ac4be8c9e4780ee0ecc400aa8ac13fdbf0e40f515f38e30f4d41d55e14d83aa4

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
Size 1.7MB
Sample260804-symjmach87
SHA256 ac4be8c9e4780ee0ecc400aa8ac13fdbf0e40f515f38e30f4d41d55e14d83aa4
MD5 66b7163781f4e3aed42ebb832c525fee
SHA1 968d0ff667b4b9be1d865468ca28158f3cdce949
SHA512 4cd144377d43453732ba816cde6a4cb1773f02bb1ce03b71bf3a992803857ac3dfc781852e02be248c5dc702ba29dd817ccac8eb03c886c6bef2324d597348dd
SSDEEP 24576:lLdgMU71Nmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:cMEeb5+Pl6bJTIZ5jdgp
TLSH
T10585DF06A6A518E5F8F7813D85929537FA7E78414364DBFB02934E562E23AFC5C3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4704	elevation_service.exe
4568	elevation_service.exe
1364	maintenanceservice.exe
3448	OSE.EXE
5568	PerceptionSimulationService.exe
2960	perfhost.exe
2596	ReFsDedupSvc.exe
864	SensorDataService.exe
2396	ssh-agent.exe
5912	AgentService.exe
1240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1850814e238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007e8f7a82624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024da09ab2624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bccf6a52624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000567500a82624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4704	elevation_service.exe
4704	elevation_service.exe
4704	elevation_service.exe
4704	elevation_service.exe
4704	elevation_service.exe
4704	elevation_service.exe
4704	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3368	2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5912	AgentService.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: 33	1240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1240	SearchIndexer.exe
Token: SeDebugPrivilege	4704	elevation_service.exe
Token: SeDebugPrivilege	4568	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4768	1240	SearchIndexer.exe	100
PID 1240 wrote to memory of 4200	1240	SearchIndexer.exe	101
PID 1240 wrote to memory of 4104	1240	SearchIndexer.exe	102
PID 1240 wrote to memory of 2476	1240	SearchIndexer.exe	103
PID 1240 wrote to memory of 1204	1240	SearchIndexer.exe	105
PID 1240 wrote to memory of 4836	1240	SearchIndexer.exe	106
PID 1240 wrote to memory of 1892	1240	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_66b7163781f4e3aed42ebb832c525fee_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1364

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1bb606c1924c82ed1b60eae1d22fab95ccdd640f44d8a61ce39dcaa0e9a8263c
MD5 350021cd41b31a1bc80222ec1e100e35
SHA1 7b42dd5cf7ba6b7898af400d7fecdd4c4d357c3f
SHA512 7aa1f58ea4d56ced1b549e66f15d8327844b61f8c9346808c6d816137c30e36ca3a55e34bd2747db21dacfb6b9cc928fa50c12254d7ed0aff461b3a91829cbaa
SSDEEP 49152:7b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnLb5+Pl6bJTIZ5jdgp:J3q6mjBKslgJTIZ5Bgp
TLSH
T125D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 2d5e1764c7733a61ae30fa45b33c513a9e6fc6e277ebe6a7e7d4b21d261ea5c3
MD5 3aeeacbed05917ff5773d0778915f435
SHA1 2a05ef8ea351b688d508906825d7cf0cd4f48a26
SHA512 0a1355474e6cf4d3aae4506815ff82e68f7cbd82a970b6e77d7cbdc0a3bc2eeddff902bc26718639427fbe0a178e2e8a1535c33494954fd8e78957251fddba03
SSDEEP 24576:SXYfDtczAVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5tcNb5+Pl6bJTIZ5jdgp
TLSH
T19085F11967E508F9EC67823DC8E1C611EA73B85587A0E79B03B499265F333C86D3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 a1c29494321233767136a47da7db52e688811f2cbaf4168d34a81abbbbcf1dc3
MD5 3fd580bdba4528e75dece866e7d892f9
SHA1 c145877f32467d3100fd69290939b7737838bce6
SHA512 b30de45bf3874e09797f5b32440026933ffbb295580adfe15e93cce3306ddeb0ae71530727d9c95955ec0d8b6f0fa0a2095c0f591b232507d30a8172b0f9aed6
SSDEEP 24576:20Le5ji0hmxyrMkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2Pji0AIub5+Pl6bJTIZ5jdgp
TLSH
T17B95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ca3c0a50f9a3a64a16b9108a81a19dc791f01d97e41af6fcd9b3675086c35b5b
MD5 ea41a3a1322a72ffa5e4326bdecee13b
SHA1 4ebce73536c46aeeead141ead1e632b97915b42c
SHA512 c273ddda1af6eb7086246b399d84571b06f170424118a079f9c3f6da6c44b5c3a1b039f24d6d921b7ab7b5df49603d9c9f4644b0455050d21bfedbc955691be0
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWj6q8wyuSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Z/ezSC6vUzPv+Hjy6b5+Pl6bJTIZ5jdw
TLSH
T16D756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b272172df6d41d1f3d0244d09d5e41ac6407734d0b459e02474aae10873a4479
