e4f5339358ee8e07a566f2faf90ce2955e49a9631a07cd357702c2a24c197990

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
Size 1.2MB
Sample260804-j9rhaaga93
SHA256 e4f5339358ee8e07a566f2faf90ce2955e49a9631a07cd357702c2a24c197990
MD5 0fff5ff83daef654ae78c79b2e1f3cdf
SHA1 5032e0fcbedd7f33c0244dde035c1b5f3503015b
SHA512 d8fba19988e9b0a8eb0aabda4611e172c12bbb8ebe8e3d9b9b0139fb779b55082ad8e9869b10fa69c8cf68f3863f1ba84d7c05094733523459f9d188281ffd3c
SSDEEP 24576:kzERlTx6aG6wUsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:kzEQr6wub5+Pl6bJTIZ5jdgpX
TLSH
T12F45AD4EEAB621E8D0BBC0358A529132F9713C894738A7DB53506A671F33BE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3296	elevation_service.exe
4272	elevation_service.exe
4568	maintenanceservice.exe
2320	OSE.EXE
3620	PerceptionSimulationService.exe
5364	perfhost.exe
3516	ReFsDedupSvc.exe
1416	SensorDataService.exe
5804	ssh-agent.exe
4536	AgentService.exe
4160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ed1eca00e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e33e7140eb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044dc553feb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0a8353eeb23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a11517deb23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdd65d3feb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2440	2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4536	AgentService.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: 33	4160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4160	SearchIndexer.exe
Token: SeDebugPrivilege	3296	elevation_service.exe
Token: SeDebugPrivilege	4272	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5960	4160	SearchIndexer.exe	100
PID 4160 wrote to memory of 5332	4160	SearchIndexer.exe	101
PID 4160 wrote to memory of 904	4160	SearchIndexer.exe	102
PID 4160 wrote to memory of 4696	4160	SearchIndexer.exe	103
PID 4160 wrote to memory of 5184	4160	SearchIndexer.exe	107
PID 4160 wrote to memory of 4844	4160	SearchIndexer.exe	108
PID 4160 wrote to memory of 4496	4160	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4568

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5364

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2868 2864 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2892 2904 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2868 2864 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2892 2904 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fc589e22f7506b1e8597bb68ec04f8abc744b2271573c07a71e6cb24d9382a6b
MD5 4de8781bc72ebcde11122f8ccd776f84
SHA1 1463df0706a53d274cb3dd26a67345d5c66e4857
SHA512 759bcbebc7a25dfecd1b23b631277cf219528d0daacff193ec85f542e4402e4133efa81af498504ab11cd773dabe89820e2f9b41ab57a7bba114e4631dc419c5
SSDEEP 49152:Jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn3b5+Pl6bJTIZ5jdgpJ:f3q6mjB+slgJTIZ5Bgp
TLSH
T1C4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 15e71220a530ae6efd0198d7cbd307122549bffcd0228754546b5efa3ef6dcce
MD5 bd2c7844d6cf017d3d861ad3d43dc9a7
SHA1 d1492e2fdd129cce5f6d9ac16dd996c27a8b8083
SHA512 a82950e9c96b1d85f72d0bb3169d48948f0c059e56fbb5ce8c7cf9c55e66090c8b2fc2dff307d290e3c3c9d6827d7ed4084fcaa92cc4f32994d90198333d289b
SSDEEP 24576:OXYfDtczAZmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:NtcJb5+Pl6bJTIZ5jdgp+
TLSH
T1F485F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 965bb84dc66b4a930875e016b13e995c2393460653978068ec15f63ed3a34cf1
MD5 e1f432042d95f71594f328f694dce998
SHA1 b0ea2eabff769630c1c86088714d8ec35b794960
SHA512 fff4646f7d4ee7b82758041e563df45c1a4b2989d4e5f7048840b3e4bf175ce8e0a0f6c7fbfb988d00347d05915f1cd2f49c944a53e97c437f907cc8c4424c65
SSDEEP 24576:90Le5ji0hmxyrM4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:9Pji0AICb5+Pl6bJTIZ5jdgpo
TLSH
T1B795AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ebfb821c94ad26810840adb7b780a4c228029cb2082419d40088fab80ab5252d
MD5 07258946248ce2b4f9e04e4bcd6aef97
SHA1 6f1ae6ddcdfcf0aca4b12ead3d309fe9b0ba4c91
SHA512 7a79786dcd9cc68ae2443472437ace78c71e4ae6e72205efa5f53684f051f425c7df331641f2f0e37acefee70c62a81abaf05fc4a4d3dbfe5619cc1b56010c03
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWj6q8wyu2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:p/ezSC6vUzPv+Hjymb5+Pl6bJTIZ5jdZ
TLSH
