1c6f5f458d9d1
SHA512 4cb7ec731be4914cc48510dbbbf84fde87c58afc793293ea768cc34e64803412c45b5ce09c102c65eebf48f3caa07c2519a1a4506d4cab6b3a18efb36ee9967e
SSDEEP 49152:JhtSn8EApI0figjgiDn0AP5wvb5+Pl6bJTIZ5jdgpN:4X2iWph0slgJTIZ5Bgp
TLSH
T15895BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1d105443f4bce8d0d8c81de8528fe05cd30c00bcfbebae7503517eb6e02d6833
MD5 a239ba72b54bda2baeb16ec6122cfc8d
SHA1 d55f3090fc811c53d04cc6ab6210404a33a6e63c
SHA512 c36b6e097a941b5377a0198286709c56b39ffd01b73158279aa087159e08164fd3d150be153070fa112baa67eecb34a2abcfeef068e0852a1bce687aef84a18f
SSDEEP 24576:7Jmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:Ib5+Pl6bJTIZ5jdgp1
TLSH
T1326523824A6B20CAE09B5779D9C9DB00F87DBF56DE8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 98f1e521d389aa4d54168ca5a242c15c83123401058cf4e8ad83c1d3b0937893
MD5 ddbf72180b7f80056cf2b79aa3a1ee71
SHA1 926fe06256f4a51be886ee96e8de610b2cd5aed0
SHA512 8d94e08b0b8ed70cd0deed6ca08b5298b5648e337583ae6e82fcef4f0fe08b077ed107dc4002bc6f3f47a1d9e519b18e6838ed135405abf905afaeea414e771a
SSDEEP 24576:+imb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:Wb5+Pl6bJTIZ5jdgp1
TLSH
T1436523824E6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5bc3381f6a2e73e9165f367533bf2cf3ac6133b2fdda981d30330703d7ccf3c0
MD5 3081c3b51e0fcabd73e8a08a1452a981
SHA1 767419161c49b56c2c92becbf16afcea7c887d49
SHA512 77332d9ec5d453c773e2afb1a32455afe44ed997348bb19c7815e32b0208d628974ff60f0d1004b71a78a98ca61a3751e50b687df44c5afa10d9be48db00936f
SSDEEP 24576:PUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:Lb5+Pl6bJTIZ5jdgpD
TLSH
T1B16523824E6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 29e0e274de74c707bb2b25a864281340e29fec79faa3588086b2e9ce22e66761
MD5 352fced748f199d6e1144de46378ade4
SHA1 f7d21ac0f2386581a92925de39a7c74874de6973
SHA512 aa511733e9a8d6ffce31ef81d63b0edd59387e1dd9211b88e95046fc927bdebb0579d56a5bbaa7fedfc425444d697e2ffaf34ccb4fbbe8b7cb87ff497c705f70
SSDEEP 24576:3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:2b5+Pl6bJTIZ5jdgp2
TLSH
T1C76523424B6A20C5E4A79339C9D9D700F4B9BE96DF5267FFC675082BA9313883C3174A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 dbb5c66bd76979fc7f5b91c26a37223cdc779ecadbea4a272ab1fece66caa4d0
MD5 1a13bb8d767217f2db75ea12e0d8ab3e
SHA1 49d57a435a74a4c518c5b889345c5ba2079043dc
SHA512 f9e01d3d0c06e4f566b4cbdc0fbd4b64aa59d521b3a2fc18b1e400d79dbeddbf32bf86c30ccfd1c707d985ce885b3084fe7efefe7e32489dbab1c48f931fe278
SSDEEP 24576:bTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:Gb5+Pl6bJTIZ5jdgpP
TLSH
T14F6523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C67D0427F134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 6f58e037d6773e89ea2ebb6c3e57e8b747d314dc11c5b8fa9403776a9ebf1294
MD5 56234e91be535c0f0f73af779e839834
SHA1 af61c0b501edef1324c18ac01b4a0cc47a56d5d0
SHA512 2293e6da0ca989a1e12784740da88e2aaa50fafdee03b0d759ed2b7345a6a3a33981f4160c9bdbc6b5243aa7d3aa2bcabdfed9d6bb05b64ed6699a8638cb85ec
SSDEEP 24576:1umb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:jb5+Pl6bJTIZ5jdgpP
TLSH
T1096523864E6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e9e2e367f5b3edb86b54f331876cc72cbf104df0d1f2e250fc4a72b854acca23
MD5 20e24adc7ccf5b15ec0feb7be213a6e7
SHA1 84fa651680da0b97795b87f9c1b32395ee93ed29
SHA512 7d4e565589182398db8720aa2e8f0f7f913c9ba899d675c9e8e3ecd9055e98b05bb651f433d1c484049406dd6b964ac23ca8f4393416e9ce98cd18028dd05a46
SSDEEP 24576:Lqmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:hb5+Pl6bJTIZ5jdgp2
TLSH
T1F86523868D6B20CAE09B5779D9C9DB00F879BF57DD8727B6C67D0427F134389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 33e1b0394ddc9864c1e44d6b6aa49e12333518f0216ca0575fe003fccfccf41c
