stealc | f6ff18b094444f907befd550ed4f6200a36ddb4214e53d62fceeb14ebaf0984a

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Size 1.8MB
Sample260910-e4l86axfpf
SHA256 f6ff18b094444f907befd550ed4f6200a36ddb4214e53d62fceeb14ebaf0984a
MD5 83b0cd09c1dadf896b6257cbd15b9092
SHA1 5e6099f0dc9cccde861f6283c4f3574e9950fc37
SHA512 d99c9a5804fa1ebb5ad0d38dfb34756a8f1a9ff4e21ced345953e305badefcb236280ff457d258068fc2d6156328fd0ebb0d4726aa40935e363c3c961a5e401f
SSDEEP 24576:lpt+UQ8AqLSLjvMyxknw4FYnshx8OfVe247:crIEnx4x8EVep
TLSH
T1F485E015E7E400F5E1BB86788F729502EA367C950770D6DF03A499A66F23DE08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/6044-78-0x0000000140000000-0x00000001401CB000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
2556	elevation_service.exe
4800	elevation_service.exe
4812	maintenanceservice.exe
4868	OSE.EXE
5916	PerceptionSimulationService.exe
3568	perfhost.exe
248	ReFsDedupSvc.exe
560	SensorDataService.exe
4948	ssh-agent.exe
3712	AgentService.exe
4136	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e4897fa024febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000173b0edd40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005561b852dd40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a34d60ddd40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000184fed52dd40dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d78a60cdd40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef6fa910dd40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db06b00cdd40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeTakeOwnershipPrivilege	6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3712	AgentService.exe
Token: 33	4136	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeDebugPrivilege	6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	6044	2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2556	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4972	4136	SearchIndexer.exe	101
PID 4136 wrote to memory of 3184	4136	SearchIndexer.exe	102
PID 4136 wrote to memory of 4632	4136	SearchIndexer.exe	103
PID 4136 wrote to memory of 5432	4136	SearchIndexer.exe	104
PID 4136 wrote to memory of 4688	4136	SearchIndexer.exe	110
PID 4136 wrote to memory of 1544	4136	SearchIndexer.exe	111
PID 4136 wrote to memory of 5112	4136	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_83b0cd09c1dadf896b6257cbd15b9092_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5916

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3568

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 644d7779a04363a9fa7ef5a7696a00a6201f605b28c7c0c02b377457873895a9
MD5 55bd4024bdbb477cd28e00593d0b85c2
SHA1 e65165416680913db5e412678e0801562ce61cdb
SHA512 befea6815d62d20c2def870f8543d111751089ee35db68b0185d1f25192cf05c859cfa89cdadb005e3e954ada2857ba286b41a93e0df2c8a7469a7326ed7bd0c
SSDEEP 49152:Db+632BuPkFKRrdE6ohdstBhuXjfS4LWxnBx4x8EVep:h3q6mjB2ix8EVy
TLSH
T12BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 ef389373596289ceb4dd1d4353cfde3a236860e20711d663a4db84e7c90b5c94
MD5 3cae0d75fe97d0af8d902b844b87fffe
SHA1 6d23a2efdc166abf6dd09965a2ae4237132b1502
SHA512 878c77fd5c2a7ef86dab0e4bda1ea956a81aa4715b5267932f00b57a64c52d9c7f19ea95f51b4c39a3ece383f20119d5617ec5180b2d982e71caf438d2933215
SSDEEP 12288:R1XLsswWkxy2lRq2czAf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:fXYfDtczAfyxknw4FYnshx8OfVe247
TLSH
T15E75F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 825f0662378e6ee639c553d2be4ea185c4ad6d3e603762bf191de1c51f970d3d
MD5 ebbe8a0a10e49fda32a291fd42a7ac97
SHA1 4083790e8097c772ce3406d3b1dfe807fe1da459
SHA512 a5d5bd4f979a9c4ac05bb34aa931709cf1a94513eea9570093c818ba43f2cb117de31a50f68c9b6f1eb27eba83c5c3ed6a866bf1c474f6f1e826229dc78bfbf9
SSDEEP 24576:X0Le5ji0hmxSrMmyxknw4FYnshx8OfVe247:XPji0Aosx4x8EVep
TLSH
T18495AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b52e450cd49e5512f7b25a1c58fb1ddda279df145175cef76142b82fb1ef1d67
MD5 f241891b126f6958ef2eee521cc6297b
SHA1 8becd64ca4efbea3ee78a24336b0021624c2f32f
SHA512 d23c64ceeda50611d9257129ee22e96411a3e0ff26c9fd0be03f2db256a1af843f14444550c606a65f0ea770f1fd805d41d0aca5e44242b9b9b241a3bc456ead
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyu8yxknw4FYnshx8OfVe247:1/ezSC6vUzPv+Hjywx4x8EVep
