stealc | 5ffd12cda746da82a100c8ad3e58473d8a0cc756359a1ad72ef81a5a508b5bc2

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260925-te38psfd74
SHA256 5ffd12cda746da82a100c8ad3e58473d8a0cc756359a1ad72ef81a5a508b5bc2
MD5 032702ba701635a9e8fbf8d5a191c5a0
SHA1 ea559ac62d729701a07d41319cc1e9be3b2a8b62
SHA512 9608f840bbf834694a2766921146d1b952f3af5e52d8e30a22182289ba599792f523a59058b96e07ae52e674e9bdaf643444ca7c6024a19ea4d7fcbdef221ea3
SSDEEP 98304:AGOweUqCMjGfW/NZArTzb6xRaxC3Y1oe:ZOgqCMjGCunMP3Y1o
TLSH
T16A06AF1BA2EA41F9D8B6C074CE529907E7B2740943305AEF029055AA6FF76F04D3F729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 2 IoCs

resource	yara_rule
behavioral2/memory/2800-83-0x0000000140000000-0x00000001403CF000-memory.dmp	family_stealc_v3
behavioral2/memory/2800-350-0x0000000140000000-0x00000001403CF000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
5928	elevation_service.exe
2964	elevation_service.exe
5620	maintenanceservice.exe
2764	OSE.EXE
1856	PerceptionSimulationService.exe
1220	perfhost.exe
2496	ReFsDedupSvc.exe
3608	SensorDataService.exe
5516	ssh-agent.exe
1348	AgentService.exe
4556	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
	\??\F:\	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a92cdf134b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaw.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000078dde7d8064ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000843522d8064ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5454c1b074ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b55c2dd8064ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5fd3fdc064ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082fc44de064ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
2964	elevation_service.exe
2964	elevation_service.exe
2964	elevation_service.exe
2964	elevation_service.exe
2964	elevation_service.exe
2964	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2800	2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	1348	AgentService.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: 33	4556	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4556	SearchIndexer.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5928	elevation_service.exe
Token: SeDebugPrivilege	2964	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3440	4556	SearchIndexer.exe	102
PID 4556 wrote to memory of 964	4556	SearchIndexer.exe	103
PID 4556 wrote to memory of 5564	4556	SearchIndexer.exe	104
PID 4556 wrote to memory of 4508	4556	SearchIndexer.exe	105
PID 4556 wrote to memory of 5288	4556	SearchIndexer.exe	109
PID 4556 wrote to memory of 4400	4556	SearchIndexer.exe	110
PID 4556 wrote to memory of 5340	4556	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1220

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1884 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1884 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 92c83e3704603600c29234ada670b316f812385248e7365ea405a6ac535983cf
MD5 c20d1cb19287074b03a2880461e765ea
SHA1 634d1a214d545ddc965294dddcebf27f007ee76c
SHA512 9a50d6d0510f628bee05d473f23ea5b91566edb6d5797ed5c967f637a8faabea3a46258156cdd416fe1e26ba715af279d2e28b99710de84cbfd9c14014d0f03b
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnTNoKRaxC3YhweoMLa:r3q6mjBUxRaxC3Y1oe
TLSH
T135D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2ea253d15d1e1f2c2e4e8858d009fcce03ca7b775511eed486a82679cf938682
MD5 abe95e82eb0b31db2743a1d3eba4a422
SHA1 7d3d51909d13219c738741e8f61b8e128750a62b
SHA512 ff797a149d7542ab2887ead51c1ce223d69c7cda1cb98ac663a40573cb073a87576f03c5f40510d58bb3b1cbecdd6c6e6a31cae06737cdd0d8403bc02595e6fa
SSDEEP 24576:WXYfDtczAoNou5MEdf/RavguX1c3UrxhVmerUZyLeh:Vtc5NoKRaxC3YhweoMLa
TLSH
T12D05022867D409F8ECAB823CCDA28511E733789147A0E79B03E496665F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7fa93c71ebe8aedf1fb194373ff734fae29b2d137eafb8f685b267946d8ac641
MD5 a96c22ee5c6f699581b70c56db268a7a
SHA1 9f7a0bc998b160a866bce719cc3339ace5d4fd9a
SHA512 1fa73ec84e64dc0dc01cead462e207cb8cd8146a82ce41a567ffcc22664801ea6c061a831c0c7fdc13179f8cff5e3f24d8adc250a00abfd642e4cff7dc2c867c
SSDEEP 24576:50Le5ji0hmxhrMLNou5MEdf/RavguX1c3UrxhVmerUZyLeh:5Pji0AziNoKRaxC3YhweoMLa
TLSH
T1F8359E16F6748335D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 704be986eec3fa9f0e392ee8d0d8fd310035ecb66c56570de5d5eb978c29b915
MD5 a2fd902d647e6de842165f8b1729d60f
SHA1 c690d2318dc0d547fb4a816dec53479cb3f02b89
SHA512 9dabf49d0449e3217071223f6541e67e6312ad183a62b27f25a14a1f024fbd1b10c39f9f1afa7a138fed28811689e7c777542462fca130fdba59e48e34235964
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWj6q8wyupNou5MEdf/RavguX1c3UrxhVmerUZyLeh:x/ezSC6vUzPv+HjymNoKRaxC3YhweoMW
TLSH