MD5 62ed304587e0a059583673aeb88ce1d8
SHA1 6259451542a735cd276e4f8b5ebaeca56721c3f7
SHA512 75417a8c3f19520c3e2921d1e312f8fefb4d0353bf08761edef1373f7f26414589a037c3c66139a1bcf07e3818d343bb67510e87bcc5ab023a28cce70864124c
SSDEEP 24576:sZMazFVSOCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:sZMazfhb5+Pl6bJTIZ5jdgpc
TLSH
T113850295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5d54246900a77577158aac67af349fedab4d6c49f66b7dbda3b05c7361d5be1d
MD5 02867498fef07a706dcb8ff5b35dcdc1
SHA1 8dcae35aaa6ae921652f8e8b211cd065dfa0d423
SHA512 9d421d0060f7cb5d0729ca7e261c7cafafe78e294675154017be9c23b754a917fc548f9ba47b261baf8d4f320af032aae05a11f7c93deef12ee76f4af1278672
SSDEEP 24576:Ndmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:Kb5+Pl6bJTIZ5jdgpg
TLSH
T1F6652386496B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D082BF134389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 90c1f552e7f5bae1ad9f5320817776133bd8061bceb66585c1ac9edf623f061e
MD5 10444071b59a245f6411dd707f108e7c
SHA1 7454c6affdec568f3f4bba6e6d0639d2b280c763
SHA512 f1fd7a1b2b33faf9c9d8fb231d1fa132bf8f1428685fc5a8fc16a80180203cbba3132ff7efb6270ca491bbe13d0862ed3d006093ae76979f24ab5e2c71bfe824
SSDEEP 24576:cBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:Tb5+Pl6bJTIZ5jdgp1
TLSH
T1836523874A6B20CAE05B5779D9C9DB00F87DAF57DD8727B6C67D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 26e069f96cce9aa04ea4bf6ee9ade7bea534087b3f759a9de0739325ba1cce33
MD5 931c1b906d5ff24cfe540cb7588fe38f
SHA1 b707333ce27d31331c090d4cd45baecfecb06523
SHA512 65fbff17b5f78ae16a69269343b1dd84cbfe97b17ad1e04d450b9c39a56e48cce5d30f8632f397643a9c6ed5bca3f9b3490a86149afc7cf2d8b4bcfdc1ae1a85
SSDEEP 24576:Xzymmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:XOb5+Pl6bJTIZ5jdgpP
TLSH
T1CE75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a110078075eee2c777d460d60cb6964728ae47cdc6e7df2b6a08ce9d8d17df29
MD5 669716b1ac628c8f9a56cffa198e1d4f
SHA1 4b795332e86d1f6127504de54f0ef9c2a1e8ccd1
SHA512 96e4173989ad4a74801785be523994b1cefa43d4d653cc3b93fcc2ec2cdf602c81ac18d243bb1d130386183d470fc92e4c9dad600a1e088d2462abd678c82190
SSDEEP 24576:odmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:Xb5+Pl6bJTIZ5jdgpx
TLSH
T1AF652386496B20CAE09B5779D9C9DB00F87DAF57DD8727B6C57D082BF130389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 bb9a46e7cdc03464909f73d846843504ad8de0929b44e5ee125ae6e1c8389896
MD5 89dbdc488423514a70ae184edee4dc87
SHA1 21f86faad8ee3f3279cd6481e2cf57b633e61293
SHA512 6e62ee102d62e14ec65741701aba3b7971d5640c6c2991b86a500e98e5c07cb556bc60b5c95831bf67383c12352a0069906287d23136f5ad3ca98fe72eaa54e7
SSDEEP 24576:qdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:db5+Pl6bJTIZ5jdgpt
TLSH
T1B6652386496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f5835d07f03555c4404268d1b9fd4d90d6ce3be88540aa8f5fe3412c191503bd
MD5 4b048d0a94eeea75614ea1baf95272e4
SHA1 1f268bb13bf515481be82daf44fe2b5254160a4f
SHA512 277f63293d2a789320e4ab5ddb9fde14d52cc3836ab7aff980a4ef9d119bb660b15fb8a9b8c8518887326fd3a56e85654ee143b6d0f50d0082bf1b0b52c4731e
SSDEEP 24576:ezymmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:eOb5+Pl6bJTIZ5jdgpD
TLSH
T15075024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4cf2b97f9d48290f6c9e47194b92535aaa9949492721fda96d0a1c1e4b393fc1
MD5 0a61f33323e343d5418bab5a00a7d2d1
SHA1 b25d235f64464085e4dc305910cd704f528405cd
SHA512 a7cc934b23463ebcb08274f819f8164ebb5e820332a440bf33ef7fc7604d0f0c16bc5704f96f48761a7b63f42c2ac3260852cd4061f4911c2dde76362218dbaa