MD5 4c2f4d750883d7d88f6c9f89e363c683
SHA1 38808054ede6a69e06ec57726f954ad15de3b688
SHA512 7f43c9e79764f196879cf5de5062db752621389d05bfbe87587e1da0b041c9cf82ff53029b2a171d307ed1f39fb860eb8024af25f219b07aaf61928078d6a27c
SSDEEP 24576:uVbqPb88hv/l+Bhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:uVO88hXl+Ob5+Pl6bJTIZ5jdgp
TLSH
T1F3559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 8098d7edcb43f6e840764332e7e3d762b625aa021fd2ed1c34eca5d94e9415e3
MD5 e3764a8437796bc296951882260935f1
SHA1 47204163480fc4d60c614b214f5608563b85acab
SHA512 2340a4a703180bc1fbe341a48c066552dc91127b28c0bb8218d7ebeb3fe4bf6768a2c50ccd72f8930cba6cb6e933aaec1292613f656e7d02e2ddb027e1ff7865
SSDEEP 24576:LFAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hb5+Pl6bJTIZ5jdgp
TLSH
T1C76523438B6970C6E5AB1739E9CDDF00B87AEF55CD862B76C5752C2BE034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 2214ef47eae6c7076d8ad5f79a91948732ee82568953a96214815066091f4954
MD5 ee87f3ae62237b47c9b2f202f517a8ad
SHA1 3723773388b832d1be9920baf0ef6da9292c0b5b
SHA512 4343fd026aa913204b84008e0343aebad7d168a01f3a8ee540623aecb9f57b90540bc3a42f1aebb0029dd82d95b0daf6a0c48ddcfe28798e276e1f38b99ecb31
SSDEEP 24576:YJIUpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:YJIUkb5+Pl6bJTIZ5jdgp
TLSH
T19A85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a834a381b9bcf0d2f584f0ea933528d1b4e68e82d7d2151620fe28579ce5aa07
MD5 2c3cc4cc2c38adcf3410332180ebc67d
SHA1 2c25f1f20b1cc4ee0c1b933ef9055c9b21229d49
SHA512 d995eb62e37c3c09810b1b812546398e35fe7e14e08a958d64af6dc892f489dd56a0ce084f53fb2cf3565985fb6cf5df7c4e5ee1fb72ecc307aec7ca2de9e6c2
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THU:EQvGAdlCEL8c/WRNw5C5slgJTIZ5Bgp
TLSH
T1B2266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 23a23dab4b3b783c6906a630d2814e7c04b08fa02ffba5624b896d7f2719e85e
MD5 92ce3c3da4b7a75b61f4796cc746f347
SHA1 2f8b25ae5274800326cd6e0ec7e66be1000fd872
SHA512 804de88e736faf261226d9b8ef2ed72a69106d281aeead1de6314be9cb31d1810c42942e4c66c9abb02fe61961446fa33b83d7a169ce7f8a8869646c85b56bbf
SSDEEP 24576:BOewsAj/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8lj+b5+Pl6bJTIZ5jdgp
TLSH
T1F485E031FE74E036C2BB0DB65B65C706643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e4a3ec87dc6e89e5eb02559b1e7ced7fb66752eb3787e1fb803214eba50cc1b1
MD5 3fb7f88ab47f7ab9fab23859dede246a
SHA1 2d59c0769ac6f3c69ed595cddd193fe41bf4a654
SHA512 c5e17cbca3050b7901bdff864d23bad91660bc38b1fb549ff12ee08f96337eab26350a2d1ce84195a59053de604ac40680414766ebf535ebf813cdae7d63d375
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHMsT6p:PUEtQevvqc2W1cpV20I32Ms
TLSH
T16B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bc3fc3790cdfe8b860dbbb3594581094285c8eb308641b7e74fa6223c2676223
MD5 62471ba648b31120c9d880790de6db53
SHA1 72127db4e7682facc08d1fe56acb275436093972
SHA512 3297ca4f2832d70633f0b5c8ab36a80dc7bb008a7d363823e1ef29af7d483a87a90ec53f1bf83d85228329f1d275954020aa64a6bdb6d9dc8dd01d55d9f0a923
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zeb5+Pl6bJTIZ5jdgp:WoqtVjnm1slgJTIZ5Bgp
TLSH
T1DED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a1865ca1f993deb1c52d427fe9d21e8774157785d6a309a6bc31f1bdfb3e182e
MD5 b95b53599bbd5d6b15f45b4acc42b5d3
SHA1 bd43a81790f82bac794985948d9f31eafe52efe5
SHA512 42459eccbe5012f9440a73db2bb85da54b43d6d7a7ebd31572c431e834c4aec2d6d157ee9681f62031dbef3fb374d7f2af83fa945c14885fa9cc454d3945f770
SSDEEP 24576:IAhGL6IFoiwtA5l7S53Gmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:IAM5Foiq55b5+Pl6bJTIZ5jdgp
TLSH
T1BD359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 fedebad25db2b864903ab034271988ceb32079f49dc4e007cfad1b08e835c366
MD5 977f97ed2b78cf14976441d1916fa6ba
SHA1 5b335aab69448b4d9b37a05937051d8acb1b2bd3
SHA512 ebe1c6af2243a87dc4f1fcee25be36f1757a4599b6ac4e2feee0e2cc38adbbc4e5a97bf9db917271c773487a01446942c2875af143fdd089ee7646ac8c8041b5
SSDEEP 24576:GwuGOWDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:GwNOFb5+Pl6bJTIZ5jdgp
TLSH
T16975F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 d197a17d5f9ef643cb5cdaf82530a6d690f4ed9143dfb05d0a32102fefd2a1a2
MD5 966cecac2d46f960dce1da2cf8d1f4ba
SHA1 8af98504a2eecbb971256a5908cf3dece52616f5
SHA512 b53fc01e601155419a5556452d2c7fbd108ed29168330bf9cd95776be1e244ec1542ca5bab8ccd75eee0a0fa4d3dc0d41e15c50645aaae7ca57efdbdb3143b4e