T1AD756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f83d9074654097bf667c37d3b987892d019abd66eebddfe248368c8771454b33
MD5 882889852bf6747c70dee14c14e5c14a
SHA1 62c6334fc102fcaacbefaf12436dc9d4cfb3896a
SHA512 1a1f92b09536997c69772bdfd99ae148f64f501ade6bb24ef35f5dcc83c3fce3d9bd56b5ac9ac41e76bacf934c8d894bb0fc1e0629e840416881044b4c2c7248
SSDEEP 24576:rVbqPb88hv/l+BENou5MEdf/RavguX1c3UrxhVmerUZyLeh:rVO88hXl+CNoKRaxC3YhweoMLa
TLSH
T1CB559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 34bbc54604ffe633664c73dd78d1c8d8ec83c719a484e455bebaed1551c81a3a
MD5 0bd9cfb1fc3540c76b3c8ff355ea4836
SHA1 75ea57c9515a4005a076efe8815c11d9b1632df1
SHA512 3cb3115aeaa98ac1f2a127dcbc9a55fa03bfa4f1cf4d18c22e59668598a274619befd4596b95674a4b9ab55bffcfdd5cdc5e64f133ff6123fb56e1516e171cac
SSDEEP 12288:LGHjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:LGHNou5MEdf/RavguX1c3UrxhVmerUZT
TLSH
T1FBC42306890D4684E3DD1334B79B18E5E3684DF5FBC01627AB8073EBDA34A79C92B163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c4a57358a453d197009209dca921bbbe86fd054ad346ebe9acd514d6ef911192
MD5 9480975297d59d3e0b8228b1efc688cd
SHA1 b67cb600eefdcde14ab084a47ada0ea0d39de3ce
SHA512 771ec6a47e73c95fbf9401cb1ec063636deaaf9ceef6e01b0999b93560a5eae963d18cde09e3138938e81897ec64078e0d57bc39e0bfe2f70a46516b95aec7cc
SSDEEP 24576:jJIU8Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:jJIU8NoKRaxC3YhweoMLa
TLSH
T1CE05CF3BEE28ECD2C27E8D785B918640E77278704B51A3CBD165830EDE235E55E3AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b25d24e7d7326e6ea800c3e5d7d7bc6f85774bf6c014eeda11c11e851040d68
MD5 7d4a5fb7ee272a4a0770b85ac0f6fd8a
SHA1 c952b98b5475cb5e80a6d64000674d4fd4c81859
SHA512 437410828019af39764f893193fc7b595e8042e25d48b26bd380aed119c53810989468b5a60a40caa12386d69f1415a202335b0a1efe4e2911ce97ee582b8d7f
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:ZQvGAdlCEL8c/WRNw5CZxRaxC3Y1oe
TLSH
T1CA266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b52e71c26fa27d6627015676016fec4561ba014d9e584f1e3e10350e7d783c75
MD5 0371a266b5e75f28fed1e5c1eb09fd0a
SHA1 5bf3b32ddc0ddcd737c591c2f4009c43e7f4111e
SHA512 e28ceb8f73fb58157fe627736f864f81e8980e2e328d1aa826440045a1d4cdd959a613f69fc7611ca724928d0b970420e9123cecb184fd5be6158d222dcb643c
SSDEEP 24576:mfewsAjSNou5MEdf/RavguX1c3UrxhVmerUZyLeh:UljSNoKRaxC3YhweoMLa
TLSH
T11E15E031FE74E436C3BF0DB61B26C716547C79604B911AC3E3E89A9E99302D22736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4bbc8a0972509060961e7bfecb90867bf73fe3d7f731349ff558e1d351c068dc
MD5 36f6df4ca3855fce67afc537c8305db2
SHA1 cc6c4b4d32e8dd3384777b192892a1e3cba281cb
SHA512 b1c8fb5f9c0f6dee0547ef3b5ab805e846c12d272b3caa207fc5d6bbeab96326c8d78ca409bd9b20492800140afb5cafc799fd698433a0f63a9c0bf40c137521
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHsP3Y1o:GUEtQevvqc2W1cpV20I32sw
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6a8cec7eecaed1cd9d3cbb47d281cf8cacfa940779ff6b91f5bd2ead145f54bf
MD5 b4b0aca7b99cec293c8884842a52744a
SHA1 d2157987f962dbaf1f6b507d7067a7c05eb821f5
SHA512 db4b916a6fd6c2587688d41e91bab46b9ee793234860f1027f3b6b748309bbe617525eb6a7818d6c9caa0e4681b848e6c2ac9acfd39e2c77bada8f8ed7af1f00
SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/zyNoKRaxC3YhweoMLa:boquVjnmdxRaxC3Y1oe
TLSH
T148D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 86ce8c5caf6a767f2a668072e69940750f6556fcbf19dbfbbadfe20d838991ff
MD5 693066cde9a0b3e6bb31c2eea8ce25af
SHA1 af3104e80185a50fb41330ad06e6670800d91376
SHA512 7a1df01203dc2459b0acaa64eb2654d8df04fe31d947912ad4c2dd14a602bce2c38e19b91c630f1117989e807fd49d9bd9a8ed8cb1b0f10831695f2ca8872cc7
SSDEEP 24576:YAhGL6IFoiwtA5l7S539Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:YAM5Foiq5NNoKRaxC3YhweoMLa
TLSH
T113359D81EBF945D4F5F3AA7899B69171EA76BCA65E30C20F2150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d842828019c5b47c656a5b95eed7a5b930d2a07b8988afe58925feb1e1e6e566
MD5 6daf85f3e3f58e571b0d78ef0d109c90
SHA1 335ffc3dcc3b4c7496838bd4b8d4c217558bb307
SHA512 f13b7e1d3ad68d55c33714390b6e7c8a2ad7ed3269ded73d844e2cdb0e23f4fd0966a7e6d38d1cc26224fb6dca128261e9debfcfb893ddac7f8e40a80148c65e
SSDEEP 24576:ywuROWGNou5MEdf/RavguX1c3UrxhVmerUZyLeh:ywSOhNoKRaxC3YhweoMLa
TLSH
T17605F10676A80CF8E9A74238C6978536F7B2BC522A21D71F1760C75B5F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 08e3aef71ebb539a84e473ef13839582739cfab9f1c920c02362c5b91956142b
MD5 dfb585957d66d37600c60909642b88cc
SHA1 3d47ac599c79b2916d862bb1faf5bbf3c4f57c48
SHA512 c1a6aa042ffe97f2cbc3f5a7e7595846fc6b75e4ed8351c74d9056e683a3f70224a254c68808503226e9fa318724622c814da34c5a5b8bb0a8567410f5944272
SSDEEP 12288:GyZ1IyCjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:/ZuDNou5MEdf/RavguX1c3UrxhVmerU1
TLSH