T1B7756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ed3fcc05df21eecad3158e2b323b9ff4776bcad2432f274cf3f7afaae128bd1c
MD5 fb7c40261414e624b5ee830559973e3b
SHA1 d3bb36eec03de24deb55c17db14d783535cc7872
SHA512 cf819f3ec824526c251dcefee93756a1ef730d32d9da3aade4187d87163a149e651be763fd955169518628ebd37d5f799c08a1e5922140157fb308c921295168
SSDEEP 24576:mVbqPb88hv/l+Bdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:mVO88hXl+ib5+Pl6bJTIZ5jdgpp
TLSH
T115559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 db27f49255235fc6ca76124356aa91cd4573ab0ba5ff6b632ddae7b4957de842
MD5 9a40ad4dac2680c617883000934f89f3
SHA1 e5356f1e92a8555eca8854f9245f151d534f8293
SHA512 346435e226b192bae3692448320bc52cd22e34a654554cab442f42e4d23d8e0a586c28f1464a893af17f0217b8809a4514f4aa0e45a37fd146dd2bd3d057893c
SSDEEP 24576:MFcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:Ib5+Pl6bJTIZ5jdgpr
TLSH
T1B16523834B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 a8e722cbdc1da624402477cae22564ecf2537f703775dd3627ea7dde90290ce8
MD5 91b91c31e81a414922023958d9995b0d
SHA1 e534287c75691e7f4fb3fd8c131cdbf14e1f6445
SHA512 0ec38e46e6e95886b633413bfa18a4f6fc1a24fb2bcb2c5e8b5eb74184b633143cc89e62ae5c83bfe608760f5074999c700c597c620300d39d51c0cc4addd815
SSDEEP 24576:kJIUVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:kJIUYb5+Pl6bJTIZ5jdgpE
TLSH
T1A685CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dd51ef60db8e9e385a5b33da14658eb43ead3f3a7518afb5909313f24a3a17c0
MD5 f0dc0f4bdafbb564c5228ca6dee51022
SHA1 69e34492898f477620c59b53d11e58400d15fd03
SHA512 b5647f10365d4bfb3c671f6fb2caea214e844c5d5fd26d7992f03fd9e1ddd0c231e516eb42d7bb5e80c517e3c5fc5a8374f780601a6cf1853db6d07728dce364
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:VQvGAdlCEL8c/WRNw5C1slgJTIZ5Bgp
TLSH
T1D5266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c7a61e1eeb2ee1c118abb07a989ece595a048593fbb935011ceecac1803748f6
MD5 e9a53f3f9a68e846408dd47568dc460a
SHA1 23fa911e2c751c611c8e459405ebbd5af4ffd6ee
SHA512 cc21863fb3adcc25499d956171123bd101cd55642d468422a3dc5b39100078dcdfdf8437a856687f6046401d50c006fbdf13536c268185d6b783132931aa4091
SSDEEP 24576:JOewsAj7mb57GBiOl6a8JTth/RWZvR6wQQ92pN37:Uljyb5+Pl6bJTIZ5jdgph
TLSH
T1B385E031FE75E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2dcf960f4b3738287f73833f9bda6d7739fe5ec4e04286a4b542221a3ff5ad70
MD5 92c7dac285c09934c15ea489f7383d3f
SHA1 e1c556aeec39bf826d18b4fbe36a623ba18b667b
SHA512 cf92690b3ab1511978f0d45ae2892d25bb300ba2a53c1f23bda4303a886ad0a29312ad74061c4761b03f870ee33e54ac536b327ad7b95be85f66a0bf57de131f
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHwsT6p:+UEtQevvqc2W1cpV20I32ws
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c5f165243ff56a35ddddc15c57b2ed4ed76d8db55c9c5125de5881021da9b6a0
MD5 be57b80770928bec0f4eb305c0b6f6a0
SHA1 d1873268ba6835731c83088ebf8bc29190cac744
SHA512 5ae334e854a3bb60f1073a704dd11e37ef4fc361639dc87fbb26267de2178c55c2620818305bedff435463ee4307382df265cb3a8483db32cd5dd8fd571b57eb
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zSb5+Pl6bJTIZ5jdgpj:HoqtVjnmJslgJTIZ5Bgp
TLSH
T1EAD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9fb97d3a01e4a9fca359f80c386d1b767b14d7a139e03484baa8399f6f57215a
MD5 ea69858dd4bd966aa3039fc96e3f70b6
SHA1 0b5da5cb6ae9f52c65d68ed1710aabf0b7b0ce44
SHA512 6a7dcb5a57cafe704040b4d928674ded16ae9e54d3867ff1782b90c8839453c174f96331f8e34ca2bcca3a53b5e642bafdf1773ceda5e694667336071fcf3d00
SSDEEP 24576:iAhGL6IFoiwtA5l7S53ymb57GBiOl6a8JTth/RWZvR6wQQ92pN30:iAM5Foiq5Nb5+Pl6bJTIZ5jdgpe
TLSH
T1C6359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 cbe402fcb15e040eccdf674b99ec268a55539e82dc3ac1107ab4240c8fb7945d
MD5 77424d50f4dfe2410b271c274f35d72d
SHA1 826c5f7d7a0612eae01ab3201e6ddd67e7064be1
SHA512 b4bbef8de753685a7bf3d2766aa17b1c3a33d7b5291437318e3a7ad4f00733347e8ad75f280e6a98d52781c90d3d92b77c9a5b908986c206d6bc11083fe59998
SSDEEP 24576:WwuGOWHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:WwNORb5+Pl6bJTIZ5jdgpV
TLSH
T14375F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 08d2302be14e88cd139ab942ab7d3296c198a230c6c70852b66897b43548f9d2
MD5 efcfcf10040fe753b6428b527401ed68
SHA1 0128fcd5527bee4a3aa9e83c9f9f30243ab20d33
SHA512 e1c060e31b3becc5cf30dd52235d6b8d3bafd1e610b282e882808a85900edbbd1270af79c401a66c7d2c7d7a2dce744c58d8f6446123a566e7cfa69eb47591a7