TLSH
T1D2756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a4170e47b924fdb150b4ccfc567afbe980d6118c6d8a1895d95f314be1d2fbb5
MD5 b8d514fb1cd9e2dc11b49efa3add4876
SHA1 4e7574e426dbc668e5bfcb2c0262c205332cdeb8
SHA512 a35d6cb423d2f06716d69bcd73fc587e5beb1a1dc77288f62609cefd8bdf984a1a0863e98f7db38b64183f6dbb94daf0084693af6c8d00b550ad7dbb2b8bd2ad
SSDEEP 24576:bVbqPb88hv/l+BDyxknw4FYnshx8OfVe247:bVO88hXl+Mx4x8EVep
TLSH
T103559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9e911053baeed4035d08893c9a168d9b1a2510f5475ec321fff5d2757b5b342e
MD5 6f471f56ae89f004e8946dd027e2440d
SHA1 16041f2cf219252da04446cc89337168534d46a6
SHA512 67569e4b238e54c0123cfff7037b29e15393e15d66de42fe76eb60ff1ce930da92b6b73d6a32f81c037af8c8b3b39ff02b369d38882447589edca600f31e2ec9
SSDEEP 12288:Ha6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ha6yxknw4FYnshx8OfVe247
TLSH
T1F765237CABD9E4E1F65E14331A7572223606FDA0DAB4C11BCB78B54EE4B0C50E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e9cbe2cb357962da9616cc6ac0a09bf9466a40c69e9b208c5ecf9efa8d643d3a
MD5 eb0d78b3a5cfcdde151bcafaee665d1e
SHA1 a5283b74da631576bce4f814e52452aec66258b8
SHA512 abfcd26f11e81435ce5ce994378f62492f4d33d63fdc1ae03e52bae02debe7deccaa83403705ea6f0d21c5ca52ac8b755f95a62f1ddd91b7d6f0c0f7e28ae2cc
SSDEEP 12288:EeBNUbTVO86U7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EJIU7yxknw4FYnshx8OfVe247
TLSH
T19375CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a4da49750bfac28fddfc33b408caaed48785ca2d6f245fe392a5d4afe7167c5a
MD5 b592773546a758bfbd789c6a547bfcca
SHA1 8cfc076f022a0c58c0546c08b59b21dca39fc7bd
SHA512 b76d2c339bfceb054e7d030f1a3c5754cdf68d9123df62b6ee3187123a5e38f3363688b2cc6bfe5ee61689c6c8a0651319d1d8efea62791a32263ffcb953333b
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THN:qQvGAdlCEL8c/WRNw5Cnix8EVy8
TLSH
T139267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 1556cdf1c86bd5afc19ba5439c0bc38109e5dde4825c69e65e9dd69514eabb10
MD5 6d30332fb3b43ef9eca7745045ca7c5c
SHA1 d5b01cb561197dce875d68e90bb04e6076d4b5a0
SHA512 fed12c9a388f163dc1703fa8b407813310254a2219b52d7d707dad2fac4eb469f24541cee94431c0da6365e8c7b238fded302cd9d7e30ef962655eb0e069b526
SSDEEP 12288:HAwSfxL/2Dc3zDLLmt0LDQewsAj5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:g+ewsAj5yxknw4FYnshx8OfVe247
TLSH
T1E685E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3E89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 98d91c95004f54f7bd17c2fd87a84e229615a6fa9bd7ceba8483179fb77c2902
MD5 d8eb1dab18cbd5c6db626326f08ddf2b
SHA1 adc0b22f3698e4f8dcd944c029bca2e8aa167130
SHA512 91bd1ff58b52d4a64ca8ed610c4ef48e3e3fdbae7c7374d855bc019c529fbf4efd8956505985b03d035badb1fdf23bce875d222c059efea9380088ac94250bb0
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZ:5UEtQevvqc2W1cpV20I32
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 171ce774be0f9c237f31694282a92d8dad2c645a8f52bdee02f283f13820776c
MD5 ebeb3ee39b8c00ab0cf1ded0091e1684
SHA1 c23d71acec0385261090f84ac2eda57bc83c012a
SHA512 a8b01e967f7f5add54403e049a5416885cecc14dfa702e16da66717f1dc8c5084510e1b2cb7bb36af9512834a205b9f57b640e284db9c772152811a2c9487d45
SSDEEP 49152:kCbRquA/m2yL5zLfFiV+XenmE3/zcx4x8EVep:toq2Vjnmrix8EVy
TLSH
T18FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f67a423455188db812392771775b6c32be300e8420ac36b32dfe57f8d09b673a
MD5 e089f04b845b2f60c4bb391c8be3586a
SHA1 79595f5e9c24d077e955a90190e6940662898abd
SHA512 86eb4d713c893f18043ba1320bad7415fc131cd990b6956afb9200cd360214dda3cd99185bd25dd08f9d628c1cd7c4c5622cdf80a0e777f1936fad7526a557a8
SSDEEP 24576:dAhGL6IFoiwtA5l7S53oyxknw4FYnshx8OfVe247:dAM5Foiq57x4x8EVep
TLSH
T1BF35AE80EBF955D4F5B3AA7899B69171EA76BCA65E30C20F1260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 18af9a282d73c919d2da8c9fe5ae659ec984f56f67b1eb2d07cbf13dc2d6f3d0
MD5 3452b3c27d7c9841684f0ebb97c70637
SHA1 fd42d0ef67329ec6d3c72c2bdd36d26337448aea
SHA512 40a243919bb78c9af56987740dcc592a6f48c9ece53f96850f8d235a931f99b787bd780e3fab9678dab58279162891c688a37112e8260f2176087f18966d9513
SSDEEP 12288:Amw5HEjsChNrBFgl0WDm+Cc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:dwumOWFyxknw4FYnshx8OfVe247
TLSH