SSDEEP 24576:sZuMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:xb5+Pl6bJTIZ5jdgp
TLSH
T1A065128A17A830F9E1A7533DCCE58B00E772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3f5529be4811405505c554c502202a82b77bf8f43040a5fa760998d3135eb6b2
MD5 893a364e44c1291de3a7db45baf4d8d5
SHA1 d119e170d36a08530ce254f18b1c343e7bf05aba
SHA512 470a8d359246d18622967c14612d558cc59278795a382449856b8065df8218dc37350bc9f02ef833787cb758c4077ba5e203cd9f5e6a792bb879110407d25bbe
SSDEEP 98304:GQRQyi36YOcPDLvw2gAf+PN3uslgJTIZ5Bgp:tQyiKanX+PN+sT6p
TLSH
T1CA666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2866fdf26c92773432b650c3cb2560544bfa44b6ab2aadd9fc10a2a024a4795
MD5 3835190926378c16f5574f61d999595d
SHA1 e5cf9cdf9630b016e1f1babf41b1c99e6199de90
SHA512 7a259c711441668445d0bd123a49f0670e6827202aa9082b18c6b6c90f6720e2e19cb6d76eff793fdc6be07a4b61f85b603f24f784b4734dd0690110b30469f6
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3uslgJTIZ5Bgp:qQyiKanX+PN+sT6p
TLSH
T162666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9ed4033e300518cf84b016a719a1720bb9857ed044e53b93451ddb105e78cbb6
MD5 37617e8346db79717d9d3d1304e39597
SHA1 65afa1df6de689020b0cf1fc07b17921cec77112
SHA512 d7142e02b2f5545804feb219bdcdad0449a99baf3074de134c5551ecde0fd3f2ee2c10f7d9d087d99dafcf748fac24fb69458405817f128d1a4eed70994f14ab
SSDEEP 49152:k68Qg55nhkeWu7PNU3/ub5+Pl6bJTIZ5jdgp:OthTRc/UslgJTIZ5Bgp
TLSH
T1E6B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ea0c017389672c00e52dd4dd147961b42ae43e2a0af7bd67aa74096e4f3dbd1a
MD5 ba3276a62f995e8d93e8a56afa805cab
SHA1 fd9784459d05ef98bf566a360762eaf4cfbe109b
SHA512 04ec6511810697c78dfbe573bfd50e0dac83253d9dad9f0024367041f23ed8d9d21cf71d53a68404ad4d4b8d7b233cad684b3a85eea0699e2d38270a2ef5b58c
SSDEEP 98304:Ny5112gYy5azzVvU69nLKnhZLslgJTIZ5Bgp:wLIHRWh9sT6p
TLSH
T1BE167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6e9e4d2900efadfa1c4399c4f8cc3e3c480d9d20f0ac3d11c8216f721f7ba1c4
MD5 985c8f0c5e4693c457f1a39a3a26529f
SHA1 23488452145571102db9a0d7b0de4f431ff9bc13
SHA512 9339ededbcf2e2f8f67525946ef39ef726309e1e27b648c1e9fdf09aeca0449953420268879fc5c09be713580abbab965a5b694b1e68c98a140b18c26f0b8ace
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glIb5+Pl6bJTIZ5jdgp:Hu6JmIxd2dGslgJTIZ5Bgp
TLSH
T1E1D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 58b7e1f007ebac7ff93eeeed5c38caf4e4adf6053d8216f658a7fde71e52c88f
MD5 99afd90d193d8294a7aed89ce7e1c04d
SHA1 714bd18bae3216f7966e308e15aa4b3a91d93b31
SHA512 cfd497cb7203bbc8e024a64aa0f0db1bddedbfe9d380eb204bee3432a13a7c9cc3767788902e7b06612982c3e90a4643a461a9b36ad71a92b1e1b8dfdb23db8d
SSDEEP 49152:R1hpsNoJpF1A67U44CwH7R4xEb5+Pl6bJTIZ5jdgp:RmifPqR1slgJTIZ5Bgp
TLSH
T1DCB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d9c853eb174cd877f888d557e610bba1b4af2a3f92ffad47dc00b05b71f408b8
MD5 2402d8b8fd05f0f23f7e90534a8e2c44
SHA1 0ce347361e916f5e770124b3072418dcb444d4f2
SHA512 77bdead6f599ff12c8e6b4284af652e94e96cbad3431c49f5404dc895de5a169a3f65b1f539d38830390a07edcdc4bad60787c6aa803db9177e962688887d1f1
SSDEEP 49152:jSuZQIY0Be2KkRVtOnks6NMHqbb5+Pl6bJTIZ5jdgp:B5dKqi61vslgJTIZ5Bgp
TLSH
T193C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 87bb4c0a4d7bd646c4df5e6f59d3a6f5fd202c0dfd58b0413a5c7cb0e4bce108
MD5 0af5a7ba7ae21e759e47db9840de470a
SHA1 8b567e7b1a3cb191913dc41bbbd8d21f2c1315bc
SHA512 c3c9dfb390f832d077f8a887b43dc76b30cee3e2526a979de9f2ddb4b3d962483ec3b4143eccf76b5f1fe3ba836c2a09c1276b5952a96dd1cbe223fc979d29d8
SSDEEP 49152:QhtSn8EApI0figjgiDn0AP5wYb5+Pl6bJTIZ5jdgp:BX2iWphhslgJTIZ5Bgp
TLSH
T15595BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 478ddd0510ca5e04cfdf91cb7084c661938942740cf116deed2ac826905ab780
MD5 80648390a76c3634963972157f07146d
SHA1 e54bf22716b96500a921eb99c11bda4b860985d9
SHA512 19b386c905fd9aab4553906f64cd11a8d3299cc284a287a4261bc61ab773b385863d037f855d81684b75a72e8c9ec85205742b45730cb0110aea7f37a1416c1d
SSDEEP 24576:5omb57GBiOl6a8JTth/RWZvR6wQQ92pN3:tb5+Pl6bJTIZ5jdgp
TLSH
T104652347496B20CAE45B5739D9C8DB00F87EAF56DE8727B6C67D0827F231389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 105bcd975939b9f6b5f3e911ee3711e30ae5b111c38d67cca3df7701a9c8060e
MD5 6a90b195352a89bf6186bcabeca89960
SHA1 8c222dd22082653bfe8667d660bafafe39004c3b
SHA512 375bae52ea5ffa8bac16374a84237beb87faa8b2a4fa40a909474c40f5ae1f56eb8183f33507b049631b7a19602f1702e49e78d33256649f2909f6728b0f6a9e
SSDEEP 24576:Sbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5b5+Pl6bJTIZ5jdgp