T12AE4120A26A821F8E1EB533CDAE61545E37178A2677143CF165053AA5F33EE64D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2261df26037d83aec2efa8904287d15511252c07c0befb2d392a6b9303cb5e45
MD5 5f88a7963546fe83e8e05165875128db
SHA1 45bede5f965f9169ebbaddd52c2781142bda3161
SHA512 ede4559a5d3dffa93603e84352739753acab3cd0a2ed0aaa82598d87197123b6b845449cc85ca57f25af6a8aa0dd656d9a9376b0349590ed1410ed0627b09280
SSDEEP 98304:KQRQyi36YOcPDLvw2gAf+PN3gxRaxC3Y1oe:hQyiKanX+PNyP3Y1o
TLSH
T1E7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 baa51fcc070deca589ff37125c72071222c88b81705a9fbeac63ee1c6f606ee9
MD5 cf554027a66e9f706cda5c9458c54d2b
SHA1 6cad94de0a36a037b074d78c7718e971e7e2aefa
SHA512 0957b973843070a3240ac3f73e8d271c94ada874aa462eb659904bd774411dc8105f52297dce9356ceb6c3e4a161f57f4fa5d7c801fa271f0ff40c61f7566846
SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN3gxRaxC3Y1oe:YQyiKanX+PNyP3Y1o
TLSH
T1D0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 14168f56bcbe914a5a63c222b8804dda64d81632059cfe0322649665eda6e2f8
MD5 ca134b2cc3018cfdcdd12c9d4c1b4d74
SHA1 3befd905813445f123ddcf0d1e9993b0bfa644c7
SHA512 1400a4faf3f8e700976faab1c8626e96a9d8d95a6643c368ee5bac051f37b666f68e3ef758c541e32684e5145e4021e1eb91fa4ebb993e6ae62ca0261ce2f5a7
SSDEEP 49152:i68Qg55nhkeWu7PNU3/iNoKRaxC3YhweoMLa:gthTRc/ixRaxC3Y1oe
TLSH
T1CAB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8541721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c972642c797da5b7f1bbd974ceb6e2ffb2a21d485097f11fcaf6fb62f74e5c0e
MD5 074522c79feac952df24c08129f0142b
SHA1 7c293d02d8aed51d9f380acdd40078801b11be6b
SHA512 08a4752c05b418f7f2def6550650ae2e5693bb8c4155d12cb79e778c07fa14511c087fb65f6c9f749e5cade574a8bbd4c2ba1f1d88f8a08d9f408c5f8f68bfe3
SSDEEP 98304:Cy5112gYy5azzVvU69nLKnhZHxRaxC3Y1oe:LLIHRWhNP3Y1o
TLSH
T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 634048c1bbaf0c421a24a6b70ea165ddc1444a6fbb2820a9d80965825efc9a9b
MD5 75f0f7c6296734396cff873106c92393
SHA1 6cfb5182024a9303d2eed22b7483f68ba6712d05
SHA512 b80217a5ef336e5761a12fd036f0d3cc5d0f05881e2e070cd92f23caabe82e7ef60d36ebd649685c1ecf85b17784b1f91a35206fe0732b60746d755057b138c8
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl4NoKRaxC3YhweoMLa:7u6JmIxd2d4xRaxC3Y1oe
TLSH
T1DED59D13F1DA01E8D05ED178974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 19aed13b0abc6c3fc2b34be06be2a8d87c194fcdf3ce8f4b7b62fdfd73dbf110
MD5 80fa1d534dd1a6d446162dc3ee541f93
SHA1 1316b7e3b746a34cffbbbe3d82e6b79c6ffa9f9c
SHA512 74336fce9453b5a27babbd4de8439a2a20277facb80351db9777b28aef668f6979bf91a81cdbe912c90547356654d858886936648913d3a78960dc30abd68c50
SSDEEP 49152:z1hpsNoJpF1A67U44CwH7R4xcNoKRaxC3YhweoMLa:zmifPqRdxRaxC3Y1oe
TLSH
T194B5BE13F29901E8D06ED17887569232EA62BC460B30B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 74413d204265e1b96a79d4135379f152e12106a129a59d217de7c98314728ebc
MD5 3de869b1a91e6f2e937d433bdefe5c30
SHA1 6656677ad1110dc6983e95c8e17118ecd019c935
SHA512 4367e726b6f4e881c472e4c9cf5d7d0acf96654e4d3de2528a760b35668dfb8b3cf241826aec33f6ba0ad7d4cf33ae1474541688466cacab364287bc8bf1ffde
SSDEEP 49152:HSuZQIY0Be2KkRVtOnks6NMHqDNoKRaxC3YhweoMLa:d5dKqi61DxRaxC3Y1oe
TLSH
T1F0C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2cb2d70c8ff2cdb1cfe255f3920276ef927e6f42dee444a1677f1dc4f490a004
MD5 477d5ca3edbf4d1b99fb088238a8a6b3
SHA1 726751933210707073c1c8fd1b22790dbfe65a21
SHA512 549c140a25897328c3a7b0319d6c4aa2902c093d0d412b64cdf400eaff121edc1181d6f34e732ec8ac3679124bab4690edb957d24266cc9436174eb2a37f9014
SSDEEP 49152:mhtSn8EApI0figjgiDn0AP5woNoKRaxC3YhweoMLa:nX2iWphBxRaxC3Y1oe
TLSH
T1FB95BE13F2D901E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 593b30730f64ab0aac48006a6035108373e0665f49308b432b5d157c17c4ea4f
MD5 237b8c973226d80af72c1478843aa017
SHA1 3f5c29573a0139f23c667794f9b85851df85f9bc
SHA512 e7fde2f6a0850cbf1501bd102add6712738cb7b0ef46b74ec9331da879024b08a3e3dc7ea2dbbb08df3aec81d9b64a6106bb67d61dc2271cb183b6a9cf423a0e
SSDEEP 12288:h/jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:h/Nou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1ECC42306881E4788E1DC5335A79714E5E3680DF6FBC01237BB847367DB35AB9492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 cc4eb2a0d7df6c7bb5474f61731d3d48da1c43b9147afede973549bff40f8e0e
MD5 61cb39e1ee06781738e702ffc46dbb26
SHA1 43ebe842dbfd624739386e70fa20fe796747b8c8
SHA512 2b3051b9fddbd11288321780ae49a4c1e44b54702e0aaaec1459f735aefb86ceab45fe3aa3be7a82cba3467eeb44b036ec6580c526b456526c21ccc149abf3ad
SSDEEP 12288:ZujXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:ZuNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1E9C42306881E4788E1DC5335A79714E5E3680DF7FBC11237BB847267DB34AB9492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9ff136004e411dd9c98a949751e8ddaf7d386232d400480b3eda23acd02ff053
