99a2624487d4edc75abdc4c5458452c8ae42fc79c57fcc8c09d5c7f6bf209da1

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 1.2MB
Sample260709-p7ch8say9j
SHA256 99a2624487d4edc75abdc4c5458452c8ae42fc79c57fcc8c09d5c7f6bf209da1
MD5 348018738f8f45ecd124c4c60a6b9165
SHA1 bd7396ae085b4c89404fe0f4322885a5c778410d
SHA512 30615ef4487101790314e40da282a05729f01564492143abd4f5ef7a6f5b29a7641a617f707f06b49b5741a23eaf8807891005c281f182f5bd114b1cd1f29638
SSDEEP 24576:QZGOPs0qHe8o6UKj45fVok46/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N0xKEpVok46LNiXicJFFRGNzj3
TLSH
T1FB45D0223AEAC436F5B357306E7ED6AA142DBD600F3984DB77D4592D29706C25B30B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2440	elevation_service.exe
2304	elevation_service.exe
2488	maintenanceservice.exe
1056	OSE.EXE
4824	PerceptionSimulationService.exe
3968	perfhost.exe
4356	ReFsDedupSvc.exe
5828	SensorDataService.exe
3264	ssh-agent.exe
240	AgentService.exe
4804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ae4236b4af6ecc35.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc9bde95a20fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056322197a20fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001a88b97a20fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dda7bdea20fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f6341198a20fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed793b97a20fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a173f797a20fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2480	2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	240	AgentService.exe
Token: 33	4804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4804	SearchIndexer.exe
Token: SeDebugPrivilege	2440	elevation_service.exe
Token: SeDebugPrivilege	2304	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2052	4804	SearchIndexer.exe	99
PID 4804 wrote to memory of 5980	4804	SearchIndexer.exe	100
PID 4804 wrote to memory of 3636	4804	SearchIndexer.exe	101
PID 4804 wrote to memory of 4836	4804	SearchIndexer.exe	102
PID 4804 wrote to memory of 2916	4804	SearchIndexer.exe	104
PID 4804 wrote to memory of 2452	4804	SearchIndexer.exe	105
PID 4804 wrote to memory of 1060	4804	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_348018738f8f45ecd124c4c60a6b9165_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1581435544-3586420778-2104125077-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1581435544-3586420778-2104125077-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2968 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2968 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8fe78d3bb7d199dada578cb2d685b32a61760f96e6eae03f0aac19c8ff515dab
MD5 e566ae3057bfc1f263d3448da795a30f
SHA1 4e8ff4ee0cf2085a23e2a330802b07eb99799a97
SHA512 040836ef72cfd8bc41f6a31bf6cb083fda18cfcf244bfa3d85599830c8fc526a96e252d30e91e0c3e6ab9957b152b13cbcc26b987b91f04606117cb0b0f6a162
SSDEEP 49152:9b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnjLNiXicJFFRGNzj3:D3q6mjBo7wRGpj3
TLSH
T1ADD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 65f3f5d5137d761cf3ea4ba140e50b92eb4ed07b94c89a58a91b127bc5db262b
MD5 4a1cee5ac222f6e71c481f574662aa0e
SHA1 6a12e0cbc2408f1fe8494854fd6cbbf82a5d6575
SHA512 bd616faef236942ee632b8045cc9e52d76fd2d0cc3596c49e496b93a5f3edd6857bb12abbd9a6b0921f4d40d1984c77994b1855b94f7d54ef38e4ca0777cc8d5
SSDEEP 24576:eXYfDtczAM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9tcpLNiXicJFFRGNzj3
TLSH
T18175012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7ea56d573d1522f8611bcb305e6ddab274f33870d7b3533bec2b0223342ff451
MD5 cb4e9fe48991f92ed34f36a2a79072aa
SHA1 ad3877ae82cd26a1362d0e97a76f6b187389ef21
SHA512 be7fb7e0aa102c6869966b62a4fea3e337648ec1fdf5d311afd7b30a5829391254ef963d3fddc70944b3ac97180db00c7ee69f39745353d6035d1d0e58cc56a5
SSDEEP 24576:p0Le5ji0hmxhrMb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPji0AzmLNiXicJFFRGNzj3
TLSH