TLSH
T16A652347496B20CAE45B5739D9C8DB00F879AF57EE8727B6C67D0827F231389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 cef151a07f7ee0c0b3ab6ac4c64826230f62e792a408a584b896e16c0e24cf09
MD5 15b14f2b8be80c264076ac3e1817b9f2
SHA1 478f579aaae1d602ec5528fa1182553e0514515f
SHA512 c33cb058a6cc6595c7443c5b33b5b1167c857241cb107c1b7da2c48d9dcb88584d05cacb2ffe9d9c734b79d8e2ebbfd8595f318f8925374107159b3bfdebe682
SSDEEP 24576:sRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Jb5+Pl6bJTIZ5jdgp
TLSH
T163652343896B20CAE45B5739D9C9DB00F879AF57EE8727B6C67D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 94ed3ec0933c76cf9a25d8fed757c1f4d250ad12464e1fc07e7cf44ceda74637
MD5 995779e4588ff54ea92dc373a40ac97d
SHA1 33438085dbe7cc0598503984886b1ae86a1c35d4
SHA512 ecdca2d2d7a594e2b5cfc23443add9475df1578973cd46dfe01339796bafaea9526ce06f572dea09d4d3717a9efcf3e75c5aa1854156b76cdabf98236bd37a0b
SSDEEP 24576:Dmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ab5+Pl6bJTIZ5jdgp
TLSH
T1696523424B6A20C6E4679339C9D5D700F5BABE95DF5267FFC675082BAA313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 04d8ec04b04d845bc71a88699c93bd131a3c33e9774539e5ae661613b7b4e601
MD5 5c694aebe6931830668f104d545e136c
SHA1 436a982d3ecf60f3412fc1b19278b5aa47011b79
SHA512 23c754aaab27015e79d59568024c45d04fe9e5edfab05f47cbf533160757277317508929e30bdf0023fb3215b70757db63f3e32fea02442af1c9370cc6f89ded
SSDEEP 24576:demb57GBiOl6a8JTth/RWZvR6wQQ92pN3:vb5+Pl6bJTIZ5jdgp
TLSH
T17C652343896B20CAE45B5739D9C9DB00F87AAF57ED8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a25f7f2bdcdbe6c7549dc40dc717fe0d08b03f02e4dc60084a4c52b64719b649
MD5 d13d38e1206dbf7a1a80ca29a98e5a58
SHA1 767f6cc783b1d00f6ee38a1b4f27b2e38000ddcc
SHA512 6c58954fff3d3bbcbc6340dba7ef54af45417a98898d5cf044594467a3e75bcf9dcef6bc152b43510b430db48078e77bbaf16667210d4ebc0d2f42d73cf10d73
SSDEEP 24576:/Hmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ob5+Pl6bJTIZ5jdgp
TLSH
T188652347496B20CAE45B5739D9C8DB00F879AF57EE8727B6C67D0827F231389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 7d9e55a1ee3eeaaf0d869533b88fd8aa9e95fbbd32c354f3314679cdeb3ca831
MD5 7674a9864fff0d66fda4ed54f0203513
SHA1 b6d0eedfdaf0507ce54cdb9318562552a31153de
SHA512 e405747cf247b4bff2487a58ff8539ffa04721278d2654e7ee44ddcd6c6e2128490544f8c1c432213f5101322b581a84a503efeabca6baca4d793dbdc54c83cc
SSDEEP 24576:Czmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Bb5+Pl6bJTIZ5jdgp
TLSH
T1676523478D6B20CAE45B5739D9C8DB00F87DAF96DD8727B6C67D0827F235349381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 e541293596222e3436530aa5f5ee0e85ca53ea303bcf12381a684435abc0615c
MD5 11910ab82840cf33c9b5874ed611e2ec
SHA1 32bd9882c64b612c0509ee3becba205d49611eee
SHA512 a9ac45439b4552958dc2b7cda1f98c9d4731cf4cd5b1036fdb22f273b01dcc753d18b4efcafcd2d25cfe8c951e4626882808d9a32989692438ad06cfbe512955
SSDEEP 24576:7ZMazFVSO7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:7ZMazfWb5+Pl6bJTIZ5jdgp
TLSH
T1BC85F295B36018F8EC67823ECD958A05E5B2BC5A4B60C65F43B836275F333911C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7fbd7134a50c8cc14b8d1577c5ddb2e706e271a78c8ded5be2833c9442637360
MD5 d380245232a8f212f5fe3eb9bcd70a9f
SHA1 7eda33542b7539d66ec8595e0b5010c136200a8c
SHA512 1bc901ebe542fae20226cb3f6113eaab27a95402c0ec7895a1824a0a5427ccd44939f68ce71ee8e77e2b036dd148e060470a1e017dd29267e19ca16c0a360b31
SSDEEP 24576:Ncmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hb5+Pl6bJTIZ5jdgp
TLSH
T146652387496B20CAE45B5739D9C8DB00F87DAF96ED8737B6C67D0827F135389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a9a0075b6fc23123a96e803495f9e753d046d035888915add675841521576cf8
MD5 47064b0687a4a01af65a88bf48047e1f
SHA1 83ce9c8c2582e2dc26670c0e487ae2cb73827520
SHA512 86fc3e364b00c521d59010708fafae620f6f5483b8a0cf779bc2c4388d29406099ba82eb0dd9bbb4eeb7e1adc8a63b9457b9bab20905c7757b5c814498c57d92
SSDEEP 24576:/Qmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:fb5+Pl6bJTIZ5jdgp
TLSH
T16E652387496B20CAE45B5739D9C8DB00F87DAF57ED8727B6C67D0827F231389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 8e8f828d7018c68e7fbe0cf37d7853b3806ffc3298082c26bb36eebd7d40df89
MD5 cc1018855cebeea5afcc398d1e2f8110
SHA1 0d5542a34be2ffe4efaaf187edef85ad1fce3118
SHA512 efe8ce8a56fe99cb4fe808fec2735fd2f2a4255f21aa1e2c2cdd2b5b813ab7d42ba170acfeabb594a1a6af7f8e459e8cd5553d5160725005c972555df77e7046
SSDEEP 24576:qzyPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qlb5+Pl6bJTIZ5jdgp