SSDEEP 24576:NT/aLl3z0zDEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:NTiLljWb5+Pl6bJTIZ5jdgpH
TLSH
T12C850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 d43a4205c39a07b5946dacc16faa7f32b225eb0789fc9ccac3ea4d1c43a87138
MD5 c535cd6578566ee940b53bb98cbeecfb
SHA1 cabd6877f044d4a5369af1f3a14c8a8fa5034297
SHA512 aacd20dc53819334553d1d5288cbe64f603a02e65461efb65af91ad00900246698650b024ce9d7072a4d3e283e616d8f2e56e908805ec71cb10792a8d0aadce4
SSDEEP 24576:63Ud9CHKy7GZwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:cUd9CHKyahb5+Pl6bJTIZ5jdgp0
TLSH
T10F95CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 ea923d92c681a1daaa314a0dba07ebddf386215dc9df9ee2ef0d777bff04f836
MD5 0c1586074d6b16698892ed7fd369adbe
SHA1 468b47cfa5b5c7747276c808774e92f7dd20af2c
SHA512 b9f796bd9325a4d1515f6077c9fe71042bc03832f3e8235442a8555f270c2e11ee617cd215682f3f0e87b8b0d60a49c9615a3413e6551b5d129544d49b07a988
SSDEEP 24576:W0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:8b5+Pl6bJTIZ5jdgpT
TLSH
T1C16523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 591ee4fd0ca618dabe56f152dfae852ac6ac16c903299cbe1638768f3ec13223
MD5 50bc398213a0d7aeec9342b42a0ed398
SHA1 d7f70219e577a4ebbb1b5284fac1cb5361071b81
SHA512 6748ec8271eaa20e62c1b86eed3a7a9e15b41d9df30ad4f9ae36baa156058bed34575e559b8ca06f2c95c5b4cd4f02614ba6e148fba5b3e91349b991608b7316
SSDEEP 24576:wGmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:kb5+Pl6bJTIZ5jdgpv
TLSH
T1FC6523864E6B20CAE09B5779D9C9DB00F879BF56DD8727B6C67D0827F134389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c75b62ca2acf66e9d004cc8106fbbff814f11a3fb6e223e4844acd873cbcf1d9
MD5 b6acb2a620a319bb01f66ba032b5f520
SHA1 7a053813a97214ef9407ef636d61edbc79c5d47c
SHA512 d5d63ebf6383fcdb3b872b515567b5de4e5da879fdac82494f52fb5fb564115ec53f2ca9d5f24b13ca60e332a9f5272b27415f33ec09566a0e2cceebb6ae1e8d
SSDEEP 24576:efmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:zb5+Pl6bJTIZ5jdgp/
TLSH
T174652382496B20CAE09B5779D9C9DB00F879BF97DD8727B6C57D082BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 0038ad9cc9695323ed3d9a7812a163e8b92d107cd601d0d642c0f345a3aba47f
MD5 686a96f2e1fb4aac1c7debce07519194
SHA1 8c78f1863c73c422180a93dbc2a5c8639c25ebc7
SHA512 7c4b6218383a3d47a399e146b560502eeeb91168f84905558cfaea6d911aa8342072db1ae977160a1bc977121daa5d00b198e7e59170e8ba331cd39d761660f1
SSDEEP 24576:tdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:qb5+Pl6bJTIZ5jdgp/
TLSH
T1F6652386896B20CAE09B5779D9C9DB00F87DAF57DD8727B6C57D082BF134389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8a1e8ea1ecaaec1d3c2ef67f63cd867d6b0728698256ec0d8217b94e01299bd2
MD5 791e64f8b71463f1248faf370ff48921
SHA1 868b259786f83bb15bb15ab5a68e2f7940f84ff9
SHA512 7e56ab86f8d69b4b955fbc611f14484871313e19c3ee7a871c3ee7c6feb6df524e58436c5804fb058f40b8a84e54fe4f14d896fe2eeb2ad68b6fad688d067d76
SSDEEP 24576:s0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:ib5+Pl6bJTIZ5jdgpA
TLSH
T17E6523868D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 f901711e1b705549b7b5c8090d0dffdaf89f29744b5e72f295493fb4a7c8b4fa
MD5 daff766e05b4556a939de604b438e2cb
SHA1 32bab36e4b384fca57e6cade696d38961b0e4b07
SHA512 109cfdfaa08d44945c993732f55931a48d2beae8a48b066955335b2c26e41909964ff6825c3683b779405777b8bb6fc0e296df021a391d366ee357836fbfd800
SSDEEP 24576:HFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:ob5+Pl6bJTIZ5jdgpu
TLSH
T1BB6523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF134389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ec961d492fb7518a55e881e35a60f041cf8eb47282f668268cff902409a0c998
MD5 eb6f8a743cb8b95f8c697405b77f88f1