T1EB75F14977E81CF9E96741398697D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 2601f658c3f9f161e79a45124f43552ce4cd161b321facf704342cfc09413ee4
MD5 feb2931bd5741565d3db0ad2fbec5f60
SHA1 9c5a7ae78f6b2ba75053ee4d22ed475e1fb07600
SHA512 31b03854638887300fdf5628d3e12e9fde70c01e30cc229c38fc19f1e251b480e39eedc3cf9b517f6caec2374bd44672ec33f66ff128c15d52dec2b3cf279094
SSDEEP 12288:ivZ1IyJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WZueyxknw4FYnshx8OfVe247
TLSH
T1DA6512AC33E870F1E1A7113A89F15206E762B4A2677183CF4768625EAE71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2bd9ea9762fbeaae234a4edf1204910e246c6e43f32fbdf663cc1afcca906b60
MD5 e26886b61f21160814faf99aaf767cf7
SHA1 256130fe1c30b1f8d9fd6a7f7ca1e45d27ca5ab1
SHA512 c770a145b0a0ec994c045b1336b7fa6f3a7f5d823baeeb3aa9d5d976d466120c0952702b2f0434e9ff6ea0e3034278b6eb7304bd3772cd02e41f914734815cb0
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UY:rQRQyi36YOcPDLvw2gAf+PN3Cix8EVy
TLSH
T125667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33ab6a25dea1bf9e5ad3f6a9593ac6a191f3eb42fc11f5ed054b5c5d0c6c5980
MD5 42e09404024d1cc2ce090494d795ee70
SHA1 bad902ad0f84ac326102fc2afe60db4534c6d1b8
SHA512 857056ed12ae02e380e70164bdae04c5f94764f952a66d0198cef4a5efb8ecbedc3805eaa5b2649a016063e8ece938738ed32542f3f79c7136c9dd30178996e7
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UY:GQRQyi36YOcPDLvw2gAf+PN3Cix8EVy
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5b66b117ff1033857e7cffffdc115cdafeec37133d8befbbb410d56dac58a7e8
MD5 1056a86f4f8c35bde57431818a134884
SHA1 690a809b76594d8ee3184e5c65482f12efce0477
SHA512 add5874d59acd74fa796f31dab8eda4bf503265a93d01909324bdfc3f0850a6b1dfb1ef1cb5e134478ea19562e4316ca0004d87ebc5b8164725e53548c711555
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0Oyxknw4FYnshx8Z:D68Qg55nhkeWu7PNU3/sx4x8EVep
TLSH
T10CB55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a690cdb2a3ac61ca92654628d1c17d1896d4979e491b281dd31ee80c66bed5f7
MD5 cccea89e6f3aabffe3c6e00598aef7dd
SHA1 e12bb0f40ae59cb5270073dea49920c5e7e48f34
SHA512 d30f478eb3515fee83d23f864fb1e02610ce0c0f48d22c98110105624c1ab3010c4f678e0ab4224a78b5d5ea323e80076be7a89f4c9442f67e50aa6d67d19bb0
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99y:Qy5112gYy5azzVvU69nLKnhZVix8EVy
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 457f640006e8ed87c8f0285619e12ed47c481e999919f08e52aebe0d32f04f3e
MD5 df04e38dd8610d7481730a6f02cfc540
SHA1 d754bfecfdefefc06e04660e4d1c15bf5f4b8550
SHA512 1aa331cfbfbb99efdbb16d2677ca43780fb1a8cbaa9850c3fd6fa8cbd7078b4fa616f8f6e67f2146beb8896635b811a9b6be878c0433f75186c10a4a969dd679
SSDEEP 49152:PB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl6x4x8EVep:xu6JmIxd2d6ix8EVy
TLSH
T168D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7447df314e9fb2e2791d57773a9205637c13556320166c0c17be7aad28160d5f
MD5 5681819f2140bf3697b1d84128bdc233
SHA1 b35ba79bab52c183b8ed8400a79fa0178d78a0c8
SHA512 2221321cd010b000f694726e3de1710dbc485f603000858cacf792d77a0fdd8195e51617c0cbe9817106c4866499b5afc223310726d23589d02ba060751ac292
SSDEEP 49152:81hpsNoJpF1A67U44CwH7R4x+x4x8EVep:8mifPqRrix8EVy
TLSH
T159B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f46a10aa0efea1e2a28eff8b8fd178782578c3db4e26e42070f8da142ca39027
MD5 4c99267fcd38b19df4c746054691a225
SHA1 923c9da7a8bf199862a302ae3fca442b028e7f20
SHA512 207d294d5aab64897c947ec95426b6f78d686788668a2f07b8acd3b1eb6882aa96c53558a4b5dab4caf58b0c2851e6ff0285001fa575491af91a6d1762bc65d4
SSDEEP 49152:QSuZQIY0Be2KkRVtOnks6NMHqRx4x8EVep:K5dKqi61Rix8EVy
TLSH
T12EC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cf2186ea77ee3ae108e89ad0d09bfa931e9cac88b5035e98c189c90e1ba85411
MD5 1107b2da2097f1abc740d14aa9460b32
SHA1 802dd3ec70e329baed166d804e5af7cceb127a6f
SHA512 862bd3715f6dc09e3f98daa7bf4b9139cbbff6e95c3943163f0dc19d13d3aea230ad05e00f257d82d9b8210ae0ec42f4a724c99306a901951084f006fabfc963
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wKx4x8EVep:dX2iWphPix8EVy
TLSH
T10195BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 0b82fb0dfe6e734f7ac503d5d08ece7d8afd2a07b42c11c6dda05e0d0badd257
MD5 f5ab8998fce094e3351e068039cc15ca
SHA1 4e386921331ca2ce0b2d233f87314b5ccebd6eb3
SHA512 69487b6eaf29dfbbc6f55546ab702e2e6a647cbc5ba485098e76f71cc903f871f2a7999b7ae45fe2e001201b0e728e2f42cf9cf6a88df99cb3d0cff9ab964587