MD5 9950929f8386a4f762d2a632102bb44c
SHA1 2ecdfd50df4f442d120a2ec0b3acff1c709a5cbb
SHA512 ef6241fa5662ec47190de0bbb6e87dc8b2f8e53e57baaa7d22450cc3c3c46c065531bf82aa754daf41a45a70f18955627d642bae7d91dcf01b88cef7ab10dfbb
SSDEEP 12288:cUjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:cUNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1DBC4230A8C1E4688E1DC5335A79714E5E3680DF6FBC01237BB847267DB35AB9492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 76727423421a29dab73662da36875dca9a41ef9c82142967b1d5e26652d09732
MD5 1c828a5e10ecf47d88258a134ef18e99
SHA1 e22b5e017b2241bb5c741510f8f6855e5b7f63b5
SHA512 0a32781d02d7cb9c0ac0cd82f2d1bf4c33e0b17e091319d8bfe0fd09f5253e9a911c8cc4ce68cf8feb0c78e8b313fdb57c66a01a72a202626b27d37358ab38ef
SSDEEP 12288:QVdjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:cNou5MEdf/RavguX1c3UrxhVmerUZyLa
TLSH
T193D423064A5E02C4D4ED9338DBA714A5E3B47CF5FB51136FAB40229B4F317B84D3A6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7654cef6bd43664ae08d9419efacd02ce3bb5d971c0816a6b9f283c4cee4a9f5
MD5 d1081807694e45b59ca540641ba8621e
SHA1 17b8962ecbb0aa6b1e9785757e17a84e8f9bd303
SHA512 5e718a7ce4dd8cb6759748f01e55ca4005b630a4830708dc3796eddef59662277d47d760030b8eab448ebaae2287f149e24aa97651949121ee5bae44a645b480
SSDEEP 12288:MFjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:MFNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T118C42306881E4688E1DC1335A79714E5E3680DF7FBC1122BBB8472679B35AB9492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e8eb0d9d3019b52da32f6d6d991687e5187e48850706cc68e6d621299be12f1a
MD5 9cbd7d0d61f1aae3467ffba016139486
SHA1 02559bd8aada752b9b8ff5dde3abed8608374472
SHA512 393ce400d0eaec528338af94e315d34e52ab101bce39824d97f774ba4e6679914455d4208f8ed5c1f9596ef1ec46c4d5f6227a613dff115d23f229d250da0c58
SSDEEP 12288:dKjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:dKNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T10AC4230A8C1E4788E1DC5335A79714E5E3680DF6FBC11237BB847367DB34A7A492A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 15fddf2a5e66b64fc98b13c23a166b88cb4ab066cca5f3aaaa6bcd66415fdbb6
MD5 c2735e96d335014fba5e2affd9455641
SHA1 c7debd7f767e92e2cbf5f82a64f71848dbcd2042
SHA512 14da558984299b12c5cff874f8bbfa152c63718ebff00b2eb5e4c673442fa47551541635f29c8d06a8d211623d4d6cad6b7213579546551145f4b4c2f0c01cb6
SSDEEP 12288:gWjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:gWNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T123C4230A8C1E4788E1DC4335A79614E5D3680DF6FBC11237BB8473A7EB35A79492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6a07bb9cc3af9d585a76608df0378c98287c0490e6cef3f40672ba8501e2fb8c
MD5 1e511b1dec0511ce6cd59527cbf1cef3
SHA1 98c8930f336c3aca67fc04d95426ce9ce39f9f51
SHA512 c5a3c02a27440cf6b80a73f2a9a19c75d456490171fda31ab383b437f966b90f626b1238c800d6f1d909e103b61b892ac4d7acd9550c66ad5c009a5cbba2123f
SSDEEP 24576:EZM3zFVSOONou5MEdf/RavguX1c3UrxhVmerUZyLeh:EZM3zf6NoKRaxC3YhweoMLa
TLSH
T1B5050155B35008F8ECA7823ECD564916D2B27C6A5BA0C61F13E436675F333A10D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 591c57f1c2042fe69de16f13d9565cc2bb0cce9bc66d7d99af4b3b4bdbf0e1b0
MD5 bce38e57715a1007fafd73f983452bfb
SHA1 cbfd9349c94b9965072df91694843c647a5b0c55
SHA512 d29e90f8c753406c708f4e687ba8322e94df4f6d71461a2407881444caf2a029c0c7b50f8fe1a19980eb0a24003cdcf308e9f0158036d2ace2006f2bbe8688cb
SSDEEP 12288:TzjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:TzNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T11FC4230A881E4688E1DC0335A79714E5D36C4DFBFBC11227BB847367DB35A79492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 59e20c1ebfabc0b72a4279725b9965497fc16c28b3f3f7d3ab575c97ada408b4
MD5 c833a2c82165ddcbbd0b247d0b6c19a6
SHA1 b93407d939588c47c242c7414915aea292568d9b
SHA512 f756b626ff586ecfb1e83c13505eb1eac0b3ac9bc3a5628f9fe2ed13e05c1d61ddae074b8cae1148d579cc91b16d1cbd8d7c34ab5c0127ffb98fa08ad072787d
SSDEEP 12288:W3jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:W3Nou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T187C4230A881E4788E1DC0335A79714E5D36C4DF6FBC11227BB847367EB35A7A492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f9c743338c1f9615104f3ddf1b0824cd9309acc45bc45892bcd793482b2870d3
MD5 ed4def77f89b3b0edad348836d506239
SHA1 0123835debf4a73897dbba2d5b44f5d1612ac989
SHA512 b2714fff173207d327f4336f92bbc5f8566941c6c406fad5efe9c8a92992dcbb92a01d42c84a77383418195b1161452b3a3408580f6eecc77166d52746a5d658
SSDEEP 12288:LyPz5L8CjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhZ:mzyCNou5MEdf/RavguX1c3UrxhVmerU1
TLSH
T1C9F4120766A521F8D1BA8238C9A21952F37578725B608BAF179013772F336E18E3F771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 20114651dd2077dd31ddeff2ef79ebe0569f4c51f66821181e2c5f2206f623f4