TLSH
T1E675024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c86cff8b80665181c76e204870fee27c37b7c7e6b355256495fbda4fcf738c27
MD5 8b755c213bd6751edc9c61f835e16f13
SHA1 e7fa7b910bc787c0f7ab8895dbb45335093b5d1e
SHA512 d7ab5d9db9572aefc0e088777c8ffd2b413e808b5a702760c93f49d3c3e87d78562008e5350d8c0bd28241dfa41321ac6701b1dab9aa800d116c355bd73187c6
SSDEEP 24576:scmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8b5+Pl6bJTIZ5jdgp
TLSH
T17E652387896B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 3ec386b42fc772f27cc6eefac9681f8acc97e8cdb2af02cb199ddfa76e320044
MD5 892b070d50e919867e6a8cd350a2f10a
SHA1 6285d2078c13a789b0610a5003de340a842f3120
SHA512 8f28f278425af89b91e5ee3e0a97646096ec90bae909e07125f2e7fdaa40f388faf20c649135a65547eb5ed965b2310f0c8799a81f69b09540424192ca47ebae
SSDEEP 24576:fcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Db5+Pl6bJTIZ5jdgp
TLSH
T126652387496B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F135389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 eada2d66b5b33f99553ee18860800975fac1429527f371befb666ca10f4ad698
MD5 7f2e006442b9536348cb4ad3438b011f
SHA1 ba172074f2e104f745fd14e8a8d3002a62887ec4
SHA512 7dd6fba09b7a74ab361b1076635c6977b9e2c60676aea458333470206790da29238e5e11bdfe3fcc09044f6237b56d22414b3133eda6c96bfbc48a4e24632f48
SSDEEP 24576:XzyPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Xlb5+Pl6bJTIZ5jdgp
TLSH
T18475024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 7ab54319a045cb68228f5361013f769dbb4a39716e3e3c4ce654ba1d04e6a6e8
MD5 04cd19101621662d9db80b2f003ca8f0
SHA1 8e4937327f6afe44fb0722c4d15b0c06bc9930cb
SHA512 577487ad4c62f11b4b51e3d53ce6b1488fb55da25701c405f0081fe37f89ac154cf84e2523a44c2cbca0e1c79461362074d5b1ec29d4ebba58daae793f677560
SSDEEP 24576:QT/aLl3z0zDBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:QTiLljdb5+Pl6bJTIZ5jdgp
TLSH
T1E1850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 ca40f8d1da255fee94e5acb453bbff2d2fd53511f04474d3b763222b33e22edb
MD5 505555dfa0f341320bd345270ff2c6c3
SHA1 ebf00b3eea00a43e97ccb9bb03e69dfeb77e2364
SHA512 5f90a50325f5f80efaf59a41ebe3ad0c7bf160ffedc1e42ba33bd99075e19ad2219c30c02d56309dc2ce826d0bf70761383304bdcf5914712e937d778002906c
SSDEEP 24576:Y3Ud9CHKy7GZdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:iUd9CHKyaWb5+Pl6bJTIZ5jdgp
TLSH
T10195CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 58756c326a0460ac02617154f80135c3475e7b042a763f2b568ef29e323d8230
MD5 f6093c5eac946e0f89ca5d4fc0f48d45
SHA1 552679b2b079e7c57de29a92c82a23f845873856
SHA512 64bd85cf0908807a657493696fe34d61844d68b8d9b510a9b82c1f84d3c712233907016c4d7ea13c7a493b96522eae821f4b0e10c6bbee537debc20f5ba5b2ad
SSDEEP 24576:fxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:0b5+Pl6bJTIZ5jdgp
TLSH
T1A8652347896B20CAE45B5739D9C9DB00F87AAF57ED8727B6C57D0827F231389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e9a86efd1c81b99e39fb80c73797cfbc29592f9f9230293fe95d82865780e900
MD5 ae4f380d9de0ec9344a33277c25abcbc
SHA1 dba6cca8593a5fc322b2c79a1dea703af0cad72a
SHA512 45b338da2d36e0376ecef9199041724c6c20e4e952b5f0d3f1bfbd7d419d558b84fb9fa6857008a03cbdc3ff9c8355a78b4dc1d6f005852a3048d8f6d7d35586
SSDEEP 24576:zvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:6b5+Pl6bJTIZ5jdgp
TLSH
T1566523864E6A20CAE45B5379D9C9DB00F87DAF56DD8727B6C67D0827F235389381220F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 f6b8b5dce689303466fc669e4c01ad53e03765c58d1ace5c94f7454b5b1ef804
MD5 d4a130d8d75264d3290e244f7631b282
SHA1 57a6bf31e1c499b255e3e4539427017cb236008a
SHA512 ae42f22c7fd3a51326c7c18707b0471b9a8dd3e94b5e3931ce8d507eec2050b0ac7d51e235dd86337d161ccd3a3fa8a55e25dd6b35a98e97df8fe879441e2efc
SSDEEP 24576:GKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Eb5+Pl6bJTIZ5jdgp
TLSH
T1B7652383496B20CAE45B5739D9C8DB00F879AF97ED8727B6C57D0827F135789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 000ece71558bcc637ebc87523b1ca93be978d2722193dd640e67421cfba43732
MD5 b64f9821422bb24616308b797bd046b2
SHA1 3fac51bb687e38b40f208a91136fc9d9db1c1553
SHA512 601551d7edf8775742f989b7b21efb256b68629f7432d2f24e1cd74dbc712fedad6e3e1c4f79776bc26e096572c50dda07c5ff0a3671ab400f3b992105fc11e3
SSDEEP 24576:Ncmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hb5+Pl6bJTIZ5jdgp
TLSH
T11E652387896B20CAE45B5739D9C8DB00F87DAF57ED8727B6C57D0827F135389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 5ab06beb9bfde01df5a402ee0a5ef78d3bc5f481c44c41ad26bd3567f168a796
