stealc | 1bba20a9ca8144cfb4be8a9d2bc12a1bd011d1401a4b60431102922c13fc6c88

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
Size 1.7MB
Sample260930-dbs1kaw1ex
SHA256 1bba20a9ca8144cfb4be8a9d2bc12a1bd011d1401a4b60431102922c13fc6c88
MD5 3b94448ecedcab0871000f262a587198
SHA1 8cc8ea6720dbac34cc973c7672803ff8fa97f046
SHA512 e0b2e97919995d6f95fc485d6947f9b03152989e01588f28819f4485587c590f6e4b80652d57e0ca9a91fe657bf82c6756c561dfe24df50cb1684dcc153c2231
SSDEEP 24576:XLED+ugR9Mmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:XQvgTb5+Pl6bJTIZ5jdgpI
TLSH
T15785F11AEB9510FDE1B7C239CD958E01FA717C4A87A1A6DF13D049A66F232D05E3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/2532-78-0x0000000140000000-0x00000001401C3000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
1708	elevation_service.exe
2152	elevation_service.exe
5396	maintenanceservice.exe
460	OSE.EXE
3648	PerceptionSimulationService.exe
1376	perfhost.exe
5204	ReFsDedupSvc.exe
5056	SensorDataService.exe
5440	ssh-agent.exe
2932	AgentService.exe
3096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8de79b7a7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ef8c3c08650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2cf067f8650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ae602c18650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000313dba808650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049e81d7f8650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000cddb0c808650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe
1708	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2932	AgentService.exe
Token: SeBackupPrivilege	5204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5204	ReFsDedupSvc.exe
Token: 33	3096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3096	SearchIndexer.exe
Token: SeBackupPrivilege	5204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5204	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2532	2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1708	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3292	3096	SearchIndexer.exe	102
PID 3096 wrote to memory of 5340	3096	SearchIndexer.exe	104
PID 3096 wrote to memory of 3316	3096	SearchIndexer.exe	105
PID 3096 wrote to memory of 5980	3096	SearchIndexer.exe	106
PID 3096 wrote to memory of 3364	3096	SearchIndexer.exe	108
PID 3096 wrote to memory of 3760	3096	SearchIndexer.exe	109
PID 3096 wrote to memory of 5300	3096	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3b94448ecedcab0871000f262a587198_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2152

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:460

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1376

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5440

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cd41110409e94b93e80050f48a356de582388efe904b9214536613e2de095fae
MD5 cc2c9fc003a6c13dce950d3b6088cfe0
SHA1 3f6c298584c9a851e7b1d01c5f0ebeb74a933eed
SHA512 81a45cc834f7f8d61fd706663fcf5a05a5742a917925ead13dff07c710747c8ac44cad4a85b2e097452f46584a45a2ba0bc96ddf1a76c73c607db0a65c99eda9
SSDEEP 49152:hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnjb5+Pl6bJTIZ5jdgpk:n3q6mjByslgJTIZ5Bgp
TLSH
T139D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 df31cda8b7b76769b7749dacf1e5bffb451211b0ecc8ea28fd520d4a8feab9b5
MD5 645ad8b2e799223d0c777c5d4d68ea31
SHA1 12ee95dfa88696b8fa334ddf83eca7c97ddc5eca
SHA512 3377eec656582909f1a25eb6d0661b9d1f601ca172e2182e0b23b924a267c2c28d41eb43ed2f8a98df3a6250c872775dd0103ac7620ac2d61cd818fc8566cac5
SSDEEP 24576:hXYfDtczA9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:ktcNb5+Pl6bJTIZ5jdgpG
TLSH
T1B485F11967E504F9EC67823DC8E1C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 0618c8545ad09019464b5a7502c8d64b5c2d7e3f60024bbc9839ea5abf1c9768
MD5 b08079a67a5401d5ed5931f701b8edce
SHA1 4b1384cebcd489ade016048f81d333ae7a829618
SHA512 baa9ea75b0467b4de8c00d84805aca41a9b0cebd3a6455419ae2c7428f5b72703a7a19a50b24c301515f834ca74b6261f256c893be71fd4c1699865f08c9d246
SSDEEP 24576:S0Le5ji0hmxyrMsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:SPji0AIeb5+Pl6bJTIZ5jdgpV
TLSH
T1DB95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 133baafc6d4b3f84182cc0b4188c6e6a8306cb9f4ad3c53624bd17e9e952b707