MD5 daf50f2dabd23a96ddc7c61fc120a407
SHA1 d2a326bed4e2273ab6d1f7c301adb828f8cac151
SHA512 62ad594c8631c3595c67e94f9b3f3bf412452691bc94a2c1cb953581e59ddf8d54f859efdb12d744bf8b4450b6f2db9dbcee76ab3528f28e38e4548cde847eee
SSDEEP 12288:gzjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:gzNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T14FC4230A881E4688E1DC0335A79714E5E36C4DF7FBC11227BB847367DB35A79492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 496180b3dddec27e30fa847dfbc5e186bd6189df4eee4f234ab5eb42d3e09c64
MD5 cb7cb149b7d614c69b108127b2e1b25f
SHA1 01d4b0e829c48979a761e7298734898879b8ec7d
SHA512 298b52b1ae3394b2d9ad77bbfc80368a4bd70c6afeea9fe3c089cbf51e348c744260e1ac67d9b98021d026fb4f1a9fbe0adfe1c61d34f894495cb843ab61e9d3
SSDEEP 12288:VzjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:VzNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T19AC4230A881E4688E1DC0335A79714E5E36C4DF7FBC11227BB847367DB35A7A492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f0d3fb5fa9b38d7a05b6fc1e4474d7b0146ef4426b11416c362dc5f8d312e801
MD5 1d21d09d9411d15f1ecc75cef6c09785
SHA1 bcdbd6f23455e1bb7b2dbf62673e86dee3e1ff46
SHA512 a52a4ff7b9f73ed7480b5e7b31c59847c6eb430b3b36fc6a87423c09a8cd26f699200bbdf6ee917d96eb7382fc1969968470a921cefa77815672c561e50620f5
SSDEEP 12288:myPz5L8CjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhZ:bzyCNou5MEdf/RavguX1c3UrxhVmerU1
TLSH
T1FCF4120766A521F8D1BA8238C9A21952F37578725B608BAF179013772F336E18E3F771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b41ac673e19d222703fcd6d02f09bbe556a86724ad690565897d20469d3b5821
MD5 bc6746884192c0f58ba000363fab2498
SHA1 2c50bcc7da5a431e2d8f5ef371bf53bbc7f3bdd3
SHA512 4b097ce46491a9fed75baa3ea3ffa8b51bcfced2820fe36ba6e0f9c6bd1705e6091a1d85c3123d978f1ee7fb2b8ba8623906d569e7c6e7a4b93e0502e20b5b62
SSDEEP 24576:1T8aLl3z0zDkNou5MEdf/RavguX1c3UrxhVmerUZyLeh:1T7LljpNoKRaxC3YhweoMLa
TLSH
T1AF050255B35008F8ECA7823ECD564956D2B27C6A4B60C61F13E4366B5F333A10D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 51b76e7d256cb34b4fb2c7f238fc5b9bb4203b227b2fc35f368099ff1097f747
MD5 063192dfafcb4d19d37b7044ef234759
SHA1 80f2663fe54fd0a0885103606fcb3f2872078616
SHA512 31bf9f328349168e7474e1299a6f786a5dfca66a28193d4496992b92dde4f0914bb9bb0bd02ff03906116412c4f94b4fbe40d11d0c37651954e31e4705e5a31d
SSDEEP 24576:73rd9CHKy7GZANou5MEdf/RavguX1c3UrxhVmerUZyLeh:brd9CHKya6NoKRaxC3YhweoMLa
TLSH
T1DE25CF50F3E410E8F0B79A35C9764511DAB67C9A5B71CA8F03A4265A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b4ccf695ab56426484763a081f188cf3ddba7a81d5cec1fab178400836dd1332
MD5 1a495e533f3f4d50fd13fa15c3b5da69
SHA1 1d1d2326dc1f4c554b1e98ba9e7fe96f22aa25c3
SHA512 0418de1cc5c7ec8a85dcf56708aa9d8fbd640a66abb6d6754da203656f660d5595785f5a3811a769a800b2c0f29e522fa8462a8094069341d0660e18f0f908f2
SSDEEP 12288:N0jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:N0Nou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T19EC4230A8C1E4688E1DC1335A79714E5E3680DF6FBC11237BB847267DB35AB9492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 51679fb2dbc40915269b3b89436f9c7d8257870b1bba3b34af43bb4dc24d3f15
MD5 94a081d74bb6093a2fd52a7b0970f4cd
SHA1 a1b1e2eeb2956525775364025fe70ae888da9c1a
SHA512 1e2fe6131b648bbd3765bedbf83ed963337cc0a9fea5e98cb0cc19ce1ba59896864b345decb41a5d4136bf41a98eadf4bb1318bb8cc2822029567dcc4fd7ed88
SSDEEP 12288:FijXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:FiNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T108C4230A8C1E4798E1DC0335A79714E5E3680DF6FBC11237BBC072679B35A7A492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3fc3db5504c2203ebbca07f2c673e5a7f2c41edfcf71cfacea446e035a2f9207
MD5 a7dddf3bc356b847a7c7c0101cecfa28
SHA1 5fff423e155fda79860c5e5735a9215f80195717
SHA512 8c17a420f6bf5ce9a2bd33dbbbb0f41f264ad26e6d7eae7369300bc2cb066b08e3313973fd714c8603d41d771edf70dda77919e360b89627464f91465463a0a1
SSDEEP 12288:9xjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:9xNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1A5C42306881E4688E1DC1335A79714E5E3680DFBFBC11227BB847367DB35A7A492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 9d60ded03e6a8fbb303bf47dd8cf031956f0e03e54fa48814bb53bb02a5569c7
MD5 9f232ee342c06664ca34873617af6b75
SHA1 e6608f6d98cd2fe92aaaca8cf7b7d6b256b14f84
SHA512 122c6a7f429437c6204ca0ec692414e8c21b9cdbcce49b1791d3b6c3134257c74f57beecafd5a555b0ac1a601ee4c8f768b6e6d35a4fa323115cc7cdc1140779
SSDEEP 12288:tzjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:tzNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T144C4230A881E4688E1DC0335A79714E5D3684DFBFBC11227BB847367DB35A7A492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 4f714360381de32f99de1de8f341f15760a7787cd6698b818a978f7fb0167028