T191859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f8306e61c855524cc71ad673a3496eac0090949c5f53d23f829cbc01f7ec4ed9
MD5 d4749469bf56c358d7679403dfb4513c
SHA1 07de89d2d79fe0c6512b9085c3503b0fb9372510
SHA512 9ac56797862783e2d49e5670d2396a4f22c0349bca9e005721ed61fc05943ad0d8ec6a9842289daa7a2bd460a0d7da255caed2df02a057229bf53402911cc8b9
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWj6q8wyu5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L/ezSC6vUzPv+HjyqLNiXicJFFRGNzj3
TLSH
T11A756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c6953294921b69276ff8fa04dff4340d0b6caeace42a98dea7150dd124f3f01b
MD5 67ce55e62e4ed346e9a6b50920c24bd9
SHA1 0021161bec56ae785457ff2b147459585d810d5f
SHA512 556b724548e366b65b8fb7e0f6dd1d4597dd31b153fa88603333359b2b362bb3ad8b8196e3847e0122fa04a00d5525602ae43f5a29fedaae451dfe25c93adcc2
SSDEEP 24576:AVbqPb88hv/l+B4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AVO88hXl+GLNiXicJFFRGNzj3
TLSH
T1F7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1e8f15fc727f8e06c721331cf1abdd89be4c894996863b704701b23f9816aa63
MD5 04ac28b5ecc4615394807f67e5412577
SHA1 7159f82aa5379b577bfc5a36dadeed955ceda54a
SHA512 205982f197061c1e04614c37ab9297d5a56a8995f3c507575f8554a8c9cea0dc696fa18837fea9d8ec8758da4e6ed96ec13d2a518b667b4d7a07976f919882eb
SSDEEP 24576:kGX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fLNiXicJFFRGNzj3
TLSH
T1825523D3468854B1FBFD003A867A5828B5845E2C8A595CE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ad54d52d7ca4cff49b7f76c66e6a605a7f36585fead61a326417510191bc6a24
MD5 af0478bc08eb7b2a689c6d7e54e1a62d
SHA1 c9387b1fb00c035d9263d37204b0e96c849cd479
SHA512 b34dce9a1bf7700095ed687a042294171cf5b72cb78ccf39e02308743d6dac1dabecba8a047aa62678172317d08c2eb9e248019c99f76cc65443c9c177ceabdf
SSDEEP 24576:QJIUQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QJIUQLNiXicJFFRGNzj3
TLSH
T1B575CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 081646bf0267fb08ea70cc5a249d88ca151864a4118e4153652931307f65dc95
MD5 721e92b31a380f56f512d4462a2d5700
SHA1 6fbce99049bc5bf76888bef810b3c715d480d4b2
SHA512 0976f1ad3f4baa1a57f29c21dd447ac5d6816e2b3fb8b4a32a1e9fc13f44ed29135c2652e391462dd843a212e7b1e4cfb960da74bd0fc69b71472c2ebc7aaea2
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THu:8QvGAdlCEL8c/WRNw5CJ7wRGpj3
TLSH
T1EE266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 72b6d3393ea0d0434c6adb38a317c9d65438aef8663e4aff6eb01b196176f35e
MD5 1182b5cb2ae545c0d36a373ad309c74d
SHA1 3836f7ef60950276c8539bcb104db252c91271ad
SHA512 65ea0144c2196e470cf572389779c85ab691d9a012216f6b8504725d7a75b2b08aec6cd6bbf21d3122ae2dcb9e029819a566409dfbe10c4345abfa1e83d3a5af
SSDEEP 24576:yfewsAj2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:olj2LNiXicJFFRGNzj3
TLSH
T1F275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7873d275349ddd67c3b09adcc543f4861b1bae38f3df943accf5e20a5b87b5ad
MD5 3ec1528dad8e0701591ba234409a6cc3
SHA1 f70e5e507da1afcc074a4bdc06d25cabb6846457
SHA512 89ace9c78a008cfeaf399d95b9dbd1671b9c1e33167e1edd78816d6839e5032343309439291a2a7cb3f639f78f1fe5167136a77e461a2812cd693a30fe2721d5
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHyF9:tUEtQevvqc2W1cpV20I32m9
TLSH
T17C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2ab5a124118a831f557324bcacbced5d10788941d207a52c0dd7a374208d0293
MD5 69ef3b6eb79c783f235a2aa83278b1d1
SHA1 5f1e0f165b20e647ce17030742350526c9b8a84a
SHA512 efb4f7365da46aed3ed1a57846d144d27547900397bc350c251ea8a0b5bab7f93ee4d397564266f43db11da3820cb26da09b5471557768d7a741734b949eebe5
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zWLNiXicJFFRGNzj3:/oq2Vjnmt7wRGpj3
TLSH
T1D0D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 588e8f3fbee86d7d7735f9f292d37175682d387c20b74b921dcf6178d5dbde10
MD5 82ec96de9d15ec7b5f54a40b26c81ba8
SHA1 0b50caf7c75a6885e015ea5c929e038d72d177a1
SHA512 f895bf871ac3384e1ae54e43e29c8a299cf706a976c78c733f36b24537295797b18914f1755130814cc5daf21ed9b462badb33943bab709baf838587602fe0ee