SSDEEP 24576:JZuwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:Ab5+Pl6bJTIZ5jdgp1
TLSH
T1E165128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1e08607715159d4fc5a1178ba08ad6fe78b4d3abac65f56632c179eef8f11f38
MD5 d516da9edd871e8b1dae3894a563fcb8
SHA1 189810021d5112072fa9d5322ca8df3155429230
SHA512 3cb070505cbe1ca0d131e5c5e3768351977ee7361cc092789ea685cfdb72557c83b3fc4ff70cdc862648d3a09b86212ddf6a1fb2672b2c9c43e8dabea9ff845b
SSDEEP 98304:pQRQyi36YOcPDLvw2gAf+PN3qslgJTIZ5Bgp:AQyiKanX+PNasT6p
TLSH
T144666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0703e4fead9cbe453e206004b2957cd5ba0c11637732df92368faccbfb3683d3
MD5 cd0cdf4f30fb5293d9099edd09caaa63
SHA1 796b7b322430626ab08adb141643a89d0b7d44eb
SHA512 6b90cd68c7fa04575e705b6bcfc9305aaa9f9b2ae6ba603f8a1700c04945208ddb47d69c71d62d4867b8f185d92087c79e62c42e4a91d6d72242691e82e4f40a
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3qslgJTIZ5Bgp:jQyiKanX+PNasT6p
TLSH
T186666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 207f05b790b3192d2f58118f6728c4ece51e706dd70e4dc3294c61cf025ca937
MD5 933eb74d140c9f738b2fbef4d14ebcc6
SHA1 97f53b905157ee1979a79e29252b52888af93a24
SHA512 21904f050f7b72e2d7041fc6f157127f4072013f01160b6a223fd9675739342a741ce024e9a20313c97b84eaa9a9fc98b946ea423367353f74a56ec829655cad
SSDEEP 49152:b68Qg55nhkeWu7PNU3/Cb5+Pl6bJTIZ5jdgpG:lthTRc/IslgJTIZ5Bgp
TLSH
T1B1B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 03dfe9ef19308bc7e9930412d39f6e09b333607fc43cb461ce0343461f14fd33
MD5 fbb7ebebea45e0b7eece08bf9bc1e62e
SHA1 d60a04e4fe79c0c441d44e857542087e8929e93a
SHA512 b0d612ec675e9da206cf1c6d412200443cd52f892f861e33f697cb1d4280dd0e868be629fedd075e03268312bd92ac29ca30beb22a189e71ac6b93090ea497fe
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZfslgJTIZ5Bgp:XLIHRWhBsT6p
TLSH
T1B5167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7b36eb242884f08224b14e88184c970765f247d8b7a0045a72d188381453d825
MD5 766991209a610d066856ac76f47fd8c5
SHA1 159ab0a6cd62fcca6040f3978cedc1633fdc1d5e
SHA512 c0b9726f5184ec0573ecaf0a13c1dac61d7a90aabd4e6dd72c9f74a8db8be02b241557ab2c6fa944d5f7f3d300edf97e283e85582dedb3fee37d90ad92232438
SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkb5+Pl6bJTIZ5jdgpm:bu6JmIxd2dyslgJTIZ5Bgp
TLSH
T1A0D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5713f9efd3db1cbbb50bb04531d85277186b6f707a0992d8d825701b2db18313
MD5 4d382ca0a714666e1e73f0d83680502a
SHA1 d996ac3c53adc6811f02bc749a2edc50ff8c6b5f
SHA512 9a179dde4442128fb84ba5683d0dc874d0dbfec367c57741d19529a3e2369fa76eea5601c97daea03779600de054326f66ae0812142c05cfdabe7be99e42dfc5
SSDEEP 49152:n1hpsNoJpF1A67U44CwH7R4x4b5+Pl6bJTIZ5jdgp6:nmifPqRJslgJTIZ5Bgp
TLSH
T14FB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a7391dc31ac9c2b8f3c375f9b472f3edc354fa1829c697f1cfa1a6812d64c051
MD5 52a0f4cf99dfa08a57666fd27b44f44b
SHA1 0e8cf46439c2817c0a85b43e498270c307fcca90
SHA512 f38fe387562641cf9d7a9ed29cf3b60342d919e7200c84aba07559b099ef1b21b196fe638e335cb7f58f84c36b44a7278096da65042384e012b1bb9b5dfef242
SSDEEP 49152:YSuZQIY0Be2KkRVtOnks6NMHqnb5+Pl6bJTIZ5jdgpE:C5dKqi61bslgJTIZ5Bgp
TLSH
T148C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 87d5c5ebc917a78e8b63b04351fef3bb69dff60a487870c8287d68f762a47b01
MD5 eca26cd86e38ae9cf0a52e9821680ed2
SHA1 7713db6e08e9b2238f061cb7ec6e3ad77d27d3a4
SHA512 dd5b10368861b34ce44c18accf6137449f389e5ad4575a25afe865127fc152435c53c7193ef284fc08904051922b9e2ae1ba0651db9c8fa9878045bc07acfada
SSDEEP 49152:8htSn8EApI0figjgiDn0AP5wUb5+Pl6bJTIZ5jdgpO:9X2iWphtslgJTIZ5Bgp
TLSH
T18C95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2899d8822a1b58c85d9f4e0dca769003c0ba7c8fd4eb2026d99db5f875d1ebc4
MD5 80a5d326c91e2a65eddd04c990234808
SHA1 9e53d379624f6cb39688fc815e2b4b76d62d8905
SHA512 610e32c8981223dfe543413d29b718499f62c83e81d43a8ba157c2adc48da060dd7dce18aa2cc6b756c5b9f16b749f7dc785aa65459cc4ae0c633f4df95008a8
SSDEEP 24576:X0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:zb5+Pl6bJTIZ5jdgp8
TLSH
T1EE6523824D6B20CAE09B5779D9C9DB00F87DAF56DD8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4f1a33a799c7a48b74c7d2204c1260cde4d9e70adb295cdb7e7e106944be695a
MD5 a36471f9b4773410327e43d889e94089
SHA1 a2845b5837cd3bc33c238ff20feb3a708527bb26
SHA512 87bc53866f6c82bd47676415b6a94633a8d8865bd87abdd40847086a6cb9157c8014046584c7d9a45661e0ec74ad0afb619365cedde7e8e02490bc1e8d64f03c