SHA1 6512d673a1d25efda5323507199a521d1320380b
SHA512 82d3165de13dbbeaf31097e29eaf7649dc84e29a235e04e58f82189458bcf7bc3f9ae8dca6ff55277f207fa14c19b8e60625ef39de497fa8e63ab5fe9a47a226
SSDEEP 24576:gTmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:1b5+Pl6bJTIZ5jdgpC
TLSH
T1636523828D6B20C6E09B5779D9C9DB00F879AF57DD8727B6C67D082BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 399a5ae290ac2c6918faaa69d36cbb1ff1bae065502a6b4b8459ef181a63d68e
MD5 1757ddc318b82109a6b0f5b314b8619b
SHA1 0b67aa23ab5887f3e3c8e79d9156c5787d2a29a2
SHA512 5951d36f6c23aafd454827493f344e40dd97b2f593edd391502c0d77578bb74e26794fb98be28b8a941134814d7d571cbc78fef47153a0a1e8c3c80692993311
SSDEEP 24576:Sfwvhk9RX6wkyAIRmb57GBiOl6a8JTth/RWZvR6wQQ92pN31:LMnYIsb5+Pl6bJTIZ5jdgpP
TLSH
T19E95CF29EBDC04E5E0B7923C99E7460AF6B178595B31C6CF026A536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c2ebe35618943581192f329ba2f956e0ca7693b9a02affa1559ec2a4213a8d64
MD5 3a561971c0eb64cbf3605f310dc1e944
SHA1 6fc802391a39cdb4326bbb3c44eb2ef88c0d43ae
SHA512 298018ca87d929c4b3235c9ce05ce97b380a4859cb39332a184f4ebf9d2ec73a547d892ff9f446c621a2d9e89d60e3e149c18f344304289b5e1529db6020e1f8
SSDEEP 49152:0YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Pb5+Pl6bJTIZG:rySzPbslgJTIZ5Bgp
TLSH
T1D2066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 98135efacc19254c4181394bb5c7433906e8048b8b9ac997bb44ba2f5fd1459f
MD5 9531403142b3d2f3ea85e4657e89ba5f
SHA1 108b1b232880295335d6be1ab46dff5ca09e4117
SHA512 f82ba455335479341853d8c1c63fef2624606df6e67c0b382c24578e9942338ec2ae00dcba774dc49dbb4ae775787118696891d2e9338095abb4c04c7babf182
SSDEEP 24576:847Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYSmb57GBiOl6a8JTth/RWZvR6wQQ92Z:847JUQjqirIhCnDHUPfF/fb5+Pl6bJT1
TLSH
T1B665AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 be59ef4901eadcadfc4da2ef1e08cd1a7603bc1af524b0ee025aa96087307eed
MD5 8cd4442d2ee6e0fb646a96e1e4335eaf
SHA1 3608bfa8ffaa6d388b03edb44ff19ad5a198f8a7
SHA512 0722ad90ab4cd1b79eb51c2c80351e7ff9e6a1549b30d27e4a180d067356b61250c5d1e81b9076bc8769eec9dc857b19b2d77d89810a3101cb0f62d48e35e9a6
SSDEEP 24576:vNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:Yb5+Pl6bJTIZ5jdgpA
TLSH
T18075F14AC29811D8D06E6279CB858A00F7777D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 74446494cb2fa90d0b47c4afac1d39c8c1bcdfb23f4918b0e7987ebd811b6203
MD5 dba04aee88a71b4207b83974a1dcc4a4
SHA1 ccf168fd8f127dd118d5a183334ebe20bf46b40a
SHA512 4de27eb67d10f360ac3b3f9778870ce531310668df82fcdd3343b180560017e8728ad8e1aa83e03ae1cb0c01b88fe5842417456afd0511e96da2ca252f3bc51f
SSDEEP 12288:zyQzAU3fOBWc60P9ngGy6GhV8m4ei5CXwegDXs6FxpZ:zyQUUPwWXI6qhei5NeWFN
TLSH
T1EB253950762AC75FC6AD40325E37C2CCAB707D41FE059B0772C8972FC576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 f55967dbd8a2b3d60eed198692ecf2ad80b7d40ecdd1aa6a469c1fad5a3e09fb
MD5 e263efdbffafe1024a059d5f627ddd9f
SHA1 9150dbee5dbcac9ecf570e8103d5bda631088aa5
SHA512 af9d82d3e52c4b248e86e0a1c871754e02160d6eb3a6fd2a4745606c973a0c63540b43dd076744f3b649ff5dbe1154c2cfd268da1e4306ff2a310297aa10d6fc
SSDEEP 6144:4808UdLMzHgM/D2/cnOI18TRPtMx9RPtMxOSU9/o8GBJvlaH7z8goe2A:4808UdLMNOmGO7z1l2A
TLSH
T1B155B8815137A3CFD1FB2071072A5B4DABA4EC0672455F26B3C8193ED86AB65B0B83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 bd3cd3b8a7bd0e1e8154387553398abf7eda6e5f37f4c4cc44aa7ba8078561ed
MD5 a7697f88f0dee27392ffe59dc8047f31
SHA1 75ecb76b74a8f7db171ff7b19b0876cd6a052541
SHA512 b4c4a8eab46fab71e04de470ace803674235ac73aadd0b011a392faabc73cc92ad4080995db4090a2118507f4b643f1381b2f2b51247759e10fdd93c96f7ff12