MD5 2a8f95b1def323cbfc616e4443fac0fc
SHA1 d1bc99d5b4c730e476576052291414db2bfbde3a
SHA512 1374738d89ee83f6130ebb56b276969c1845016bfbeb37b95d146dd708f3acc58b5ccc33078b20b0df40f8c0674652ab15a4598622a9d4d714d92b894e9b645f
SSDEEP 24576:Txmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ib5+Pl6bJTIZ5jdgp
TLSH
T1F5652383896B20CAE45B5739D9C9DB00F879AF57ED8727B6C67D0827F131389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 12599ef3ee4a1ce1fbeb4e231b72bf78b600334950a0e7f67248d8402f4fa260
MD5 50e8bd23c5e1b39bc285b59909bf67dc
SHA1 3fe88333991fb38a8d178312d89d6528189e00f6
SHA512 dd75c665094d417df50b91a050cabed0b5d156c6f8dc1703a7fd864d49d60dc444a683c3e7f40eb88a843ca819cb61d566c806001cb9434f8b55018e483ee0d6
SSDEEP 24576:5Umb57GBiOl6a8JTth/RWZvR6wQQ92pN3:db5+Pl6bJTIZ5jdgp
TLSH
T1946523474D6B20CAE45B5779D9C8DB00F87DAF96ED8727B6C6790827F235389381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 886ff2b567699ceae32808ed513fa1a40b83d855627eebb3a1ca28f83043d728
MD5 9ce4405ee043969003aa096182768e27
SHA1 e347d191d62ff38611394828b8525b1db02f0861
SHA512 96284f9161b7e3cdc055a400f69e567d893f58a9f642dca3bb9e04e03a48d0ff31278e4bf5a8f5f62f790c6464d3d592a2d3580c62393c9a1dcbe0e52cdf6206
SSDEEP 24576:0emb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Gb5+Pl6bJTIZ5jdgp
TLSH
T198652343896B20CAE45B5739D9C9DB00F87AAF57ED8727B6C67D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 3252243333039ec04afe91089881d5fd95510a0f32a112b929dbd9f1f8478f6f
MD5 2ba5c4d341f7ecf389a908c80c98156d
SHA1 8f1cfba08ae2cbf92983546b3732da650109aa39
SHA512 7916320640b5dfcee6d793661cbcd6c929c3425186b60a88625a865603e9dcf20de6d25289854458cdcc87aee2254d4d1cb623afa2ab08a29f899a5605bc5082
SSDEEP 24576:65mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Tb5+Pl6bJTIZ5jdgp
TLSH
T1B76523464D6B20CAE45B5779D9C8DB00F87DAF96ED8727B6C67D0827F231389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 c2912993b77374fa2fa4626da47995415fda6a9930a6c37576d145261297ccc2
MD5 5083461b578a4e22dad9cb5a0a56012a
SHA1 97b27b362280aba105323a3849e260ecacd718ed
SHA512 2420de55c695e8a9e67070d8d5a5114a6a4e9b03fb4b119fbcfe454c8a1b844d86edf18a4d971021d1fcf049f9f424743d83a2a5447cfdac82c138a9915f0767
SSDEEP 24576:lemb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Hb5+Pl6bJTIZ5jdgp
TLSH
T15A652387496B20CAE45B5739D9C9DB00F87AAF57ED8727B6C57D0827F131389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 1098207a99c88688a6caa57e98491653a685640e4a47724782852c9ce2407bb3
MD5 df1fdb0929bbecd40eef5c47186db029
SHA1 1a33d227ae180611d7096b293f89ade613fffe1e
SHA512 2a4208b600b0f2218d4a3621010f6b90268e3faaeb3d2082bd5e522a93bb91f761d0cee2bd59bf7b2cf784e575afec1af20c682103aa9817a6eb93b6c229d28b
SSDEEP 24576:qfwvhk9RX6wkyAIgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:DMnYIXb5+Pl6bJTIZ5jdgp
TLSH
T15995CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3bb72e928e4aa4d3ef7d395dd84bd05ba63aa92374b7b3e2257cc50b169f71c4
MD5 0e1e00682048b944c8c83692e505f8b1
SHA1 b8791cb8d993ea910402225e71c24ab892d43d8a
SHA512 7b2e74640d0460b947aeb7cd39543049c1c5a400f68427c9afc1b071fa3b8ae22c56a0a3a7808e89ca48e87f00fa0c9569ccb7b835dbccebc91e37265f94860a
SSDEEP 49152:GYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04b5+Pl6bJTIZs:JySzPOslgJTIZ5Bgp
TLSH
T1FE066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 97caff735d742ca55eca8fbfa99b005e6241ab1424ba16b24a3a3eec57ca4768
MD5 4404ee7980cf75654a117ca35cd05532
SHA1 f477eb70bbdc51a6a2aa8229b3f8379b5d150410
SHA512 c3140f267b8cc17cfb99c3cef11bf30697a7bc1f2d59dd132ad144194001171f6ced67fbd07b168f47f57cc6ad5a6b0527bc49a6c8b65318cbe50d1b543a5af9
SSDEEP 24576:p47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYLmb57GBiOl6a8JTth/RWZvR6wQQ92X:p47JUQjqirIhCnDHUPfF/Ib5+Pl6bJTl
TLSH
T1D365AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 64e62eff77a55c5b03653b555059374a30474c0bd088fa4cd24f2cd04079253c
MD5 d885f8cec29012737276c23943eb7c1c
SHA1 8df097aadf87d59aad2d1b768f8f01ae0e7a97bd
SHA512 316865beadd1b8ec7c47eb590b367b0346f40534514f55302a0f31787585d3ef4d5fddec07a7e54c4be776a8214d65e320ecd3d9b5422d56464457c989d3f466
SSDEEP 24576:PMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Tb5+Pl6bJTIZ5jdgp
TLSH
T10575F14AC29811D9D06F6279CB858A00F7377D658BE1A3DB86E0F43E1F366846DE6703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a3f561c30cedccdc466c7e023b6d0e3d6f98f90ad2df42d8d2575dd6d82198a7