MD5 3d352263a8e666a2ea62dc30f264ed06
SHA1 3a882c1d6f010f846f3476df011f2e3f104a2832
SHA512 fde11610157ac37c2067728a7aa65f0cc9d802d439ae51f1ff0ca7aece8af86ab23a6524648397479d677b81740190570d8f76993cde450ebf10df06c9a9d500
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWj6q8wyuymb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:k/ezSC6vUzPv+HjyKb5+Pl6bJTIZ5jd6
TLSH
T1F6756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6a2f58a46d0cc990c185f853623be24bfabb2b93a055299b9a75c25ebae633de
MD5 fd5d97b44f3ac37e2756e09a31c59690
SHA1 3f69bd9e1f1dde9d4390db4d329ef2948ffe3317
SHA512 dc0fbccd9f09dbf52fd455f96833fd950c30359ee647746719623b45b958ec91d557ea410241eec3032a5bd92113462b9cc7ebbd3c7691c0e77c61d621e97e27
SSDEEP 24576:VVbqPb88hv/l+BZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:VVO88hXl++b5+Pl6bJTIZ5jdgpY
TLSH
T10A559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 89344d8f298af0df830cefd4cf07a32e3bba7ddc8ef39fe607950820be7e1e2e
MD5 7dcb119e84ae0549dabbf7d6ce7262a6
SHA1 aa7354ccb8b55da3b1365d9f6fd8c27ed3695409
SHA512 2cc574c8775391edd861966ec9f21f251a8898bbe94422951efa56cd458515ee2baf20f1a75c5963e1658ec268d008f65ed8536a2b4482d08039d63cdc4402cc
SSDEEP 24576:kF4mb57GBiOl6a8JTth/RWZvR6wQQ92pN30:kb5+Pl6bJTIZ5jdgpK
TLSH
T19D6523838B6930C5E5AB1739D9CDDB00F879AF55CD866BB6C579282BF034349B85230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 bd5b0ef7140a10f2e88739b4120c94863cc22a72e37c37d7561c63e657877271
MD5 a981338091813fdc699417f15e808e58
SHA1 c5ea471c6ca307d67b245c851306ef98fc149f33
SHA512 a8aceed10e9fd6c3e85b92cbc62aee1acc57d29e5cf69d7ce2fbbcb9adfa4c4d81d7c3931c5e7a0227198a0538961fd59ba86df60ff4ace51b2a8587a9a773ff
SSDEEP 24576:EJIURmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:EJIUsb5+Pl6bJTIZ5jdgp2
TLSH
T1F785CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0ecbc3a938aa740ea1ca650c015efe327557a8e838a52d43afc9cd494306e843
MD5 76d39590468cc409b2d175076e3b200d
SHA1 f35b8351276560e52b67fe3cb439ebb781c9ea9d
SHA512 559e920752925f5b3021c449bb75aec69c606352b9968f989fd8f0fa4acb0180776d5378936ce7ed45098ffc53689dc6088f85cb374d93ad1375fcd93c10f974
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THD:lQvGAdlCEL8c/WRNw5C5slgJTIZ5Bgp
TLSH
T1A5266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 5577f4def387049fbeec879a2f51d6e19428b691e3d9293448ffb5b388804a97
MD5 160bd4cf90a6ce3c0cd24fee5b45446c
SHA1 df98a63b83e3a48a5bf77bb06b9b504a665aeea3
SHA512 e760e543274d1321a6fcc09c08f1df81ce91f3cd7f90cce53af4594d8d42dc290a88c01e9c1b38e31d5e7868039815e48558f9391e66750e27a32bc40586dc4e
SSDEEP 24576:7OewsAjPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:iljOb5+Pl6bJTIZ5jdgpL
TLSH
T19085E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 260e9b5688f01911c45e5df2dec6f26497b76e1f0275ffac3cf0f815fb133275
MD5 11a7c45d9fed70b152a623b7a6655809
SHA1 e6a08449c771b5be6f0a7d87f6549c21abd973a4
SHA512 2663d4924fe7d13b55e9243464808316d4f46e57bc06ba8c2b5c93dd436e409e1d37f8a0948a10d9b9288500d7031df7ef57f04eca83a541d5a495481093f1c6
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHssT6p:sUEtQevvqc2W1cpV20I32ss
TLSH
T1C7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 004a53f848fc48de7ce3ada615e7b68ba59c23527a4d154eab3b6fa3a2da6891
MD5 184fd9ac53788fd91dfce43877df19b5
SHA1 819e743a4219deb8d6fdd0e0fac469ff30c83bb7
SHA512 b041b87b50b2a39f6202bedd45aeedaab6456d8c1620c2c0c8542ee0d29bb37d97fcb4532aef9c75ba22dcc58124aab7a987ead90921206c296cb50f13a4313b
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zub5+Pl6bJTIZ5jdgpe:HoqtVjnmlslgJTIZ5Bgp
TLSH
T1B6D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a5b575431e1a2b844bfb40ca9fb8d6f8978e6b9842ef4d10aa5a8b1404998c95
MD5 5193ba7b16bd17b8d1252a8b6d551c0b
SHA1 1b2db1d352639dda145fe714bacb8fd9e1a4d04a
SHA512 1ce9295f6b61356aba897b6aef56c761c539553934ba1a8b0f3823d16c6c641cdc02db6e4b513312a6cf9c85ded11a785d931de219bf5332689b814bea934262
SSDEEP 24576:WAhGL6IFoiwtA5l7S53Wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:WAM5Foiq5pb5+Pl6bJTIZ5jdgpv
TLSH
T1A3359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b637b65f44357405ab8a00d4503072649e3c442c37786d10ad2b932f2247e64d
MD5 c0624baf4d713a96f539499905269c95
SHA1 97b66135b3da06ff6e73e7cc88be1280f518b801