SSDEEP 24576:rvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:Cb5+Pl6bJTIZ5jdgpy
TLSH
T1016523828D6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1d3177d6b4a062709f909ab564e3c2b34cc245c3e3c5fe505b49f94952fa2082
MD5 4dee3b2ed6a9eb040f74766d64cefa1d
SHA1 3bc8dea056d21725e3fa7640e9a0804900eed26d
SHA512 0937862e4b79cb1774a126468f7560cceedb5c4c78d91d5ea1e4dbc71dd77e8c010327ba2281241b0129bac7c9d301f940ada0ac6db6dda493e8fc431437a1cd
SSDEEP 24576:Otmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:Tb5+Pl6bJTIZ5jdgpy
TLSH
T1F86523828D6B30CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 a5ba4b8fbaf9845b95daa0dc4c7fe41fd0c98cc1b0659d52e7f7a809c42ce201
MD5 3bc45ad1112072ea58551a841581f40d
SHA1 d866815495315225db9f8dec1c015ddb3e429354
SHA512 470c105ec1d9c37313f73064dc918b5a79b98d358af545d398209768a7619fed7d59c89c38f6d3a5cc3770bfc0021a3b0f8ceb7ceed50a8ec4e46533720829e9
SSDEEP 24576:/mb57GBiOl6a8JTth/RWZvR6wQQ92pN30:+b5+Pl6bJTIZ5jdgp2
TLSH
T17D6523424B6A20C6D4A79739C9D9D700F4B9BE96DF5367FFC675082BA931388383134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 3eda73834aa57201682e01abe7788121471b9b557730c45fbbe857551cf6ed5b
MD5 3e7d7c7a7a76f8ec263b9cc041544987
SHA1 f4dbbbd49547c29aacf0bb63cad16ef04e2e8a56
SHA512 00ac0b420f27729137373f6f728e3a12f9e10f7035b2baa10464757ac7d1b24cf41dcafdb8bf3bfa7d98656034099777bb367f8fe36043527a7121c98af699a1
SSDEEP 24576:C6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:Ib5+Pl6bJTIZ5jdgp7
TLSH
T1AF6523828D6B30CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a394e9ea37eeec727ce5f23a5a7c72dc20a9b1414aa6a663d0e59b6a0db82a83
MD5 9bcb75fe76d9c01b9c36e1e6ceaec670
SHA1 4ff4351b7ecc8805d53f8711b6ccd7e59402e696
SHA512 6c185974617fa7f6108328b03b0759876f166a57eb6639156e5f59790c1a9f9bb9d328df1d6a2dd311702139f09e2a08751d967ce2cd2591ba8bee852a9628c6
SSDEEP 24576:Jzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:Mb5+Pl6bJTIZ5jdgpI
TLSH
T15E6523828E6B20CAE05B5779D9C9DB00F879AF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 57c39bee2c00e958b80e1ceefae2d4b26169b2df80f486fade826b31a7787574
MD5 4ee8b9eae2f83df6faeeeee6b16a5502
SHA1 94b80de2a2cd1eb108a1eb7b092dc111fd96f6e6
SHA512 5fa4c3200763299ad84c2f59a85ce0b28d447abdfc8344eda67a934411bddc91e300d0829699a26fe584e13b4186540885ece876d7beab558582adab663f8308
SSDEEP 24576:OXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:hb5+Pl6bJTIZ5jdgpi
TLSH
T1576523828E6B20CAE05B5779D9C9DB00F879BF57DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 8bce5ae8f7cc24115aff1b97606154d1058e9f92dd21a6ca24afbaa231f17cb3
MD5 9ccdc0e0e19b8ba6c68a018a14e492db
SHA1 7a035404ea177150b3d98e19690caff060c433f8
SHA512 2562947a49a8a8457c3dcc40fd262aaeff067fcdb3fbd689378291c51fab14df270997fcd385fa7fa04d357886622f81d2b7f9643b69fc003da02555b512df82
SSDEEP 24576:cZMazFVSOPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:cZMazf6b5+Pl6bJTIZ5jdgpo
TLSH
T160850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a57f0f805a77a758e891f32f56542ff07827a53ff15f29fcd79fe2494f043037
MD5 2ea497005446b066b92ae52a2fcbc04b
SHA1 0bfc09926b665e0e071d85cc15803b6b93bcace9
SHA512 b6a304fd91eecbd45170a13f2d07713324d9adb894b419c89d19cae3b06b7d8026bc115611d0d1e56ebe847de1138232928846378e033bce8e89e1cdd3da05e8
SSDEEP 24576:Zgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Rb5+Pl6bJTIZ5jdgpa
TLSH
T158652387496B20CAE09B5739D9C9DB00F87DAF57DD8727B6C67D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 96fffca6641e4b6b9d48f778e7eaa3ce4d125a4b5c2f5e2b545ea226d3800ed7
MD5 8298d3088fdb2254d97a164a1e24245e
SHA1 a454e296883dc96740eee4dcc68ec18deebba482
SHA512 4bd83ab430f3c84636bcfb3e9f5c4205b7501e94da86154fecf35993963142f46d88c5e95d0e75e323aec8262f372de1aa6afd197f898aa3bceffe16c38e7287
SSDEEP 24576:yMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:2b5+Pl6bJTIZ5jdgp/
TLSH
T15D652383496B20CAE05B5779D9C9DB00F87DAF57DD8727B6CA7D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 037a5d00bd5e21c6128b40fe593353f9b3d8bc796d10bf9e8fbf0f84318c1b40
MD5 51dc7982a4fe426fd2ac60345377a20c
SHA1 5f842ac1c24e2f7062d4aa0ceb4ea328e20e6da9
SHA512 52a0a5b6526bd655006d8ad9885e73772f5293b26bfa4f596bde9505e9af5967fcfedb94688cbece925798d1618d869d4b364732222e7147c62fe859b73ce8ac
SSDEEP 24576:7zyrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:7xb5+Pl6bJTIZ5jdgpW
TLSH