MD5 3666d2f1d79de3cc9f05d2bcc0742368
SHA1 5d3226d406692ca5a7377d7a6a4e992fbbc89208
SHA512 fbebaae8f95d0618497521192f7023d0e3e1fe3386837fbe762ce1fee6fb89d4eaa48ad4f8737772a4e9a9da3ef244bf8442e0e2e8f984b9d032da8ea250fd2c
SSDEEP 12288:/j4xgy5NhjPhvaVz2evPS+XKRHom4PsCUI:/Eg+3yVzFPSKKRIm49
TLSH
T1F9451701766AD75FC6A940325E33D1CCAB707D01EE45AB0773C8473FD5766A8BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ecd3906ab2fef67394b2de5920076239b00367b11ce1d3c6c2fdd384a79b4384
MD5 a6bf66aa5cf71ed1d0394f4fe8ed1176
SHA1 4db1151b1bfaf9f9f50c6c6c81979814554b2d1f
SHA512 a557bced66e6f94a37d87942a323e2a528906c07a19fa53736a6254185cb5f9bc056c901b0f9332f245d0301502ff3d2b0717bf2b631121d3a8722ec8cc9a6a7
SSDEEP 6144:IIjQ3gPIQml636k/rPFcRXKDexHcRXKDexH4qy6OqPY/ThQ5/SWMxKE:CgtmaP2q2qE/TW4KE
TLSH
T1BA65D781A537B38FD1FB503207296B4CAB64EC07B7056F2677C8053AD82A765B1B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7d70e2377f95503007cb5aace0dfe2b27365abf5b63eb3ed3d68c6de2d5184c5
MD5 c6b24cdf8f3e376993b27c733272c96e
SHA1 2eca58dd194bb424217fc9d115e79ac737a94592
SHA512 4d8977146bda689dfd8a1b6e0837c5a4d7068f2cb57b11c51a5b8c7fea80ab30db7fc70709eff8a13f22324102192db1d603f7ec79fd091222f5a23656117ebf
SSDEEP 24576:nEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:nTb5+Pl6bJTIZ5jdgp
TLSH
T1086522428A6A6086E4BB5738D8CDD710B83EBF65CF8166E7C539146BF1306C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f279b07a227074f2594c8712fd4dfe08ea3b0693ef961fd826a7cd3a6c0e548a
MD5 363d8bbd8619886aa4da65fa27b516e3
SHA1 12062b1fac1a7d16eb260e02fc98409df4094f2c
SHA512 ee4c74338cdfaff854c65493bbd31cf215358d333a2a48dfe77465582f2fbd4c4729831a26207ca1f163a46ca740a68eeb0dbd41f743afc94db4abeeae3f1ec8
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1gb4mBIBhGFCb5+Pl6bJTIZ5jdgp
TLSH
T1F1659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 9fbee5965eb54b0f0e223b456d54e372e67589e625bdb1df6a5ed95e90607b3d
MD5 f98c094088a2037d6caf12f684eaec03
SHA1 f1bbdab00b12367cb07f6d38c1b5024c615b9cd3
SHA512 129c44080c40cc208387589c4af8ca611d633f9343d4d503416c2df901b768e66e666983bace4547bbbedb90e0a1d6e77f9f318e7ca1d764b23e3afe6fd13ba7
SSDEEP 24576:NG88u8FpJqH1ozria7/m7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:A7ZFPqVXa7/Vb5+Pl6bJTIZ5jdgp
TLSH
T15D95F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 52f41292dafaff2733baf14aced96a777ac350696a794d72949e5a59c7c0641f
MD5 3618de766118062b9665e0632be05c2a
SHA1 487c82cdc4d4baa1161191998154508785ab039f
SHA512 d57d439709861e7d0b66c9a12a5efaf58c65fb150a152a6097cd946baf9649d1c9215a77b51543409fdcf51291d22d8f8c67cfb35fe1f5bbcf1254f015373d0b
SSDEEP 24576:qPUr+NQXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qJQWb5+Pl6bJTIZ5jdgp
TLSH
T1A075E11F26AD18D5E67BA13DC9C68709F771B8624712A2DF02E0817E5F23AD87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 47e1ea1f37a3394a7fd4a30093424f93f7d7bea7ef0ab8811f557fa65292a8e8
MD5 a72d6583448176c1d3604f8065fc6f74
SHA1 20a4dd06a9ee0e9dae1666787bb026f258ddfd5b
SHA512 ac8edc801f6dc42f0ada6ef2c26ead963fd4835b065bbc49d005f61d3cc2e2fa56b6768d0ffcbb61ed17003fce2a8c18639cff39db6a01e9c1fb98ae7fbff6ad
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGb5+Pl6bJTIZ5jdgp:KG05lO43bTslgJTIZ5Bgp
TLSH
T1D8D5C06E62EC11F9D0BBD17CD9C68A0BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 45d10f2d205853ac30c62a75a2440193cec0ce19d0a2d40cb9c193696aea2723
MD5 5af5fed6096b3a3f37f6cdf13f9c56d9
SHA1 b771f8a2b4a3504d5992678d3adf4c141795a861
SHA512 3408dd9ecf0cc0ac66682fa71f56a46b99e991a179f3ae256a719cf73b7d2eca89408d9f7a38dbe91318632af84d2450528c5106e2c4cbd72dc0283ea6d11ddb
SSDEEP 24576:Hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn1mb57GBiOl6a8JTth/RWZvR6wQQ4:/a5POZ3lJt2pasx2+mub5+Pl6bJTIZ5G
TLSH
T12E65AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ec79560b102052a3ff63bf384a9c3cbf14f2d8326d61b7cd0b4ccf40c65f0595
MD5 0fd2be905ca4489dbb9aa76de3a6df23
SHA1 1f1be6a17ce6d0e5ae8e8b53f9cd903a3b694206
SHA512 d7ae36eba9a0987d65f85f5ccf086bdcff09260b7a03ad56cf3c662e0e2528a94c31836b31237aec18593f24f2f0b097362fb2611c136331f9620ee0ff964166
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fkjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:cNc/zEOVHF1b5+Pl6bJTIZ5jdgp
TLSH
T156858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c2b1b4c6e86165491d346bbc4f2d06e990857ee780f22f83e81ba8115e597e0c
MD5 2705db89b62c9d6470590bfafab3ec9f