MD5 8305d0803bed20f11dfaaa3ea4fec9b5
SHA1 0ac1d6d7a0de02b310bd865d5316718adf539578
SHA512 094179edab3a3075477238bd280cb567ee5af9cc7bc9e816efd3bb1528cc65869798d87ad1d5ac7ad9057100518528dc95e121c56d0aba71e113911fc7389ac1
SSDEEP 12288:P0jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:P0Nou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T148C42306881E4688E1DC1335A79714E5E3680DF7FBC1123BBB847267DB35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 877eaf4d00d772c1978d1433cada0fee704136567841463b5da9f3f70823dd94
MD5 123d322af61cfbb84dadc6f976856233
SHA1 956d6a67f9c2f89b4d1a8c1a321bcc04f02322a1
SHA512 d342394a2e106e8c384a2df9ec9fac7a786146c67cdd7947d96ea3345e00bfd11f7682efd53c334220eafa6509bc2811351bb531a1002124674be9ae75ace3ce
SSDEEP 12288:+bjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:+bNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T113C4230A8C1E4688E1DC4335A79714E5D36C4DF6FBC11227BB8473A7DB35A7A492B0A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 3b0eb6bf29f8e215ed20955bc88f7801f4784eb898ca184ac8367370cf99f2da
MD5 f8921f56b32afe041a40e4e3f994b35e
SHA1 5c4675fc0021237f97adfbda2fc93bca550a07a8
SHA512 e1e36a4517b1dc5ab3434cbbb733438e844900f21771e2e7e352803bb8bc81b9563d2c2a7afa7c3960c456a092a304f13f88550e6ac3ce74f9bae95f11442302
SSDEEP 12288:2FjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:2FNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1D4C42306881E4688E1DC1335A79714E5E3680DFBFBC1123BBB8472679B35A79492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 2bc2f498afcded45985412d4abacb8114ba85280ec21441c5ffd87957f886e7e
MD5 feec308b413fb241da1d3701dc8b60b3
SHA1 e2dfcb39a4474ee6448d055c51ff0f339b3eef94
SHA512 15169b1ca0fbc1c03e2381ad8bf0a9a08e30e29a0b7752135a72920d3bb293d81522d233907949a11545ce20ea179002da7848bb5a29bd0382337a4284c754ee
SSDEEP 12288:UsjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:UsNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1A6C4230A8C1E4788E1DC4335A79614E5D36C0DF6FBC11227BB8473A79B35A7A492B0A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e96bbdecb33b3a65425c7b2d9d821eb468d554c7b51ee5f6e87315a1caeca549
MD5 04590f00fe11c4c5618d954540ea6227
SHA1 34ca56225616a6c6e0e92bdb573c03c49303e953
SHA512 f760387c846d93d95a033b421a9fa982f916e00211c89dbed79d28d3700eb155d5bbd7d4ca82e857bde61e3984df4537a0621c18d2ace366164e24168a13a8db
SSDEEP 24576:jfwvzk9RX6wkyAInNou5MEdf/RavguX1c3UrxhVmerUZyLeh:2MnYInNoKRaxC3YhweoMLa
TLSH
T1B735D029EBDC04E5E1B7923C99B7460AF2B178691B31C2CF129953AD0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b8039c0f5b7c6bfd8db456edc13ecc028f900aa405deb0e760ce6b879febb9da
MD5 efc14520abe2c82de7a83d49eafaec2d
SHA1 2910bdd0777cf75b97ae0294208fe06ae7bbcce3
SHA512 cd7034258ad6c19f3c60e3fa4a5f3b15a2f05508fa9944fb94c548885c68dc493bcc1597f3196364876c763c202c43975493ab907f8ef7069882df5a859e4428
SSDEEP 49152:qYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0INoKRaxC3Yhw5:VySzPAxRaxC3Y1oe
TLSH
T195066C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dd827ae883feb0b7363892efa6ff4c338ecc83c2bf4cd28fc4cc23d6261506b8
MD5 bbfda4125679487949e77de886e3cdd2
SHA1 58a7c84928bdc394c9030fa65816ae178d3c62a6
SHA512 48f0acb266ed799798d1af54ddef5c07128bb51c1d2deb597f77d5e1f718a046311747d867dfcbdb2ed09d1c0485e25b6d6d3476789b485ab6b84032828b300d
SSDEEP 24576:547Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY+Nou5MEdf/RavguX1c3UrxhVmerUZT:547JUQjqirIhCnDHUPfF/4NoKRaxC3Yo
TLSH
T1BA65AE1EA3EC01E5E1BA923885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5a251f4339011e7505550c26f11458793377b38d45b1873ba61c822c5e4efc44
MD5 59cbaf53187db3186c1964120939080f
SHA1 1dd71b6aee96986b134f945c453d6547957b3f67
SHA512 b4a1231ac4b28cd02886846c317d44cfb7510af50999384016bed482c962c1ad2da76cb05e724153ced4a20fd10025243787279113e19b015f24ae864d869315
SSDEEP 12288:CpsfDjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:rDNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1C3E4F10AC25802D8C0AE6239C7560A81F3377C6597E193CB67C0F67E1F366A49DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe\log_00200057003F001D0006.txt
Size 2KB
SHA256 efd716be1960bfc2442d812f282485afa34b72e2b402b8a0555f3e2f0c969728
MD5 e88f1c8065f0746fdcaaf347f5d69664
SHA1 2bce59ba3e5507bdc9317488d9dc025d5c4a8f4e
SHA512 ce1379e5f6ed56f3e454412b3455f4fe2bfe7c7e967e2d572812f896b877e8b93738c5e0dfe428081d67308a007c28c566a0e85615e87b3cb42c29581ff6a11e
TLSH
T16651586B736FA51F393195B2F3E281F526B090E9934B7CEC622C585C8298B306DDF444
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\2026-09-24_032702ba701635a9e8fbf8d5a191c5a0_icedid_luca-stealer_njrat_stealc.exe\log_00200057003F001D0006.txt
Size 3KB