T18175024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ee6dd9719f4ae424ddee5cc9d430b4dda191cb7a57197cdc8deade1cecd59636
MD5 ee193285c58ec8b9c22ae6d1cf183d57
SHA1 456c37ef20b9a70ebe7549887a938a2b0fa5efba
SHA512 1cf44ec4279439fff441cc79151c24399c1bc717e75bfcee19043628bdc30e029da9571ae4d6fb504b77d297199ea98361388081d7a465e46d7d8376317348a3
SSDEEP 24576:wgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:Ub5+Pl6bJTIZ5jdgpC
TLSH
T1DE652387896B20CAE09B5739D9C9DB00F87DAF57DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 488198d5904d86e0da88014ff5ccdbeeee37cd9b3ffe7908d815d099070eebfd
MD5 35ee25c8924d954a430983c6504b8687
SHA1 47c08844c11ec390c391b95c2c5863ae0fd79874
SHA512 e1b12dcfc47ee7e2230a97177abe2d4c87e93797d87e11fa7940c785aa62f59b406920a3a1834ab790aaf6c3a0860376ee9bb8d3125e47830795a1d9cba86955
SSDEEP 24576:agmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:Ob5+Pl6bJTIZ5jdgpC
TLSH
T1AB652386896B30CAE09B5739D9C9DB00F87DAF57DD8727B6C57D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9a9fc812e64ea63404880f95f0cb4109b23817cf2fc48a5972615a4678402159
MD5 ab4e3c0aea29cdce09c4ed26ea5e5c5c
SHA1 8a04e8f9fee04fe298f5e47c45ef75df5a3bba0c
SHA512 700ca01eecc5bc47def25b6f6521665ff64997f2ae18fffc0a798998361965ae1acf4b152b6e2f013bffa024081ed66abd3dea39b47a7da8dd64b13fb31ce759
SSDEEP 24576:czyrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:cxb5+Pl6bJTIZ5jdgpQ
TLSH
T1F975024767A630F9D0678238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 3a48d7fa8658c77bcd4cefde6b1c7f476ebaa652cdfd80828cb95f05bafa4543
MD5 ea012a3f2dc41652f06a9f978b1b07a9
SHA1 3395f267e87dd6ddb849e44d9dc94ccd89cfc4ef
SHA512 3951139c2b1ca480bc4824d2a5a307d748964806456f2d8878fd721360e93ca7251f214fa6ea95b7f54b556cd8a242388cfe1cdcbb8d5a2fec5e962cc84ff901
SSDEEP 24576:nT/aLl3z0zD9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:nTiLlj5b5+Pl6bJTIZ5jdgpm
TLSH
T19A85F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 245bda45a0cdef221d0f9030d834224e0b2d418667219ddd41bb5ca3097d9535
MD5 6e1744449a8bf3be9609a4c624b5eb73
SHA1 e9cc21718b7da5a5a920d79bccf2c5687d212a9e
SHA512 9c95c1e33d431fdbe6d7f4ded27600d7b90e773bbe00cba1b9c280f94f471d2c1b53a92abaad4177b57f7a1714b2e0082501da7594672cefae99badc76c94064
SSDEEP 24576:Z3Ud9CHKy7GZRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:pUd9CHKya6b5+Pl6bJTIZ5jdgpR
TLSH
T1C895CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 5472decab23aeb4422b16b89d3a4789c13f5065f391ea998e443a012300ef506
MD5 b5119f83d1414d68af93f63b156ef837
SHA1 d73d0ab12199a992de0d9c8c58faeacbbb732626
SHA512 9883f9bccff7294002ea625937fae5e265244ba97120382ddef5abf214e05f63abab77122f733c9f5524fe80c2bde5fa3d0c77d10ddc0141eb88e51fccd8b792
SSDEEP 24576:oNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:Bb5+Pl6bJTIZ5jdgpn
TLSH
T1F06523828D6B30CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 1e5b0d65d317a7d1fe7cca18bf1e0f5faef23d58a8cfb5e4ae23f49684a7af83
MD5 80dd3957704e198a6f581e09909d6bfc
SHA1 67aacfb9126f3d586ec1aeb32c8f43ce47a55ce5
SHA512 b6965df96c3756df4cd1fc6ed364654fc1892d4e254b0058caf1ea575c8c6b9966ff1af84424316954cac57a5436718a14751444205b83bda87ce2a6644770fe
SSDEEP 24576:XLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:yb5+Pl6bJTIZ5jdgpr
TLSH
T1CB6523824E6B20CAE09B5779D9C9DB00F87DBF56DD8727B6C67D0827F134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6d02106892add167c2a018fd09b81778a8a5e46b49cbcafe1ef7b76ac784b3ed
MD5 5f4be1638be5a2f2ec36d1f16115d436
SHA1 780b5e7aae49f3fdb4f7b14cb065bf9b43ac9de2
SHA512 57110e8c8132329b1ae7708a9a69551261031667fa4631568e47b2da4db3e523c1c42c34e217f71cfb3503e1369961cf9de4651af60dc230b282a7ca163a11e9
SSDEEP 24576:H+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:Bb5+Pl6bJTIZ5jdgph
TLSH
T1AD6523824D6B20CAE09B5739D9C9DB00F879AF57DD8727B6C67D082BF134789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 162fa262cc825cc9a12d8702ce9b6175b9cb507d4eb226388b00a4c7520a1b8f
MD5 b07c6422617cacadd73a5110519ebb00
SHA1 e84bc85cc7986f1c45d7242efe2e95c2e3bde7f6
SHA512 99c4c3871fd09c5b0e52f6474cb14ff0ae27f61a4e31b04d5bb1de4307068642cf5975aeb0b6473be6649fe1297a09304787f63727e21445e219ad4a0739c5aa
SSDEEP 24576:qgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:+b5+Pl6bJTIZ5jdgph
TLSH
T1B26523824D6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C67D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 d758f08f4208e836ff40aeadd0bc2ea003fda5600df289ff4411d54c569b09c6