SSDEEP 12288:Ty+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tyyxknw4FYnshx8OfVe247
TLSH
T14F65237CBBDAE5E2E50D11734A7132666609B5A5EBB1811BCB7DB00EF4B0C50A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 941e329c06073dbd3c7a5edcf63f7259b5c1b12f4894740f318116b4a9bb75c0
MD5 6691f4973feb1952781f192b6398b788
SHA1 5a19d66d4c6b6213ccfd84c19d0deda4453c8942
SHA512 69c75e0e6da75093c18daccaeea2d6d199ab7d37cf741c44cee7eff925e6c0006e031a371552c7620a5309436fa061362c2318a3929f4932010bdba8f5aa7929
SSDEEP 12288:kt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ktyxknw4FYnshx8OfVe247
TLSH
T1A665237CBBDEE5E2E50D10730B7172666609B5A5EBB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9b2817ed7fb09f9b09ebd2ce2af9783f1b97745fc075089201ddc1650e1b341c
MD5 a07da4f84a43e133ec772e880b9eee90
SHA1 c2145ecdae631a71d5368b07f07c2795317e4702
SHA512 e0119b9169bba93169c7e530cf8bf20ca65587915b5e84023c424d4ddfaf30bc35c308b25905dad170bb4d433a7ffee76248b14d8723f6e4dd15881d673dffb0
SSDEEP 12288:dz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dzyxknw4FYnshx8OfVe247
TLSH
T17265237CBBDEE5E2E54D10730A7133666609B5A5EBB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c6673906a58cf346d09f1d2247b6092cd7cbbd491934a3dbfc596b81a8852f6f
MD5 8f135d37d4388a7187ff711869d1ffe1
SHA1 f7755dbcb668dea6ae00b5b6bd9a4f4edd33538e
SHA512 b0d9ea9adf4c90960d28e335c3bc455de41548d1cb9a4852496c418652f6924343f3df9dbdc69e2f9f539de93788b24eec299d73c52f133ead55e88435fecf17
SSDEEP 12288:XVI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Syxknw4FYnshx8OfVe247
TLSH
T1B965237C7BEE90D1E45A51738A716222B365B8E4E731825FCB24750EEDB0890A43DF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ed7e3822a48a9b0e37d1c9a3f77204b3f028149e66a029708ff5a6b2010d45b9
MD5 9d47dffdb472013c8842a1704a07a8f4
SHA1 094b112e0c2563f34b11bdc685b5cc85b85999cc
SHA512 3f787ba7f03115ef874651a3bfecc9a16ad6aa710b50ac11c2c77a3ecb0f75aeddb3ce5917456918330ca85b85fdc76a8ba5183d4493bc92fdcc0162e6a6f1d3
SSDEEP 12288:2w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2wyxknw4FYnshx8OfVe247
TLSH
T1EE65237CBBDEE5E2E50D10734A7133666609B5A5EBB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 6071c39c61633d8abc6719b54edb6053d9b89d31e36cbad9f3136b6c32306398
MD5 3604639adc8bf05d71beef218261c08c
SHA1 284c41f345465a1ac266e85435c0106a04edb5a7
SHA512 264d4ca07d5dd70bca3b17a543b1059318bc2d6e71c422b8ff7c79dc64fcccef54d35ecb9c06a8a0626e50025599a1312e3ccb983e5f3efced15fd474fef663a
SSDEEP 12288:gR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gRyxknw4FYnshx8OfVe247
TLSH
T13C65237CBBDED5E2E50D11730A7173666609B5A5EBB1811BCB7DB00EF0B0C50A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 609d9a7cae61c2baa61e53364c2e8b4d8896c7a1499313aa3d7c4e879721b48a
MD5 de6635e2e3acc7f62f3cc021803692ab
SHA1 ed1874c9dc3989a9d8868a827ef596c4062531d2
SHA512 b791549f9b49003c5e8f27b30c913ec89481dbd1af5a0a815549c2042155290af0723dd9de67cd298757d56a5de6dc48e2dea1a9e4a25b1a6cec7392a2966579
SSDEEP 12288:J1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:J1yxknw4FYnshx8OfVe247
TLSH
T10565237CBBDEE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C64A02D963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3fd7ce96374342809a2b331bd5863c7167b044ac83157415672b3c4278d2a160
MD5 334913001205fbc1b29a5305e326fa4d
SHA1 7bb26a1e8d7f22798c7b3546e5e398d6f68610c0
SHA512 53efa338d4a742cf0909a265f2b6a61a41733d85c819e8894637eed6df9e952f5d124de06d8e092edf9dad9c6ee6467c9384f527e94a01dbbd48ebe345721f19
SSDEEP 12288:jiZwbyzzFEoS2cPvyN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OZMqzFVSONyxknw4FYnshx8OfVe247
TLSH
T18E7502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b28fedfd3a4831063f2ff6160f376f6ef16def729f2e9d33d565b0299f7b81fd
MD5 06cf74b0c19b810bc5585d51584afb8e
SHA1 a95f0206535dab976d9d8064348c4b3461dc4c16
SHA512 b08d6eecf26b71eb379ceac9aaad9789645182d2501f59cace2accb4403000a6851ba0644c3649c4104febd343221730e99333ad92bd2494f0cb051df6615d63
SSDEEP 12288:Wu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wuyxknw4FYnshx8OfVe247
TLSH
T13E65237CBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 26e4f87c99c8aa56dd1ae60cdaef33bd00b4200e07a15f50dd66d6fc9a8c6953