SHA1 e87b741cbfcd92e2e6ca29e189d4c1ce46164d36
SHA512 4fcb7bd9164c72877f8627386b901d53d157e2311f250f99ad72a82fef349fbdd372354c02ff19ec67a1d12bf0e72caa078c8618d5eedced49bde43354287d59
SSDEEP 24576:GzkNvNnaFeYhJNtmZBm5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:GzMwBtOm0b5+Pl6bJTIZ5jdgp
TLSH
T14C55AF6EAAB805E4D1FEC6B5CD238512FA727861073253CB8290C13F5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 93345733851f86116bb207381d296c7be10a78b0eedceaeb8a774e257fb53645
MD5 664d6379e08336b7486dc7f47430cce0
SHA1 bfc85a7d8b84057bd9f11d67d4ae350746d64fa4
SHA512 9c227a1501908fd382d8de01b89865c4c67d29b5a2d2ac4aca8f12121e7a98fbdd913edf975764b409c2f7576dc9f3e3534820b2057d74e2b01601bb90f57bc5
SSDEEP 24576:sD3FHshBIYQgAImb57GBiOl6a8JTth/RWZvR6wQQ92pN3:sDVHeBIAA/b5+Pl6bJTIZ5jdgp
TLSH
T18985E17ED75D00E4E47BD27CDA938A06E67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-366-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/864-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/864-109-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/864-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/864-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/864-103-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1240-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1240-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1240-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1240-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1364-40-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/1364-47-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/1364-46-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/1364-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1364-53-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1364-51-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/2396-114-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2396-116-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2396-122-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2396-370-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2596-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2596-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2596-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2596-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2596-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2596-383-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2960-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2960-80-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2960-310-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2960-85-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/3368-78-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3368-315-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3368-9-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/3368-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/3368-311-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/3368-0-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3448-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3448-285-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3448-55-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3448-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4104-382-0x00000155752A0000-0x0000015575391000-memory.dmp

Download

memory/4568-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4568-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4568-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4568-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4704-22-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4704-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4704-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4704-15-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4704-21-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5568-68-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5568-74-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5568-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5568-309-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5912-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5912-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5912-126-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5912-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download