SHA256 e0a50ca1a9b63a1eb55fca3d89dc7a2cb6c3253c4f270bff8437a1dff7b9dd15
MD5 b2335304d9415e07391516103e5197bb
SHA1 dc09ee2cf094dfb9c4b012249de041e2639520ff
SHA512 2461e719d49b9758918f383d1f2fdcd77a45789c1850a2effe84ab4a818a2837914819b4a3e25b332e4ca9d8264004f391aef18a8b0ff2a0571734b653d8c57d
TLSH
T1C361586F736FA50F3A7195B2F3E281F125B09099934B7CEC222C589C8298B306DDF444
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 7cef5bff9fc8bb712ee85f5fb47431141788983f4a0ddd7bd551df3363eb478e
MD5 bfaadce47aa4d4dfab336ca463a43111
SHA1 f086699c793c35e417a7b847cb2d4f0269ceb684
SHA512 41433deaff1742d94a2e9a8e08fb622e7d3c1597b9aa061707697fa7523e36aad39bdaadf23ee53ba7130680b76d38e329ab20f7c58c690f47cdfe5f5fe2bb26
SSDEEP 24576:AhFB5UPmDAaM4yx4S8sh5UXoXhost1Kk:s5UuU4yN88+YRoe1K
TLSH
T198450601762ACB4FC66940365E36D6CCAB707D05EE44AF0373C9873F9476A59B6F2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c4c72327ca9d20431b54131d3d8b6ba75fce77038486f90f6f996eb8bceadb07
MD5 5399d26ec192d3f1be8d6bda1fc9bba0
SHA1 6299198c97c49a89214bbdbb19d83a9c68a98cd2
SHA512 cb423f8077150b0d4ad432c2013386e0b2cb578e9d1e8eab1507c85309036351f784f949ecbeecfa011dfac8372a9dbb01e179c56beb77c1abb2dc9360fbb192
SSDEEP 24576:p8pBEZSBaQsfx07ebqtcrQWKr2v4WTUb57K+F6jL0p:Dfx0Uqi7Ts57K+F4LG
TLSH
T158551900A5B7EB0FC97A9037563286CDBB786C06B7453F057385893C886795EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 94f22c6b75e7fb38eb583db28938362e2aa114cc6fe0e2c0b03c7b35e353a4f3
MD5 a51cf90211e98c821e4b1bab2733c377
SHA1 705a6293876e5d15777256c72bb95ea0b105e945
SHA512 a4eff314c845fd0f90ec773efd1c5389fb38c12430dc8d42791c46d7b50b1d40cda2a401e3acc1bf4356435732e12c1d1290a1417624cf818bfb8cb5f3f54afc
SSDEEP 12288:F07rjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:OrNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1A2D423068A5D4A48F5FC1334A79B1474A32C69F5EF8051E7FA4073A79A30EF98D3A253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3d5b377510457767c647baf975a069e0aa058db34c3ae6945c7b3a8828c34f6c
MD5 9bd91007ee89a494eb139d99538e076d
SHA1 ccba2479c315013735c09507c30300d1ad62c581
SHA512 2732b80426155556861fde2492616e3c66b836600ad8dccd40835f87be80661f591ae1270481ef3bc64354e372e6e4d66e9d4ffe574640293c14ff1a6c3b8e94
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYpNou5MEdf/RavguX1c3UrxhVmerUZyLeh:Hgb4mBIBhGF+NoKRaxC3YhweoMLa
TLSH
T1F265AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 720d22762f5b1001937c81e622ee488813d8f3a919be7c2d38ad48efa1c8d764
MD5 42de9909364f2f69ac1f09847c67603a
SHA1 2549080c3a8d049eb0cd7d1901d1c84d309cde00
SHA512 97c2a7dcefb011765b18df4840df4b1de2eb6d307c9ca21baa4e2449ce665c46049f6ce4b75a3ef8630b42699e46223f242413802b56a0a6b11e1afa6666ddaa
SSDEEP 24576:lG88u8FpJqH1vzria7/mONou5MEdf/RavguX1c3UrxhVmerUZyLeh:I7ZFPqVya7/RNoKRaxC3YhweoMLa
TLSH
T10E35F22576E501F0D4BBD1388A864663F6B1B4251360EBDF07A88B561F23BE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7d8f13ff2d54d22ceedfd309593fc60ca69f4d1f0870ecd4ceaaabd2a748f1bb
MD5 fd07bde37a94cd5002c4c64ee165703d
SHA1 5a4355f4713806943bc9e832614c98fe1001d277
SHA512 3eae9d7642ad417aef42359861721f1e7380bcffcb11d01f1d0db16cff677ea0660fed8af3d8b518cb11133e9558e341c9e7dc54b19b81ed9d25986f60d50a18
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKNoKRaxC3YhweoMLa:WG05lO43bvxRaxC3Y1oe
TLSH
T1C6D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425032556CF02A486A91F27FF4593E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 626117c4ba59ad4ebe6dc2fcb4c186d224db8c453db2215a997ae908540aa5f9
MD5 cdd24c16bbae7364b5ae428c18f070fa
SHA1 d566b107d25070ad756817d927981ffa3d081b3b
SHA512 c0eb26f0554f960fd744dc952cd6b25c60c1fb4abb5552cd5831de5a4831747b4c7b7a5e9ab10798a346e7fdb7e34de425343a2e0fdc72eccf0debe7cf05600b
SSDEEP 24576:dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnINou5MEdf/RavguX1c3UrxhVmerK:ta5POZ3lJt2pasx2+miNoKRaxC3Yhweu
TLSH
T14665AE5EA6FC01D5D1B9D17DC683461AE5B1342253319BCB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2691eb09a2eee5b6ca98c9e38d89ba355eb31cc6580732652186ffba302e0301
MD5 a5b80f90637da1636faab0ca5e27325b
SHA1 51b22522b2aab8535ebfb6bb90b9e77d00eeb2c5
SHA512 c65f1932d1fc663f7f23aa6b6c35229bc4900446baa5b7cc054934680e06744c87246a9b615ff0368e3e1720dd4b76fd3cd3b365ea06c82c7c5a35732431e16e
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkmNou5MEdf/RavguX1c3UrxhVmerUZyLeh:QNc/zEOVHFxNoKRaxC3YhweoMLa
TLSH
T183857B1622E901E4F1BBE1BE89779546FAB17869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9d2b017ff0e61db3893905065e3036b47fd14d52d41c761bc92fc9d27f4bcbfa
MD5 34daf3219ec9bb114df9cb6ddf0cf98a
SHA1 a78b1858bc0704e0b7c328fdf51b83b1dfce606f
SHA512 8c7ea2b5b921323d18d7a8dc5e054ed56d787d2ea0bca3d5c849c67e6817bb5d7ed144245f76d958e2eb41aadee36f87e93c6b2b3a14ecfa33e69ea2c7aa7f15