MD5 747571032e58faf0a02e6cdd4ae36d6d
SHA1 d76de89ef36fffee69bc99500935ea158eba303e
SHA512 c9c6061396f10b91a44df66057c6451d1a84fc3090e5357376dc5fa13cea598fabf5e26c0e7c62f1d598829ffa27b143ae601a678b0a0647d98f34b97759ae74
SSDEEP 12288:tK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tKyxknw4FYnshx8OfVe247
TLSH
T1F265237CBBDAE5E2E50D10730B7172666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 837656d31a84d28c4ed3845d2418b6956732f2cccb1f4e7328efa1fa4bedd777
MD5 10ca353677069f86bc79bf51db9296da
SHA1 289f9a18a892df5abd5ec81bd7904bc686e4e699
SHA512 3cca043a0b502f8adcd506ac0c01b2052ec70b895ab5b8fdd7c4c7afba319ce28a787533c04ef764298339ee8070cf7c50870bbab48587696a2439e72ba41e24
SSDEEP 12288:lyPz5L8J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:szyJyxknw4FYnshx8OfVe247
TLSH
T10F75125B73E530F5E13A423689621612F772B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a2c2364e6b23c432dd3d2f9f946dec199646b51751ad89ef1f4e34c371096cec
MD5 9d0bd5fdcc2a9a428d0171ed923d4ba2
SHA1 5148ce3c6b88a3f30dd7ddffc0602f3f958f8991
SHA512 2ca58ca8e4afb729a4a6bc66bf5471b0e5e8ee4ab7d1aa8b7bf92bf87a82b853f9af4fc961206eccfab2956cd1500fb941ebed1648e24b1598830743f68d77ac
SSDEEP 12288:2u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2uyxknw4FYnshx8OfVe247
TLSH
T13B65237CBBDAE5E2F50D10730A7133666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1ee653f70445602289e3f07ddcaf41bd79bc86aceeed0ab46fb0f1f20c71a474
MD5 c58654c356d15c5468daa2c57ab18a78
SHA1 79d12660c217f949e964e5da4649dfcdbf27d649
SHA512 6afe0d1cb774606650d64908f44c90e52c50118e3c01fe25558ee42b45c9b807c507a07ae9167b032225443f8c24d05c291503d7bcff099776f78a6372836253
SSDEEP 12288:8u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8uyxknw4FYnshx8OfVe247
TLSH
T14E65237CBBDAE5E2F50D10730A7133666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5093d2bf30da19046bfb8b74d74f863d3f6c15d406e7b7a5655d0c24231375c7
MD5 0d5ede18a840aa36fb3949d953358e5e
SHA1 f5d234cf6d7a8e54697c775b3e934113273ae6d1
SHA512 8703929bb9350c0913ea8ff03ff6609bdb6c75eb15f63abaf2c2c41511b4fb732acea851c47ab47e236ee79fbb780dc6050c51c399677c8140acb55cfd22e955
SSDEEP 12288:YyPz5L8J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5zyJyxknw4FYnshx8OfVe247
TLSH
T19475125B73E530F5E13A423689621612F772B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 292a697720a0a5b2e604b570f8fc639a159c81dc1bc985d548b528db615aa8fb
MD5 d70ae130f4ec9accd19c8672d3163690
SHA1 6e9ae47b5d38d070365c6328608272a179739d5b
SHA512 5128e78a6a172cf9fce041b0e604c8f008abde26f7bc17c2e34a2b15bdb42a602d6a69ab9b6d1372324cd4ebdacda8a80b8b140ea99e62221517647fe83348a7
SSDEEP 24576:yTPaLl3z0zDjyxknw4FYnshx8OfVe247:yTSLljXx4x8EVep
TLSH
T1AF7501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 36342adbf62e5d46d3102b1eca5cb676ae4884108bfb450b46ead82590828813
MD5 11a1afcabdb77dc0578516de5c1a2516
SHA1 214311f84cb6d2922d0cfd90ca5a15856286d031
SHA512 b89b1b68138f43c48c9c612f0fb5e8857ff5cd7d1a7a09c062023811a69323b7ab67a9983312ed312f32e798eab33a1ad6792d6358d6d4ac4cdb4a5200462261
SSDEEP 24576:830d9CHKy7GZXyxknw4FYnshx8OfVe247:m0d9CHKyakx4x8EVep
TLSH
T1BD95DF90F3E410E4F0B79A358D765512DA767C9A5B31CA8F03A8661A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 8b453a9fda1d474e9ae59e4fc088114ae1a7bdf2760814a54e3aabab325fbd0d
MD5 4ecf60ca009ce7b3b6e8b71462b35545
SHA1 83ea73e14ebd1ec0779ee2d46efb24406a146bd8
SHA512 2217f9a481ec5f34c79070d5cdcdf7762beefd45e2417dabcc45a2328c66a4e4d1585d834e8f917f107ee15e66ca41b24af15f608e271ca7d7ab79a5ffd9c624
SSDEEP 12288:NT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NTyxknw4FYnshx8OfVe247
TLSH
T16365237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 4add511ba08e79d49f69d639a579bb55be4fb68a1653dda191c2612e9c9e406f
MD5 62c389cce1712fab08e8a5fb85c8be7a
SHA1 06b9df015988682ad743435c22701753decc4dc7
SHA512 3a5c46068affba703f7fb95eb0c1b2f5528277b1081ad41aba7092474f2e4b5216f3d17686f182e95c1f771724ee3f0c395ccf7ff3aa54a2769f5677272a6b4d
SSDEEP 12288:5p+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5pyxknw4FYnshx8OfVe247
TLSH
T15A65237CBBDAE5E2F50D11730A7173627609B5A5EAB1811BCBBDB00EF5B0C50A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2833906cf5c0f4d1bbe6168f5e164dc6b0d4d93ce5ad92129176df9a80a366b1