SHA512 706de9da1c57585cbf8dc21da6b5d70261fa07fc813d6ae6e3049381996a2faa917a0589aae64b6220245084ad8fe65ffe3660a355974f261558cb333764ae00
SSDEEP 24576:AwuGOWTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:AwNOVb5+Pl6bJTIZ5jdgpR
TLSH
T13375F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 149500d3bbe5f653e0676d3b797c4dcf17585bd72eae82a7907219853dccbfe5
MD5 92890a20c6ab0261059ecfed971e50a3
SHA1 b8698226f41f8f63f5af9a2f0da0fecedeb49ba5
SHA512 202a82aabe616095ffec0e57070b289b2b742e86cd472435c619ca003367e6a0a9ff5ea1a08d0246d9e77b33b7d47f69069d347aac1f84dfa3e0534c189aacbc
SSDEEP 24576:OZuEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:3b5+Pl6bJTIZ5jdgpL
TLSH
T14665128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c3ad14975793de715dd5a61f51fd131cdb258bb17b1ba998f18563c1918a0702
MD5 f6f26e1b388258e3f3f6e7b222f42ebf
SHA1 a6f9ae9d372d2db59f90dbf91b7cfeb5472abde5
SHA512 213526bc6b60ce8d0e9863da9ec659cdad1a977d0b60df32f4333b82bf7bda7f3e0288b439c11f59dcce037367a453dacd845a41787fea31a13a9015328762b1
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3WslgJTIZ5Bgp:IQyiKanX+PNGsT6p
TLSH
T186666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ae7e98ef1740370d4a14e295a9649f0e3893bdd99f149d6166101f2ce1174d8d
MD5 f22281ee39ff439eb3ac7ec296456e56
SHA1 e6edf331f9dddf5f36591e7c576dc50a41c6e97f
SHA512 35fa5f67578c2d19a8273f473a38262f8852ca8342f40c4970ab13afbeaa76ea7720d1076cc9a16d1061ecb5e034844cfac4c50ab6ba75e47b25db7792d9d234
SSDEEP 98304:zQRQyi36YOcPDLvw2gAf+PN3WslgJTIZ5Bgp:iQyiKanX+PNGsT6p
TLSH
T167666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 feda7a2a9e00c77c729b8355987ee3e5c8b50246f9de3cc634c568737d9172d9
MD5 f13584eddbea67c8df2f0dce2a8352d4
SHA1 629e2b09e38de27196c34c36fd7c291779bddad2
SHA512 bc2ff34a1b7e4fe1225adcbecc84579ba465c34e023f2b0aec27afc9e680b4cceb7aee1324d4ef71053f4005928ba50e471031212b6b71ff3007a3540f95361c
SSDEEP 49152:S68Qg55nhkeWu7PNU3/eb5+Pl6bJTIZ5jdgpp:QthTRc/kslgJTIZ5Bgp
TLSH
T1A1B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 955c5bed9f9d988183f8c74dd899f4e331c2727713c1a2ff9c145a63a62e197c
MD5 08716b8074a12155cd97551db9d36bdb
SHA1 79f3976bffae0e73fbe36f308a1dc6142e3b2c51
SHA512 dac0d5708cab67f9ab04c2e129e7e905fad5e9ba2c7ad7b049a32822e4996a9f39170e547ed5e409ec199c2a5f32954e4dc435ef3efd20d3bce68aab8d06d135
SSDEEP 98304:jy5112gYy5azzVvU69nLKnhZTslgJTIZ5Bgp:+LIHRWhdsT6p
TLSH
T100167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6cfd40b20985fd02ea2bda829708f76b012f6cf487aa58457b353febd0eec4c6
MD5 4873c2ebd547315956a07d6ae957883f
SHA1 06768abf32ac28cca5bb2c4b5902a30d5a080904
SHA512 644977a5ba9cdb00117b95efcfbd2cf8fee00095bd54e6480e5078e9b62c3033b957064d44820d1d1fbb1b46fa714389cfc7b69b4d565044a518d634808943f6
SSDEEP 49152:PB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glQb5+Pl6bJTIZ5jdgpD:xu6JmIxd2deslgJTIZ5Bgp
TLSH
T152D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 31e58234157d1a8aa7d34ec3d0ec83f1531635901c4e08d96dc86bb4f94a60e8
MD5 b96fe86301eba5cae55524c09c4beb87
SHA1 d277b7ad0c08ed83fa4f735ded695da7a27e4a0b
SHA512 1c75276c8174716b101b6ab6108363e09d26ef42d14f6c694104948915d7ed469a326de303ab9d2171cbbf0369b5002d626be60ca3b1f04cc5867f3a0b1a67ba
SSDEEP 49152:S1hpsNoJpF1A67U44CwH7R4xMb5+Pl6bJTIZ5jdgpK:SmifPqRlslgJTIZ5Bgp
TLSH
T14AB5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8027d5b7bc48feba57aff4b887f88697fd3517cb8692afa5e7994bccec80fcac
MD5 f0996a04db4389e886df99838abb85ea
SHA1 077433bf70481c468349451c4e0ea207ca947153
SHA512 0db149e34d8105c97b67f6506e292a788cbdddcde80a7bc2a5c4bd46903b8d6b8735d5b1c84d6ea1b9950e684ee8ded3dfb30124b739df8f2ae82e269c09cb84
SSDEEP 49152:iSuZQIY0Be2KkRVtOnks6NMHqTb5+Pl6bJTIZ5jdgpr:85dKqi61XslgJTIZ5Bgp
TLSH
T163C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9148742534e7d44ecf6f25fb879f53737874c2a0e0e97e5f460ceb50ab5f56ea
MD5 7c3fe583350ece531da3f354c8626045
SHA1 82bdfd9303dc0883ddce0cf2a00da46a02fe6831
SHA512 873e9eb94c5546d7f8add8443fc268368f4be7daa4411572b1012f38bde76c99df15c2fa4b690d63902ac63790481f39cb6ee5817c8577f8612da77acfa830cf
SSDEEP 49152:UhtSn8EApI0figjgiDn0AP5wAb5+Pl6bJTIZ5jdgp+:1X2iWphRslgJTIZ5Bgp
TLSH
T1EE95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9348e40d71a7487d03cc056f6917b5745e5fed05f7e7513b09ed6105eaceb83a