MD5 0793314e5ec45694945663050b878dbd
SHA1 b357ec1a81f28f62587e8ee5ff9dca25196d0ceb
SHA512 ebf8122537c740e73eb2075d5f4aa0253d1b1187bbb04ddfc6a392f7e4c079a44c232a1b66d3272cf1a95fe0687cc88a9874f71ec9677af5b9d93d6fe5a389a6
SSDEEP 24576:MNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:9b5+Pl6bJTIZ5jdgpu
TLSH
T1566523828D6B20CAE05B5779D9C9DB00F879AF57DD8727B6C67D082BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 297b14940f035e7074b6c3af86b392ec9436650f8705f735de66a9760f5e50e6
MD5 e7f4448e1a3a7a9041e096d5c3fe4bf8
SHA1 0f0d12c207ea056fa3f8a597b65e977d5a12e127
SHA512 edbaa56dac2df21a5306e4fa6f358ca245bbea98e75317a10bf3d3f172b68d2f62e406c67904aca4b46a6a1e3b4b3636b9fc56bcb6dfc23a76475e11076f811d
SSDEEP 24576:+Imb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:6b5+Pl6bJTIZ5jdgpS
TLSH
T1556523864D6B20CAE05B5779D9C9DB00F87DAF56DD8727B6CA7D082BF130789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 f96662ef9fcfdb32bb36b4d913e8c3f2e25b9baa76e899dda0c10ae4affc14f3
MD5 3a6a5a971e25297c8e1c29b93dcba163
SHA1 036d513f06e313d5a04e1e1772ce42ec40ef9d64
SHA512 44d37fd0be761c6d9c89311c19d335096f45e6596a622f773cef0dd5642b00d1ca8295adc697581ca6c9e1ab138e08f8d9e1fd46a88f545e2fe42556f4138948
SSDEEP 24576:Z6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:/b5+Pl6bJTIZ5jdgpm
TLSH
T1216523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 dd3ecb4f7b1d50926e98ce4050b30ac16cdaa1e6c72850e26d4f2eeb6534c17a
MD5 5f72adaf297a9450c2f606297f6fe34b
SHA1 d582db80788c3f7cbedcd106598c688fe1fb149e
SHA512 69cb45811cd743c2fb69a82269f3738d673341f915bfcade64a894c406ef8eec505a1336dca3075d06afa6d7e9e21c51beecc990da5846e90ede8266ba8df1af
SSDEEP 24576:ZFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:mb5+Pl6bJTIZ5jdgpS
TLSH
T1FE6523868D6B20CAE05B5779D9C9DB00F87DAF56DD8727B6C67D082BF130789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 be39dd3f148dc8cf646b1491d3b152cf8dc8ba3cb07ca91b1d07640b65fd50c6
MD5 da97fb1cb3734404d6c5d7ab9f76b402
SHA1 db66db2787cc070f2da0306c5f1424930099aaa3
SHA512 ea20b157c6cabee6562b0ebff429c5b12303f1a0c451fba5d2688c0c31186d2f6ac7c9a3abb044ef7543fffdb7568d735c50e0b54eb60f923393cf61341adada
SSDEEP 24576:W6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:Mb5+Pl6bJTIZ5jdgpm
TLSH
T1CA6523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 fe9d5c915e1f0ceb5eb4d6c472326ee0f2834039a83825fb9f1c6afbacc2a475
MD5 20b1fe3210bf6932345a6d21680f62c1
SHA1 78860e3d9a0d2781cc1da10fc04f507f37782c61
SHA512 b3c157eaac3c6d9568569a5e9a2adffba26ddd459832b339ade9539616d49eedfadc019f05b3c74c1981f9b65409aa0316c3649f0a5cf0812c81c2732ec0dcd9
SSDEEP 24576:2fwvhk9RX6wkyAI8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:XMnYILb5+Pl6bJTIZ5jdgpc
TLSH
T16295CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d6bd0bee72472f90d8adc7713b433b1caebd04fdcd957372f40fe4907156e1d9
MD5 782a0f144299113c8ffdaa6d7d37dc3c
SHA1 e135d985aa964b0ecd98a0ad1748df1f7d2f93f9
SHA512 bf1a2349d6a074cf74706e998a539b970773316bc21f1f21380fe4b6c567c319b6c24ed28c090e3e1999dcda5faf9fad1a180c840344288f7938b1a1bd552994
SSDEEP 49152:kYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00b5+Pl6bJTIZc:bySzPKslgJTIZ5Bgp
TLSH
T169066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 73035639b08ddb9a92da7c9839567a50ebde8440f79bde787f0796cf6bb066e6
MD5 0c93e3738f662c5b0309f984b817ae9d
SHA1 8132c96ac13346b6d52b40691df5a5e3d8937a7b
SHA512 9c0ffa79e553bc2502ddfdd403d6692dfff836a219331ade868612339c5a3592b01798733d803081dbc8ce33ab77bd26758ad9c726752b2f4a6e8b7b0b673b9a
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY/mb57GBiOl6a8JTth/RWZvR6wQQ92Y:447JUQjqirIhCnDHUPfF/kb5+Pl6bJT0
TLSH
T1C565AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 c1199bd88e476591f7ed0f3a438a9c097320482f31b21b3824458b3300df7ede
MD5 287c2b78c5aede207f18a4467d23ffe1
SHA1 2f103c80092160e0b47a3264fc12e41633e52f96
SHA512 910e0cf2e98ed69872bf47299b894d37bc481c826165cbe023b874c66773aafeb5fc60cebed15a57a9e98f8f45d9e919cc32a3e691291cc52bfe6e76b30962d0
SSDEEP 24576:Fwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:tb5+Pl6bJTIZ5jdgpe
TLSH
T12475F14AC29811D9D06F6279CB858A00F7377D658BE2A3DB46E0F43E1F356846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 a489b54ca80ec301f8eb850bb85f29db29a7a603a1a099a7760b5c0e35b5e5cb