MD5 2669868deed2e8744d19b33fe178cfb9
SHA1 02d36b130084da544f257f7337b4e227ac17a5b9
SHA512 01dbf411c132dc41b660997f344510362568ba7601b1c1fa21700492a16e179bbaff8f7de04731591119c0356eba0c66df414ee4f5b94c02316277b9e5ceba71
SSDEEP 12288:hE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hEyxknw4FYnshx8OfVe247
TLSH
T15665237CBBDEE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 b20171a5cce8391a74af1a32e1f76a016c8d0069af33f0243fb1929f1a81501c
MD5 90f3f17c0414cf2306b2635f871b4eb0
SHA1 4dc7a74a753e86af6e30239356ffb0e5b3d81981
SHA512 7639aed6689a6141d2413728b23e8b7d09b6e9e684443d400366147a776f03ba8fc0dd2a542f3f09f320feff1acbd5f83fdf9dfaf0593a6da4ff5de1471487bb
SSDEEP 12288:hu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:huyxknw4FYnshx8OfVe247
TLSH
T12765237CBBDAE5E2F50D10730B7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9d857b1a11c7c42980a62344a14939d76c2dcd4e0d30803f5c9e8ce05723ba10
MD5 58f8711b090d853631905c3415519796
SHA1 aefb57020ea9bc0edb37bfa6b0ca99984e78ea57
SHA512 746c20f55adb1d3218180dcdae4038a45c0a38495f71b6270a4f0a15b806e51df6b09badfda8e10d250dec1b229b14f69443ebb95b16c936e5360763a133a3c2
SSDEEP 12288:lT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lTyxknw4FYnshx8OfVe247
TLSH
T11065237CBBDEE5E2E50D11730A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 134efc2d990aebeef073d01aceee67ac51c3fc420c98559a5c076d2203d956f3
MD5 394ca444f4cdbe099cb8e393c8279a3b
SHA1 9f59e0240a8f4695865f22bd9a00c99a2f076ce9
SHA512 74da9962bdcf72a1c6b7feba666d68795ac966700a19616c43f5072fae293129e9e92283b7bc4fec14e6550e99bcddf996c921b8f71a62f104c74d065ce9f6d7
SSDEEP 12288:WW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WWyxknw4FYnshx8OfVe247
TLSH
T18B65237CBBDEE5E2E50D10730B7133626609B5A5EAB2811BCB7DB10EF5B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 f2871030b0f1b1a9bba6329c2d1421f1c145ea4d8f98bbb88c9823ddcb762cfb
MD5 fe10b73689b061620c4c7a0de2aeb4a5
SHA1 1cbf0a03ba16f9e3390f19bdd66187aa43922cfe
SHA512 fb2c0cc1ca858dcdcc8a41aaccf5f66e4a68301242c4819f463c437ff196dd1ec95a0b3cef683d491569ce2d8759952d0282b5aa29df175d0eca0db77a6a3994
SSDEEP 12288:Ww+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wwyxknw4FYnshx8OfVe247
TLSH
T11765237CBBDEE5E2E50D10734A7133666609B5A5EBB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 810a608cac2b65ec67df0a629d9dce602fcba2bbf98bb25bb1a9ca09689ef476
MD5 be6a2f607bc477686a02e5bcd6c7ea45
SHA1 ea4db6c8385f56a8345c0f0fb10d1c9ec8dbd8a2
SHA512 24e1852b69a3da54ee285490d55ad54a99e52a0b49747186284bfa9ad84e184815ac64595a19c0fec9a74bffd8564104578681577e4e9b06959146b31692008d
SSDEEP 24576:Afwvgk9RX6wkyAIayxknw4FYnshx8OfVe247:AMnYI1x4x8EVep
TLSH
T15895CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b8ba6394a5d927578cb904f506a4b20fd5fdf5ed67247b78031a105d493b9f9b
MD5 7d65b32c24398e8acf3f018ac760eebc
SHA1 2ce546a760410fa65c985167ac0561352d09c253
SHA512 1f920277a02cb304899bd9e1c42b70a5e75a4f810aba3cb6182a3ae750be77627e77a29f721e6312a7fe196b63c91baedd8f02940b45af294e93e911a10f6b98
SSDEEP 49152:ZYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qx4x8EVep:QySzPiix8EVy
TLSH
T1D4066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0c8a3e87b422e907b8d5d038ff89dab04819f5727276927b0c016a486b39d201
MD5 8e3118f97151a6f4192478984117c077
SHA1 1c9d4a83985887c53ceec23e163ac8eec144ea94
SHA512 b8e485efba6c6a058c5878e0f6cc9095d99657d069e51f5d764802ccd99d4a3dc04e52ac735fc5664124eeaae1dfc6e98d13482cbcc38e6f714f82bc9d953665
SSDEEP 24576:Q47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYdyxknw4FYnshx8OfVe247:Q47JUQjqirIhCnDHUPfF/6x4x8EVep
TLSH
T1D865AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0e19503f7db0c2032f2245794cc3ee4a2cf9d8f9efb418ab251fbbdac4ddfcb2
MD5 862b282c1da47b3bc821f0b57723afdd
SHA1 ad8f5d3a6a87ec0c29f6b4452e466eca28bad68e
SHA512 fef9c8bfaa256a1bc4df9276e67f9f5fb54f51acf06b3778c14f867b050be0870bbd940457d58a5429c969aca9887fb455e65ff94855f413bf5393b26bf522b0
SSDEEP 12288:K0sfe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oeyxknw4FYnshx8OfVe247
TLSH
T1DF750128E29852E4D06E2176CB625641B3237C6597F1C3CB97E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2e13516dca5be8882f18e2048fa40fd2221521ac588d34f0da3ac914e43a3928
MD5 65be68582a1916437fab538ddf5caf56