MD5 ebe7a75ff92e1e5e3a2c96cfd3f220fc
SHA1 29ae6ee86ff9274844178dcb503711e05edb6416
SHA512 97bf394eac3f5c5db391f5de8662edc7b8caf52b8363bdd4268a1e69b5c94204bc704f54ce7dcb9bf5b71fef2c2861e7168e04e65f76409a98b7ef89a4a08b6e
SSDEEP 24576:8Qmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:Sb5+Pl6bJTIZ5jdgpB
TLSH
T12B6523828D6B20CAE09B5779D9C9DB00F87DAF96DD8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 2123a5bb895e9bb1ea9e8429e0a2b2eae8fee582feb0aa499c21562b97144f6e
MD5 1fd0d6e69ffad8b1913801360bd031d5
SHA1 ab41292ec6fd4512ca6addd3229b87831ed4121e
SHA512 d516524ef56ff87964afc6c95ab95d268527d44285db6f444400e6a0faa1551536a409fdbb7f6348d1224bb245f821c9ca40822a64d2b4ecb28708ad0ef5223c
SSDEEP 24576:Kbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:hb5+Pl6bJTIZ5jdgps
TLSH
T14D6523828A6B20C6E05B5779D9C9DB00F87DAF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 44da0ba07fe354ec84e52afd6df6c895aa3f504701e3bf82be00d20b92c0c9fc
MD5 58cae61b0d2746d93efdfafbe85caea5
SHA1 8233b1fabb6032ae4ade402a504bda5487fc13d3
SHA512 27af080ec6e951f08c6bb3497d8d897f3f17055611f2ed7923c57dbbd779e4d10608c015fb9f42aa0f776f753db9b2e1453344e482350eed55ca0b4c755b770f
SSDEEP 24576:5pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:Sb5+Pl6bJTIZ5jdgpt
TLSH
T1966523828E6B20C6E09B5779D9C9DB00F879AF97DD8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 dbc53887dcec8e3ba11ffb5ccabe2f037e2a10458ba86af636da8f28ea3bd9b5
MD5 55043444d9424182461389cda5f430eb
SHA1 86f11e022f3326bec526135e95a5d347e0bfc9b2
SHA512 4b92294fc32e6a76bd4790bf005eb761033bd51cdf3b693f4dff9b7e91dd6f11cf564950088b2b70191733ba2a501e13bfd070248f21594da265fd76f337499e
SSDEEP 24576:3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:2b5+Pl6bJTIZ5jdgpw
TLSH
T17B6523424B6A20C6E4A79339C9D5D700F4B9BE96DF5267FFC675082BA931388783134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 754f2d324887a54d6d9eedd6d1eff1ccc7aa674ebd31c5fc173d68c4e96183e9
MD5 8ad8539f76f3a7801b94c04b9ae9baf6
SHA1 25b9fbdb4e06e57418f0fb5f4d98a845645408ea
SHA512 20cf73be588d0f99c294e3fbf1ea658a879a8402493d1818c3a53d1cc8d800c16119e22ece0298b05bf82c8442be91cffaf0ad711618a3de57e8a45e1b335e0d
SSDEEP 24576:P+mb57GBiOl6a8JTth/RWZvR6wQQ92pN38:pb5+Pl6bJTIZ5jdgpW
TLSH
T16A652382896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e7d89281cd82454283d9e807e1d24a85dae85cafefe9b7a21ff70c6c9b617291
MD5 d636b76da009c8db4cfd3867e0ada23e
SHA1 eea5f631e5ab23cadcd6ea0a3c4013e726281335
SHA512 72fe2f2f8d05b62e6c6cafc84a74ac76df9b452ab887554a6196d113d4040cc6df31e26dc2c440be84ea3542c4d02a56a90cbf972db7d3bd334a309a373ca7c3
SSDEEP 24576:QHmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:9b5+Pl6bJTIZ5jdgpW
TLSH
T14B6523828A6B20C6E05B5779D9C9DB00F87DAF97DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 4d6d1a70973432e1699826aa7b29a8ce807017bb735fb36e29d0af075638644c
MD5 5c874c9163ef9dba242f655c8d39e0b4
SHA1 f4490975f2ed15120561570314f3133e50c63b07
SHA512 01a3732085adf6f6c786719bb5d62885f301434191122bad2136d53f7ababfc5f08738918d17d1b2d45f37c68405b4cf69d941959c609b78c22f8fbccad6c12e
SSDEEP 24576:tjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:0b5+Pl6bJTIZ5jdgpx
TLSH
T15C6523868D6B20C6E05B5779D9C8DB00F87DAF96DD8727B6C67D0827F230749385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 511713c91357c3a2a235c4145e0f1997cba45173324da071a1b95d3ac1d1cd7d
MD5 e5dcf3eabe2b5a67af3ef3e62a19f34b
SHA1 ea9d060c0151dc32a1dc0bb4f2264596bd47ed5f
SHA512 d8e492cccb32217e2cbb7892927fa3259810dc19ec4b63425150a284919221fc6b4d2b617383a8dc336bab83836d023568aaf9415037f7e658b862a0cf7421be
SSDEEP 24576:iZMazFVSO7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:iZMazf2b5+Pl6bJTIZ5jdgpG
TLSH
T10585F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 dc5e9e32759488580217d2534457f0e16c657862db7e25a1f0fe84924b2ab82e
MD5 77cae1d32197e658ed08562de32c6c74
SHA1 337135932c68fd8fc0d124bf9a014431e8be33fa
SHA512 047266804eed8febdbcb5f5a38e003f303ee694bf308b9109a5414ee0cd364e9974ec38def4231ff9b09680fff5152c0e265ee32516873a6b17293e1eea084da
SSDEEP 24576:K0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:Cb5+Pl6bJTIZ5jdgpA
TLSH
T19A652386896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 286a89b9a933654e4119ff2f472d435aa5114baa08c96b47bf3e97a0208d84ec