MD5 942b2a1734355fadc6c312d5d557d250
SHA1 3e16427fa99f08e9ac89cb446aa0faa74399de28
SHA512 d80fe97f8533c3d40aaa1385beec5cb7305164db7c498121265aa0e07683198c54828fe82ac01abecdaeaa6883d764c537c38b03d408cd842d1250a98887057e
SSDEEP 24576:zBaVUPb+FZxmB1tkvlwSrryidG7gTTnHZxqdA:QVUz3PkvWQVGUTbZx
TLSH
T1E9553840762AC79FC6A950325E36D6CCA7707D01FE056F0773C8873F9476668BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 773571b9e39800a1cb0a5a9d6c428057253feb044de5f55e13ee3750b833d1c9
MD5 eaa9708239cce9a99c2e1714570b188f
SHA1 821297ebab82add95d9cc7c9abbcde43a1429e5a
SHA512 3d308a22a6cb00725ee7c3aa80fa9bc065f56602d5833c9c98121ecc17352aa27c0415630bdbafbbc89586e5804b2596874984031cb8396bb991c7598a6b27ce
SSDEEP 12288:QUue5ZnN/wfzTuhaLUz8eqqQeCaBOlbsw35TWqnF3Ht/DvQudwKAt/A:QUueWryI4hilB8uiKKo
TLSH
T1CF553B40A5A7E75FC8FD50374332C68EAB746C16B7453B0173848A3C9877A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0e8809ad4d1559b0af24a17377f4dd6848bb7ac1410efdb8ae918d713f976a01
MD5 9013fad35b735383f45596060476922f
SHA1 d49d39d7da968c94c819ab17cf6756e66c73a5ce
SHA512 d3877b818c54e280e87335a58ef333a466d7415ee4129891b2288505fe2881e2cb7ae5bd82fa0fb60f3780ae5ce4b4d48fe4489a6ed7d18a5cd71a9b8e514a77
SSDEEP 24576:6Ymb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:6Pb5+Pl6bJTIZ5jdgp8
TLSH
T1586522428B6A6086E4AB5738D8CDD710B83EBF65CF8566E7C579142AF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fe85602507a9daea70f412ce96bce8b2800e7c2a9e2fbae804447c911f415cf3
MD5 30954693cc1e16a394fd25fc938d3917
SHA1 939545501ede0a7a2ec5ec97e79a0fd4ed26baec
SHA512 f6e0f14ffa68596bd82631456055f6989c43c460a1c20e0fdf36a9cd91da287fa3df2d7c91eccd0f8aa1ca369c1f51fb01b0cf09ddf2ab382ed0854ebd5d0346
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bY2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:Rgb4mBIBhGF+b5+Pl6bJTIZ5jdgpw
TLSH
T19A659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 7214f38a6de4f0852ee94b2d209f8fb88baf1fc517ff2fc97726c3a25abaf2a4
MD5 7c6f7d956b364e1378762f72e6916c51
SHA1 ce55e60a2ce64175c8fd3f58376f75c87a604c5f
SHA512 27187263d307818d40e28794684ab82b30bc3200d7593359c454a9abfe19df9b7df5577726680345ef4fba98c0a3922794eef302ebc05bb0801c660d4b8acb0c
SSDEEP 24576:cG88u8FpJqH1ozria7/mPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:f7ZFPqVXa7/Bb5+Pl6bJTIZ5jdgpy
TLSH
T18195F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f81e47c289f24f8db7bf8f98d91fd7d915825a6a1fc0cc30d3342819d4d24fa3
MD5 53c6eb9005f45a7e1d63ef60f3ddd6b7
SHA1 9a3b0f322653bda50d0762a147c5708abdb20915
SHA512 8b6fe2b3ae638a4c1f9413378e2776cf273a376ef6fbf1b7d62880c0fbbd7a5be2ac924a1ccd97302717eb2ce210ef1c85f59b06b1d29e7cb524c2fdc6830e44
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKb5+Pl6bJTIZ5jdgU:DG05lO43b3slgJTIZ5Bgp
TLSH
T18CD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 39f11237ae0a0b28296bd117621fe131799e1f5b38364b41ad9f06206eac9253
MD5 910645c0bfdfaea31be95ad309013817
SHA1 9da45c80819d664f28de4c68076e155430e549eb
SHA512 a914f8629a7cf1f872f96f38bb8dc969cf2cf218c50db6ae07a3b3b2a00c6061f832d9d3444e96da3f561298cb6d52fa588a70382f3bc52e6c4a45a3046b32dc
SSDEEP 24576:wfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5mb57GBiOl6a8JTth/RWZvR6wQQP:Ia5POZ3lJt2pasx2+mCb5+Pl6bJTIZ5F
TLSH
T13965AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55a39685988df7e772c318619b30156704022c3385210b0fb98726409745301c
MD5 be383806f7f197af64301085d1c21587
SHA1 9b1380350cbcaaa41ef913948b2d36c136482333
SHA512 6024b326258dcadd3a362c74950231aaf98ae90d982bd3d324bf467a4fb633926a55a5b9a1700242343cb94034cb3abd227b2ce3b59b006d6db74745dc4955f2
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fknmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:sNc/zEOVHFhb5+Pl6bJTIZ5jdgpw
TLSH
T139858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 393c1742fae8e43dc976e5195c7e5de3c69c9e35d5bb103a16fe71901f3bf97f
MD5 7f0be200a1fbef89dca6f9e5135db0d7
SHA1 dbb6502758d857216d8fe72b784bbde4c13ec302
SHA512 7d938a16570160e401446d7a319392e382553d1ee43c07c07ed97e4bd644bf547f21a3f4cd3ab8c20dc5f631ab1f8a0a0a83687bd9d518125e68d91e5f7cbc84
SSDEEP 24576:jzkNvNnaFeYhJNtmZBmFmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:jzMwBtOmIb5+Pl6bJTIZ5jdgpW
TLSH
T17E55AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 795273acfbb2ff0b8757791b120cf812538d0d7763957b8326c149887923bf61
MD5 27fc9a61ea256ea23ff7de2bdb4fc3c9