SSDEEP 24576:11mb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:14b5+Pl6bJTIZ5jdgpZ
TLSH
T1836522428A6A6086E4BB5779D8CDD710B83EBF65CF8566E7C529142BF1306C87C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 048edffd2fd4d45d42f7589f4dbdb8b3fe8e5279591e934c704c88bc3ed9cc4a
MD5 05277d73cfe33d990d67fb96cf34ffe7
SHA1 75d6a755e3aa851493aebbfc360cb0395420c8a5
SHA512 174d4058a1c9a29c506d26d64bd40e09494f3d3440737e5e159e835bbe2b7623ba88a86d770e06d1690981bfa20109379472991d6d321a5759c9663add9d261d
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:tgb4mBIBhGFdb5+Pl6bJTIZ5jdgpM
TLSH
T126659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 22dce67d85921b462a91dc0039f4a683973780a3967b167c1eb054966c2e56aa
MD5 9e41b1d13e9a793052f09c6648e56998
SHA1 ff025bb5eaf16aae34078d45940c2158434f71ca
SHA512 62f17c720c74ab2f5bab3cc57a263760242b13b0a2cefc3d937bad01af7fbf95ec3bc4635baa40dbf41480c609724a5e60587f2587dfd818489520abf834bd47
SSDEEP 24576:1G88u8FpJqH1ozria7/mCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:47ZFPqVXa7/+b5+Pl6bJTIZ5jdgp/
TLSH
T19C95F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 57f2ddf3b0deccead5d52531e89042b1693ed36db14fb8230a9de0b5e63ca178
MD5 f037108efcab573b4ddf567203ed9bb7
SHA1 339c0d78d2180883222b5e11e3b0bdcef42f39a3
SHA512 92b2b5db02ab01c1dac781004f2b40d2267c3ca3bd4e7d47b39058fc381d7e62f031f40182d3b7b91e4e214ba016bff20d1e07aea0a3ba7e4fb831a1071f27fe
SSDEEP 24576:KPUr+NQ+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:KJQhb5+Pl6bJTIZ5jdgpS
TLSH
T15675E11F26AD18E5E67AA17DC9C68709F771B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 be399f2cbab817e906ab0cf9f3e4bcb0a0e764701b80bbc813d29d19a9034cad
MD5 1d404ecdcf2f97369f784dbeb8fcb0d7
SHA1 c9ca1a8a7521b2cf5002b85bdbe0610f7566c19f
SHA512 b79169ed4b0472aeabd29f50389f00fc832567a4283c30354bc442a2932ba6909b198122f24a4bca107cf73246fd75dd210f0d5d786ef3cd325eed9a8495e748
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRb5+Pl6bJTIZ5jdgB:iG05lO43bCslgJTIZ5Bgp
TLSH
T17ED5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 95c3f7993b6f3a106cb07bd30074b060cb49af69cff0e532b3beda1a8c6241f3
MD5 e36014f2ac06ba319cd96e6b920d1ebe
SHA1 4fc7e37b7dfcda79323805b051255702a77c575c
SHA512 a949e62281e501971e63effd83430d968e17da6b3ab9b624873a5de843cedc748994e869bc2a126c5ebf1b766915199ea14aae2bfaf4025eeef2a4053cc19646
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnYmb57GBiOl6a8JTth/RWZvR6wQQ7:La5POZ3lJt2pasx2+mJb5+Pl6bJTIZ5p
TLSH
T17165AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8e3514c46a02f15ceda0448020d3fbb9fb1e9bb9dc51f67af4dbd7e7eeecdf31
MD5 ac1b149fe40b32077bcbaeaa62cea8f8
SHA1 6b4e63220e1eed52b8b4c4f05ee1af597a80726f
SHA512 63b638c6f54e8f6f6cac6ae2242eccce0c393f57a7b07600dba2aa29890870998f42e487bfcf8617bfc08fdcd469930bfc2a1a0c5e33d7854c4488356eab9eea
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fkamb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:oNc/zEOVHFeb5+Pl6bJTIZ5jdgpE
TLSH
T150858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fdcb8f6627fe609a2f4ad8c1bea3cfd6a975f6ece09c3619d622bb42c31ed257
MD5 410ff421f0d03d11ab01cb5f5b785758
SHA1 82ba0394deb6fef1ba15c80af0cd6cb8a8877673
SHA512 9f861d4d097ff2a1c859f895bc061d095098efad8e3a743610cbb51646e615fd97ebcb29d81fe6c728b1e22eaaf9b17ad16149813077277cec70f2a1f281f315
SSDEEP 24576:dzkNvNnaFeYhJNtmZBmMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:dzMwBtOmbb5+Pl6bJTIZ5jdgp9
TLSH
T15355AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 4a59900ee1a9d4fc70a183fe8e8ca9d32b47fb510466a275a87bf09e0516d228
MD5 a0abedd619b4322c91f070b9e6bcef83
SHA1 5c90be903258094a762f75c0d4d7f32e27006acd
SHA512 4520336a201684fb249f3a2e6030c116f5d3410052c8ca0255e6badbb9d568c869f952cecdbe7257ac79cbe1a813deac35d600ba8b22bda22519221096c13d12
SSDEEP 24576:lD3FHshBIYQgApmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:lDVHeBIAAkb5+Pl6bJTIZ5jdgpQ
TLSH
T19985E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/8-277-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/8-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/8-50-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/204-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/204-328-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/204-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/204-89-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/204-95-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/204-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/476-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/476-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/476-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/476-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/616-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/616-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/616-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/616-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1272-279-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1272-64-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1272-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1624-294-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1624-83-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/1624-78-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/1624-77-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1852-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1852-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1852-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1852-311-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1852-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1852-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2072-76-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2072-9-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/2072-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/2072-0-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3160-396-0x00000223FC560000-0x00000223FC7EB000-memory.dmp

Download

memory/3160-324-0x00000223FC560000-0x00000223FC7EB000-memory.dmp

Download

memory/3472-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3472-112-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3472-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3472-314-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4152-61-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4152-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4152-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4152-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4152-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4152-37-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4500-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4500-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4500-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4500-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5440-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5440-134-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5440-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5440-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5440-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download