SHA1 8b3162d46bfcad132e1fafb9dd17ca7d6dfc1138
SHA512 7c9de5cfe27298f1ed60c684c674bf273fdc14a708337538a1ce422dd0ce555b6ba7d41291d76b7f85cb6d802cb5814fd5cc9d7db5dddf963287a2dc91751243
SSDEEP 24576:FW8i60aUPWniGxKZB18cgXzWP5pVroaRM670DEtwBj2t5:cs0aU+iGxKZB18cgXihpdoaRM64iwBjW
TLSH
T126451741762AC78FC6A950325E32D6CCA7707C01EE44AF0773C9973F9476668BAB5382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3e334f21fc644ba6470c35f5263077bf1c139afc748807b10e73d12fc6e0ea27
MD5 00ccfd92521f2494ff0cc79c93b03411
SHA1 7e0a266b592745c18e319695ba8ab2fa99797385
SHA512 58f078798d201e057ec072fcaded316b5247a9d77af554b75efb2f4e6df53df0cffb46d871cd4430d9d7abe2f56b19702f09f7cf575a87ac67eaf0e0787a24a1
SSDEEP 12288:iPNKRbpBx4Xmj8hLDgWz+b7sEhZV3D35oJdB1l8CGtgrvoOEOAxKK5CjpdSReKTu:iPNpai/1SvsEhnzix1l8CJVdsnTfG
TLSH
T1EC55194165B7E35FC8BA90370332968DBB749C06B7493F047384893C986697EB5E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 b38ea19d6b728cbdc894fa9b1a1f2cd86c4e85cb53ea2c334436dc0f788cc308
MD5 eb9b629a794b181f989d898c513c78ad
SHA1 edb66ccc64508c68e2e5ec1acaef826cd1b3b1f5
SHA512 5a6f3760fddb647baba5ff804b46f7a19dabb70efa42254fdfba3f8925d424e2c2ba9387cb308e696c8ae1401bd5b918b041209148c0e99b2ee75e82ade8402c
SSDEEP 12288:IR7G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wGyxknw4FYnshx8OfVe247
TLSH
T10D65237CA7DEE892F46D11730676A231360AB5B49F70C09BDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9e56ac201b6c7c9da4bcf78486202b4354d05927dd86d2340b338bf13720146f
MD5 ed2b914066ab7306464dce4cefb5f0a1
SHA1 157714cc0847094bdeceaa502f3899dc48958832
SHA512 7271b4c502eef244c37bfa2dee34d2d586cf5601d67d4115be1a5afc0b490dcfaf2bfb158816ab8b449ac556c6450fe5b659570520545d1da64f80b629763c46
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bY8yxknw4FYnshx8OfVe247:6gb4mBIBhGFIx4x8EVep
TLSH
T13C65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 6a751be69a062690cb2b23ddd0f812b19b0c5bec767d6d6574c7f0f1e15d5b31
MD5 9f5c4d6a3f6b507120abf44496f1415d
SHA1 1a1c634943ba89c9be1f33e18b5dfaa159a40c00
SHA512 81a7ad6c4473ce72c8ef5dd5fef9177e43dd89367448d5f7a112bebd968fe1a608111a0f48f06db0582fde053cc796e70f4a4207800abfd68068f1e2923065e0
SSDEEP 24576:6G88u8FpJqH1Izria7/mNyxknw4FYnshx8OfVe247:B7ZFPqV3a7//x4x8EVep
TLSH
T1AE95F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5376c52369884925b7e6bb0733b4a68185cc3311fca3cb8ddcffa6c7e2bd7d84
MD5 90bea921f91c2b3498b0dd2ad16739c2
SHA1 35d8fd7f06d20a65860a60f04b2b4194fee413ef
SHA512 34788400a86ab40c812572256abdbebaaed8b79c70222e196bc5f2c8e8ce37ceaeb7319ad278c601937f6b7cfbc787b0bf0db36cf304c87329324d07b0452d47
SSDEEP 12288:NHvUrBFrEjwaQh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NPUr+NQhyxknw4FYnshx8OfVe247
TLSH
T10A75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 40a056652f301d18fa47d1456aa9de6fe73787b023a590f0835e61f150487cfc
MD5 15bc2ffd8c7e48df55603282498d87ff
SHA1 76a1f669a691457b0a50cb2c42591eaec618a5a4
SHA512 4b1cb4d8d0db078033cd848046ac5c1865def117701f687dc4bb5e6646be7da6e485409f296572c9f9bcfc7cae40debacb88ed2e5c2e37471e18b52143fa8025
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUx4x8EVep:wG05lO43b9ix8EVy
TLSH
T1EED5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9deec25a2c0214c89336d2331c0661f0e3a88cec164f957d6f46c6397d85d9e2
MD5 7511227e92a34031e69560be6cc4f7d6
SHA1 7b0714d01b349c956367bfee170dba3e8b9eab24
SHA512 519f08d02e49c8a0bcc23f770c66183b972f3321f04516ed2433064ada0b5deebd6872c218e4a315d2cc8cf5241e661a547fbd7348cbf8eb6dc9dbd08150f503
SSDEEP 24576:Ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidn/yxknw4FYnshx8OfVe247:Fa5POZ3lJt2pasx2+msx4x8EVep
TLSH
T1F365AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 adb50a8d11389608e8d24a8dc4768514c93d72deceb2f37b05648704a5d01647
MD5 ba13db83bc60c59f54c4341e6eaa1963
SHA1 f1e441abf846e7933dec46c6be43e68488c3b374
SHA512 873b4669a7fd8c8d9676b255422048a70464f922ac1d6b1a05a7ff5bc06e13aec749117cad6d2ccb65a0ae2a074ce5fac50c3531db9eb815aa52a05ce4db9302
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7Fklyxknw4FYnshx8OfVe247:DNc/zEOVHFfx4x8EVep
TLSH
T130857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1b1c3bfe47e28d190d011b4bf256c2b6bb7003f65c912c33ebe3ca6c29027bc9
MD5 8ea925a7fb03da3787d551493606261c