SHA1 83f8945f115c07fd2ff6445df3e43dd8b2abdce4
SHA512 8c485166e61a8d03d74de75344381181507a3fca4a539b6e211c8a15b3530dd4c23dea7e09f43e3738c49590af6c135fcb3843ded22c5740aeb81c3f4684ae00
SSDEEP 24576:lPUr+NQjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:lJQ6b5+Pl6bJTIZ5jdgpe
TLSH
T1C175E11F26AD18E5E57AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 d13f06c72c94420066688991de192b2a166c568fdf9b37b3a2eb91117e7095ee
MD5 28c3f5a354bc6ee38bb54eeee61e5948
SHA1 3ba22b3d818c372e4dc4f4bf0606c653f8b799ff
SHA512 69272dd56b9b06397ce822ab9766c177e5e73b34b844335e148d60ab06bcb1255cc6e09f5d4b1964366d88e468f63d427d716bb4f018b1a258cebf0ba10c4eca
SSDEEP 24576:rD3FHshBIYQgAUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:rDVHeBIAAjb5+Pl6bJTIZ5jdgpu
TLSH
T14785E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1416-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1416-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1416-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1416-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1416-366-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2320-280-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2320-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2320-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2320-54-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2440-1-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/2440-0-0x0000000140000000-0x0000000140139000-memory.dmp

Download

memory/2440-9-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/2440-315-0x0000000140000000-0x0000000140139000-memory.dmp

Download

memory/2440-87-0x0000000140000000-0x0000000140139000-memory.dmp

Download

memory/2440-7-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/2440-311-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/3296-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3296-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3296-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3296-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3516-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3516-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3516-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3516-375-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3516-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3516-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3620-295-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3620-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3620-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3620-65-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4160-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4160-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4160-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4160-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4272-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4272-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4272-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4272-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4536-126-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4536-137-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4536-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4536-132-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4568-52-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4568-50-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4568-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4568-46-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4568-40-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4696-399-0x000001ACFB7C0000-0x000001ACFB943000-memory.dmp

Download

memory/4696-374-0x000001ACFB7C0000-0x000001ACFB943000-memory.dmp

Download

memory/5364-77-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5364-83-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5364-310-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5364-78-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5804-370-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5804-113-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5804-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5804-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download