MD5 4d3f89d86f9de6faf86ab39fc88c76f3
SHA1 f1b2248fedcc8a2b6cdba0911b02a60ab80edada
SHA512 a95c3d050b2e59189c7c97aa8b860f3c6315253a23ac9b793cd7bda0e00dda75a4d161bdc5e26f8dccee58c2a36dc1b6eeb626bdc89d5747df6d0495c5df2660
SSDEEP 24576:Somb57GBiOl6a8JTth/RWZvR6wQQ92pN34:6b5+Pl6bJTIZ5jdgpC
TLSH
T1C6652386896A20C6E05B5779D9C9DB00F87DAF97DD8727B6C67D082BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3b4eaf441a1871846fc037381795d2b6d453d58f77fadfe64233fe7a9c426514
MD5 b2a4830e28e6ec16518548b0fd6c4f8c
SHA1 2c34c5e37b3bf529c65e33d2b172b6d02bed3b0b
SHA512 eaf0659afe0e84a8bfb7942b5e3a770111419a9c261140238682c87707c30d3126be747131fa2e5f4e174faea448d961a30d71638cdccbd90dc883e58edd0505
SSDEEP 24576:Yzy/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:Y1b5+Pl6bJTIZ5jdgp4
TLSH
T15375024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 964951ed98d0ec4f47b1e52663b4f9ec92cf53598af47b7b0012ef5dc939e408
MD5 ba45e10b733cb4ec4724e6e52849659b
SHA1 785c534c4285ab6175f1f9f13e1b5094d152bd96
SHA512 79f2ebe4ee44bb5c4bd49574e394d66fd5eed1e2df63e4f7990bd827e23fa3f3e5be18c7c761f2231a64661b2e03a6f9936d80767b89219325535e65038a5819
SSDEEP 24576:E0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:8b5+Pl6bJTIZ5jdgpa
TLSH
T117652386896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b1e2fe8963fb1ab8d267219a36bf8a74fff6568b98333cd0c4caf8ac04e962f0
MD5 f5e4c3992ee4858e79f757cb1bd2ed31
SHA1 275e6a6c2e92f726962694675384192647eb5b45
SHA512 d4a4a4d52ba816f14d2b341f22e77d6f0a69253671ab1b2f02f82623dbac5f47d1d7ae91c6af386e8871e8c3cdbfdafdb07249e61ae0ae3a641ca112ea473949
SSDEEP 24576:j0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Xb5+Pl6bJTIZ5jdgpL
TLSH
T124652386896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f751563befb9544ce412092c8661302c23c465ef358730754a9045836fd85214
MD5 0e852d41028516095fa17928cf531506
SHA1 bc9fd5e68a7cc6a9a0f90df328f528d8fdb54e07
SHA512 f9a658fac837d5ad4c02b45878ef0c6b0b7cf362a7cc9335bd2ee2fcf85357d26bd2162acdb4a222c88a58f249a6a103423e0d40cac87c1fe8230b80ab50ebc3
SSDEEP 24576:ezy/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:e1b5+Pl6bJTIZ5jdgpt
TLSH
T15675024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 0ddc904f587a80c9a76b29810f94930d0bfc63048bbc5ecc0428be0a335e822c
MD5 d15d4d61319023b343d91475e4b58cde
SHA1 5f642bf122f032357475828f13ad357ef75c59b1
SHA512 0f77cfe513e6f194ec57945eb779b4fb1b2375fac116bf21927198e3cfbc592123e684ef677d4323b1ba3614b028486406f9e44eeb2335c300105d293fc0ecac
SSDEEP 24576:wT/aLl3z0zD5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:wTiLlj9b5+Pl6bJTIZ5jdgpG
TLSH
T17285F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 97abe799d98a4c0000f6524a9752c6bcf8a3987f8a7079a1a80ad99e732946f7
MD5 fc45f13fc345d1084eed601f0d90b78a
SHA1 e85167dca5cf555708df7f4d053609e673b06e8f
SHA512 a4dbe573745216efbaf7666700e1eeeae1c5e847c20b42fd395c0f17f280e98a981e03c22e31b56c8bf8dc68a9b14be515478141a44a7dcd4cfd1452fd46eae4
SSDEEP 24576:s3Ud9CHKy7GZVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:WUd9CHKya2b5+Pl6bJTIZ5jdgpx
TLSH
T1A295CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 65413928f18c716b3d7c2afb8665d0a8fc6e86442299416889d40e417a854eac
MD5 3546ea833033bc7e0529ab00af479d17
SHA1 233508ccda54f5400350a52c8e919a7158a1e000
SHA512 0fd715e2d85f61f0b6e59310c47cbcb665c8a58d9f3161f8c04215b9af5f5838b9c873557e8dd27f7a0712246f71b74d7fb233afefb596a7110295f309388d49
SSDEEP 24576:yJmb57GBiOl6a8JTth/RWZvR6wQQ92pN33:bb5+Pl6bJTIZ5jdgpp
TLSH
T1416523828D6B20C6E09B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 893f78e3e483070d5054db6615e733971a172d92eb7456e3d842db623f3cffc2
MD5 16921006ead25ce79410633ec56caf3a
SHA1 705dbfb042f28f2887b9c6407ece3098fafd4747
SHA512 9011cc1ca19c0a93c456bf35cf88957139d3cff1463791a61416b214a508d9401c1c218b963de8583b186c43d63c4ca943cd1e0d236fe6af8fa3c73a58332b51
SSDEEP 24576:1fmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:wb5+Pl6bJTIZ5jdgp3
TLSH
T1BD6523824E6A20CAE09B5779D9C9DB00F87DBF56DD8727B6C67D0827F134749385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 5183a3681302c0c004a4df7a9df81342e4f7ce933e29e0ca523b9aba5e7688d6
MD5 b1d559a424457729190761d95c166fd5
SHA1 d0c2e8660aaa1db86b3a8cb4ee99a54fbc803279