SHA1 edd5f65d056e3c5388683b7e32f6660c8b6ed004
SHA512 bfdd3245f01cecc5bace1155bac7fb142bdbad152050845394ca2985398f24dcc47e1cb30df34cdbdf1d1d9040dc6f27ac1ca77e7f57e97babd08bbae2ca6c76
SSDEEP 24576:8zkNvNnaFeYhJNtmZBmLyxknw4FYnshx8OfVe247:8zMwBtOmux4x8EVep
TLSH
T10B55AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 9faa70b20fde117cd8c63a5c1a8a65de4f2c298a58ad2bc6e892ffc566e8d024
MD5 e5764653c89242be77650a48fa0e7cdd
SHA1 202b305ff814f414504f0f6df6595dc652816169
SHA512 b4dcf6b8237f617c1fe1f1460bb32e8554d5e2809ee4fe430409cb0cd0ff19816e9aa269d1628775681358deefe6a6565ff3c8b32a2ec2753b78425b7b6ebb93
SSDEEP 24576:FD3FHshBIYQgASyxknw4FYnshx8OfVe247:FDVHeBIAANx4x8EVep
TLSH
T1D585E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-91-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/248-97-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/248-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-331-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/560-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/560-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/560-315-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/560-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/560-103-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/560-109-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2556-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2556-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2556-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2556-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3568-79-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3568-80-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/3568-85-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/3568-311-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3712-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3712-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3712-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3712-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3712-136-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4136-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4136-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4136-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4136-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4800-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4800-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4800-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4800-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4800-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4812-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4812-61-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4812-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4812-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4812-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4812-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4868-295-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4868-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4868-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4868-62-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4948-314-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4948-116-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4948-123-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4948-122-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5432-321-0x000001E8E9020000-0x000001E8E911C000-memory.dmp

Download

memory/5432-399-0x000001E8E9020000-0x000001E8E911C000-memory.dmp

Download

memory/5916-67-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5916-68-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5916-74-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5916-310-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/6044-78-0x0000000140000000-0x00000001401CB000-memory.dmp

Download

memory/6044-8-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6044-0-0x0000000140000000-0x00000001401CB000-memory.dmp

Download

memory/6044-7-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6044-1-0x0000000000730000-0x0000000000790000-memory.dmp

Download