SSDEEP 24576:fzkNvNnaFeYhJNtmZBmsNou5MEdf/RavguX1c3UrxhVmerUZyLeh:fzMwBtOmsNoKRaxC3YhweoMLa
TLSH
T1D255AF2EAAB846E4D1FEC674CE238512E6727461173253CB5390C13F4E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e37c0559c9c12a655369f2596bb288bfb2c63548d7cba4d1da85e364e2b79cce
MD5 7e9e288d8fb98502f65de7346c9beffd
SHA1 e6be4c1c1ef3ce617917774f0d0c36021ed53c21
SHA512 be42d1cb7fcc0eb530a16b5e30e5c79cd76efcd471e4c6af327ed78121903c6e8eacef5880b1905008dbd945d477113d84adb8f8fe1c42067420e9946031dea7
SSDEEP 24576:ZPUr+NQ6Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:ZJQ6NoKRaxC3YhweoMLa
TLSH
T10C05F21F66AD18E4E67AE13D8A824619F3717862171192DF02D0817F4F27EE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 99590a48ade41e0230804225afef698ff61119e99123e4973f9c08a4cb96233e
MD5 a2fc5db995401fedfc85e158a1e497ab
SHA1 7cb47211df8355ab55c416dbff510d99e88c80cf
SHA512 cd20db762a672689447ff1bef27bd0301f12346fc09d39a2a9698653135ac3e7d29493f5a4a12cf164a4cbc5ebc1e1c5896dcfc274ecaafe0bafcb4fd5091452
SSDEEP 24576:9D3FHshBIYQgAfNou5MEdf/RavguX1c3UrxhVmerUZyLeh:9DVHeBIAAfNoKRaxC3YhweoMLa
TLSH
T13D25E13EEA5C04E4E57BC27CDA634906E37138A9032156DB12D481BA5F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1220-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1348-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1348-122-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1348-130-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1348-128-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1348-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1856-295-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1856-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1856-76-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1856-70-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2496-411-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2496-409-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2496-85-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2496-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2496-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2496-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2764-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2764-280-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2764-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2764-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2800-343-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2800-350-0x0000000140000000-0x00000001403CF000-memory.dmp

Download

memory/2800-83-0x0000000140000000-0x00000001403CF000-memory.dmp

Download

memory/2800-0-0x0000000140000000-0x00000001403CF000-memory.dmp

Download

memory/2800-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2800-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2800-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2964-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2964-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2964-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2964-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3608-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3608-323-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3608-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3608-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3608-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3608-98-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4508-426-0x000001D58B890000-0x000001D58BB1B000-memory.dmp

Download

memory/4508-397-0x000001D58B890000-0x000001D58BB1B000-memory.dmp

Download

memory/4556-329-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4556-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4556-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4556-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5516-109-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5516-117-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5516-111-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5516-322-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5620-42-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5620-53-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5620-49-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5620-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5620-43-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5928-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5928-25-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5928-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5928-24-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5928-17-0x0000000000880000-0x00000000008E0000-memory.dmp

Download