SHA512 9ef05da86a51eda02e4a54c548f569134e801a2792b44c04b858857db9e8481ef75af6a9dbf05d1778a8472121d9d9f0efaf78c0badfb7cab82135c2603fb0ed
SSDEEP 24576:H6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:Fb5+Pl6bJTIZ5jdgp3
TLSH
T1C0652382896B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57D042BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f1e2a54a3bbea99f1f69ed2335f99e61bdd80b5099cd1e2d7469438036b37fb9
MD5 925ac7e3c9586e2984e0fa60ed2ae0ea
SHA1 74c7c716df25f8912d86ee1a6c464abd1fd3c87a
SHA512 a63cfd3ac88cc9de1a8b4b13b7a025388af4a4f08a435b5170999644083b1a713d59102ff7154e823cf90932ae3b2574409550e2c3c993c2ef1684eae50fe227
SSDEEP 24576:U0mb57GBiOl6a8JTth/RWZvR6wQQ92pN36:sb5+Pl6bJTIZ5jdgp4
TLSH
T1A1652386896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 c1793e4bd7dfa2c78a077801b8879d0252583adec3fc86a6adaab8f38a8268fd
MD5 a9e2e863c669c1502baa6e810d86e1c1
SHA1 3229a62fc3d29aaf361b9dccb49fe5280de402a5
SHA512 c7f47f6f43f3017b359258d8e7728a236370e2e6270d5e6f2477b53a885ff889a59b9cba231623addef860caee67a313c03012db604be42dd084d3e8bc637110
SSDEEP 24576:BJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:6b5+Pl6bJTIZ5jdgpj
TLSH
T1E8652382896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 45b6fbe767aa97f06a0e14f29e6fc048718b20e0d86a21e87b8aa94d31aa42ec
MD5 4b7738572b7962dcd7dedc6175e8fe04
SHA1 5484ec2811f706ff6d8143b432026adbbd8cf1b3
SHA512 13c413ad5e6f2362339db1f16ff2d5e8b36e63c33c31189efc9b8f923ecf62f273927d70ee9dd04315dadec1ad058f28f1756cc66f4492cd28c43ec318dc6eae
SSDEEP 24576:A8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:Yb5+Pl6bJTIZ5jdgpn
TLSH
T10E6523868D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF134349385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 9832ec396e56c2ec8006a04f3156c2b5154a687b568639dde30f8d0355516c96
MD5 2d01483f926767ce39488e49fd87c73c
SHA1 008f02b66557fd731cd6acb9e7f2b06dc107c578
SHA512 f3b7a57766af6d492ae1e6371085f163547e18ce6a69540f21bb6fbc2c48673ef9071ff52c66500693d8038b8643487893f21782ac0237b029417fd2f7bcccc5
SSDEEP 24576:n+mb57GBiOl6a8JTth/RWZvR6wQQ92pN33:hb5+Pl6bJTIZ5jdgpl
TLSH
T1FA652382896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 663d53eb0a88a5d53989ca7679b648f3ed4e427dba9c73a9d5f563a864e9d56d
MD5 b60345c9274844a85253a88385a560ef
SHA1 c075a13519f60451e38749a70abf69a611e5720d
SHA512 4fab6762e2dde3ef78e23910163f9cb0812e9e2a9e1100b10358ce1040e5bfa00c9cef4db01a532011da32a51a67d0fb76359b8b461a444bc2287aee01a8ab67
SSDEEP 24576:Jfwvhk9RX6wkyAIYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:OMnYIPb5+Pl6bJTIZ5jdgpA
TLSH
T14795CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c0057f04903d385d13f14a371b1c606d335b83fb1f5301f80b23d5d6c17a1e39
MD5 3e3750d8c4d51036e43feff4a0eff6e9
SHA1 29d0a1a467b51dde966dbd79db754949bc5d2933
SHA512 afa495ddf7fcf8807d2806c9ade7b184f7bb55e473e84a897a85170561f8802feec5db8547e823bb1e03975a0461f462785c6ef2e50d1e1d73b10fe69cb1a350
SSDEEP 49152:5YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gb5+Pl6bJTIZx:wySzP2slgJTIZ5Bgp
TLSH
T1E8066C96A16801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cf0e3d3edabd63f8e090ca9bfac01a6c93b9a2f7b96ae16b90c53d697c3a884f
MD5 c75c3ad0a509c28e63f2fa412b673e7c
SHA1 cd4e7cfc3976e7dbb22d51756fdef689bbb2a624
SHA512 b56eebad78393f2d6eb10b1e2b26310e022dd9e090776e1bf98c427c1401340cf319eb98e115d3b581483721b367b6591d60183c21be72be504b86a4947a32dc
SSDEEP 24576:847Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYrmb57GBiOl6a8JTth/RWZvR6wQQ92F:847JUQjqirIhCnDHUPfF/Qb5+Pl6bJTx
TLSH
T1FA65AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 be2952c6486067a5f8e54ef394ac5ab906d51f94e12e75c2cde6abf92671ae41
MD5 354077c12c4b935def11cb3dc74cc834
SHA1 d26680798fc2cb5969469fdec7ae4372ad30f519
SHA512 821e31f0ce822032477041d022321a657ddd6c6e94c10c296e9ae4f492b480f04111e78d7b8b02e0da01f8b0561cb025f07e5a8c72056e3b152a4b360b8636d7
SSDEEP 24576:rEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:nb5+Pl6bJTIZ5jdgpD
TLSH
T12875F14AC29811D9D06E6279CB858A00F7377D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2af6b9645c8be6ec9dab59d595c435ed7e5dc0637b14060d602539a4e8111d19
MD5 32f0ee040af7ed25d78cf66d05e3119c
SHA1 cc6128e594f7e7f96ecef459efad8a3eb065e498
SHA512 e3354414dd883dd752e5fef5b85a5866965515c4e9c057b1f97546fda5504ea72db4e1993a3cae730bb18c4c6815148abeba5a32098b72b1d95534bd35bf4eba
SSDEEP 24576:6PpQJUPBwrTk9GGnK5Q6eXalv4sCNCtvb8Wys:6QJUpwrp5Q6rv4sCNCtvb8Wys
TLSH
T112352801762ACB5FC6A940322E32D2CCA7707D11EE046F0773C9873F9576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 8faafcedeb19b5568e8b185d42cce32f6f82a22f2b2a55e9a1e0800557b417f0
MD5 a405496dfcc7eafae9d3abbf788beb90
SHA1 5072e7cf3c8fa3473e02a4bb47dcf83c271c6692
SHA512 4c87d159f36405c56f3cecc473a2148f67a30dedca263d097294f3915ba4cc4e1ae2e6c54258b6e5843e79f49fbfecfff546574874b7e14791c101e252a0123a
SSDEEP 24576:Cr7rkc1kkTzRzHGXuLpXbStwr9eyv8f2zgOd6AI/wdn7jlbVYCOwpv:gkzo
TLSH
T107751881A137E78FC1BA613203265B8C7764EC07B7096F17B3C9453AD86AB51A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cd74c585eeb97cab024753520202e75504a2da58756687a158ea4b3aac896b31
MD5 6733ffe83e923b315662f694b9e8a65c
SHA1 a102040083c92e52e6b12c1feacdcd8905e31940
SHA512 b70a3db16b0cde4572e3ddc0a44fb2083a4f4e7bdd4d4b18d6cc45e93ec2548efc9f9e60897545ecd48b2aaea8e89fb709923cb4abf7389f6839647c6eee8419
SSDEEP 24576:3Mmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:3bb5+Pl6bJTIZ5jdgpO
TLSH
T1B16522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142BF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6c6ccf66cd4eb29f29dfdcf233a2cd869a61f32ccac5abecb718e74522f1ec13
MD5 2ace14a82d78b93ccdee004957f6736a
SHA1 58e2b42b12f6bd9aca2b7930b9ab434bb28b5342
SHA512 6b994068a4f08dc1ebc321eee0e3c37eb73bdabe91d97c4975bf07b472c9c7b02687889d066a525d7c84d357681b2516bf83cca99d5d1251f3fae7d31ba90a32
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYymb57GBiOl6a8JTth/RWZvR6wQQ92pN31:2gb4mBIBhGFib5+Pl6bJTIZ5jdgpz
TLSH
T1DB659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 92b3d056f031a2c1e4cb5ead1973b09281210eb0f5ea52470c6de4e7989af144
MD5 a00b0243db4618e4a0e9cac819d96c5d
SHA1 2b0963cae819bfb50e1ddefa9fa2208eb6d2fb74
SHA512 3cfc51cdba9f1f98abe9813722c0c21ce306a09d6978b16f65eba91aad1f6a830d9c47d8fe2984bb76f4f1b99a71677d0d06d1966424cb92c97971ec83cf6673
SSDEEP 24576:MG88u8FpJqH1ozria7/m7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:v7ZFPqVXa7/Fb5+Pl6bJTIZ5jdgpU
TLSH
T11395F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 a1f52d0661b56ed61cc3eb839e487d9770326f6c903bda23f3e1899dbca617a1
MD5 1fb1fc219c81a449a1345cc6b197e6f3
SHA1 ab911843ce95d85e51ad10eb3adc5312974f0a1c
SHA512 1c855cc84aed615482e404a7d9b72d40add99cb58b01edf26e8ac4458c1ca60e16d9479f76778f854b4a270445717d104ad6e0aa90bcc3900ccb151110ef00c2
SSDEEP 24576:hPUr+NQ3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:hJQ2b5+Pl6bJTIZ5jdgpS
TLSH
T18575F11F26AD18D5E67AA17DC9C68709F771B862471292DF02E0813E5F23ED8BC3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e63775726a4ff0ba3bc8dd9d41437257767e6d8d0a5470ea22b697c98a92ae0f
MD5 dac0356678c0a6e5733198e0af0d5f1c
SHA1 89ecfb4506b49d29b6d369c73da7a1442adf772d
SHA512 7a3856827f371d50f2bf50ec70272afacb8cc33bb4e0f24025bf33eaa4c23d65c99667caaa04670cfe3a788ef07e54c6aaad08c287c9dbb34c2a6e8991186d03
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGb5+Pl6bJTIZ5jdg0:tG05lO43bLslgJTIZ5Bgp
TLSH
T167D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ad8a3251288ecf6fe446013639f3f34b19bb86cfae90486a72d046f98096e28e
MD5 a1ca34a2819d45c52ffdc1068e17e1b4
SHA1 44a4e84e105ad0983e358e9f3647441f44f58d75
SHA512 a0fb0ce5990ca62b38f8f97e5c8261f2505228d53495840d7be34446ad5b7b4bb6c3888e609bead50ddcb8ac3dbefd2c5470525799283b9a3e058e5efa889c0f
SSDEEP 24576:dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidndmb57GBiOl6a8JTth/RWZvR6wQQ/:ta5POZ3lJt2pasx2+meb5+Pl6bJTIZ5F
TLSH
T11565AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a85b462f177425f1bee30187a49f0fc9d8dbaf48208c00f1bb8618bdc3a91aef
MD5 9c5a14b419dcb97322f89a2fc206a42f
SHA1 7ee3051c4b695910a1aa568fb3cee1e43b38b19a
SHA512 e6fd80dfd680ea1579d8f5dd4dd3ac7fe23f4158b40ee30d55acf3eeea8815bdd3f6735ca002b86a6fff6680cc5cc130bffdb7f37e997dc7bfa3967f3fc16b05
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fkzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:yNc/zEOVHFlb5+Pl6bJTIZ5jdgp8
TLSH
T1AD858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 144bed47cc6c06c1a6079e80797cac0a32bd8c08a71395e0636cc4052f60cf56
MD5 b517cba5bf22a69faf93f3726547e178
SHA1 036195c57f3843c503cbef6805bccd6e9fdc7502
SHA512 9161acff04d0c77fd97938b54ba1b29c4f5b11d2d4f5396ddd6db9423f01995ac0a11cdc4f6b452a9c1b9c107722ed540903c25f7da12e07597319b25772bdb4
SSDEEP 24576:yzkNvNnaFeYhJNtmZBmBmb57GBiOl6a8JTth/RWZvR6wQQ92pN33:yzMwBtOmcb5+Pl6bJTIZ5jdgpx
TLSH
T15455AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 84ac767f41edb3baf879763e82c12ecb3c60dbf0267242611f548edde473f862
MD5 cc2afe378fb970d8d84329ba97a3c5fa
SHA1 009b531ebea8ad2311ca07cdc459dd752090bdf3
SHA512 20cce248d388bec3999c9e033806a3c1c4f875fe6382632e912fcc2d4e49ea3dba71076f41264fa0bc78d0f4f94cded125d40339be5bcb2e8fffb9db05650aee
SSDEEP 24576:iD3FHshBIYQgAwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:iDVHeBIAAnb5+Pl6bJTIZ5jdgpZ
TLSH
T1E685E17ED65D00E4E47BD27CDA938A06E67138A9472266DB02D481BA5F2BFD43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/460-285-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/460-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/460-55-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1376-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1376-310-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1376-80-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1376-85-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1708-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1708-21-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1708-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1708-15-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1708-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2152-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2152-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2152-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2152-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2152-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2532-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/2532-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/2532-0-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/2532-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/2532-78-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/2932-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2932-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2932-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2932-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2932-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3096-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3096-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3096-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3096-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3648-308-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3648-74-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3648-68-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3648-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5056-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5056-103-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5056-314-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5056-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5056-109-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5056-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5204-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5204-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5204-328-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5204-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5204-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5204-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5396-40-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/5396-51-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/5396-53-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5396-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5396-47-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/5396-46-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/5440-117-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5440-116-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5440-123-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5440-313-0x0000000140000000-0x0000000140211000-memory.dmp

Download