SSDEEP 24576:TAhGL6IFoiwtA5l7S53N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TAM5Foiq59LNiXicJFFRGNzj3
TLSH
T1D5359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3e225bbc7a364c25a9569e510c9518452f89c1533b30b29d7946147312d18bf0
MD5 44cdf657844b4c27a518c29e2ee025dc
SHA1 d689b4a80bfe708bfe75b68288fb33d176cf3739
SHA512 c9be66e22a5244d812770c8f7882d954602529ac361fb5f4dfb098b855ef721ab11d6f3eeed7749374fbbc137e66c34eeb72fc88bcedc93222054a37f14a057f
SSDEEP 24576:NwuROWK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NwSOxLNiXicJFFRGNzj3
TLSH
T15865F08632980CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 071680850054a2f6c1e91e2b54e28715e1b1a8be5aa01dc69c9f6c20b6eaccea
MD5 d6730f341a5408f674a6ac6b14251271
SHA1 f18b44a7bf241e812ec2e5dfc5e8395b889b0630
SHA512 652149f829f36abaf2a18d8b02afb5bb4bddb3e53744245b6653fe25d180556c822426a3d339a24df0c7d54ce18610a046d4cdc19cddbc8cbcceecb0b397a774
SSDEEP 24576:hZuz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wLNiXicJFFRGNzj3
TLSH
T1C955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8f445c06fdd2e227aa9251572b25ec240b8150678b224cf2c6d5725cfe177127
MD5 a94b2c015cfacece72e5f24aba647073
SHA1 5a24a9224dd7c74b22f27f18074108ec8a51d934
SHA512 e6bfb088bc03fcaa2511b82696aa569910106aa10745411403306a5d01a7b414313c4681223a878c90ddd4410d403d3e12d0a270de078ea8327f47dea23a1111
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:xQyiKanX+PNgF9
TLSH
T145667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 20cc3343c3d7bf33674cf1dce049186836fefe66e07dfa7e41869b647c7cd7df
MD5 7ce50ed1ff58d512e9a440d7a7cd44b8
SHA1 7686d6de8ca68fd2c55976df7cd190d126a478ad
SHA512 09e33ee5792db41f001a63175621fafb0402ad443316d1ff5f7481ad161d61aa8cd6055726eb6047a6fff1c37d0221597d7c147ba65e4e60bd8e0966a62e5dbc
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:aQyiKanX+PNgF9
TLSH
T1A7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cf1aeb49375f92bfef93fba7f92b33b18f8831ec7e758a1d76a3b384d7fff72d
MD5 e3a0bea1fb132bf01e5fbd4fa4ec97aa
SHA1 e033681a45371f68e342af29a0316d016deaaff6
SHA512 b8723ee4ca85c567fd4bcb61817bf15162180c9000253aeed73e8a29795486b4c85aaa48f1f52b066e7dc156804399fc1caf6a010e0059999258a71dfc5bc8dd
SSDEEP 49152:U68Qg55nhkeWu7PNU3/mLNiXicJFFRGNzj3:+thTRc/m7wRGpj3
TLSH
T112B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 78aa0b26c36a3793bb4eb8524cd0fd0f253aa2997b9d773dd040db3a5861cfc2
MD5 7e4998af09ef0238a036ccae4c653023
SHA1 ccb28a275f6f886485513ce4527ab1627f2125a3
SHA512 d42a918fbe58761877b647deb7942dc3c4a19b8c82a5e14e3cee98ff69c7eb3128679af4719802a41851d27240eda9e0323375558639ea777b0ac04b12c2dc2f
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZX7wRGpj3:/LIHRWhJF9
TLSH
T170167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7d7c671b2bdcf34f1abf582d54933e859c8045dfc8bb45b0e60739e77bd9ed82
MD5 10517d260617a00fedbdb106dc05dfc8
SHA1 16329426541361bf95dd2a5c22aa60713dfa0782
SHA512 d4cd8970d11e0ce9aac189fb6668edbc26b186827e65081e1d67ea8caa4ab5ef6b5d4e2ef556c7094ceb109558b05a8404156fcb42116a148e7158eb71417f05
SSDEEP 49152:lB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl8LNiXicJFFRGNzj3:Lu6JmIxd2d87wRGpj3
TLSH
T128D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6339cfad48de0a842d5dee7a3865ecc00fcc210c79d611bc81627f36e8348ea2
MD5 68d0e80c77c7ca7539a693c9c56c6472
SHA1 73e47411e030471d7805b7f461b2164a86e88e4e
SHA512 c0e6df9a6971ec2d646d34e3159322a8730c7eb7e9119a87fd4cb98117f58052ae2c182e5b710aa857a37445556652f948c9587a6f9016dd2be382fc5e9ae10b
SSDEEP 49152:e1hpsNoJpF1A67U44CwH7R4xwLNiXicJFFRGNzj3:emifPqRt7wRGpj3
TLSH
T143B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fa04ed71f670ceb6dd5607f633348ba6c993563a2e63fb1e8f09e1a89bf63804
MD5 afb0a73f931ecef55d7f4309ca13fe8f
SHA1 3ae75a89608a20d8dd77a0188eb5702fc4a1b9ec
SHA512 3c12f6bb916999e0d05a092c2ec8b9d99003cad4a95fe43fd465c5c2e6e1d4785cd0a7c2cf3c6ab2360c06a111e7ffe2d9a34b259f18bffa75566a95d6e47e36
SSDEEP 49152:2SuZQIY0Be2KkRVtOnks6NMHqzLNiXicJFFRGNzj3:Y5dKqi61z7wRGpj3
TLSH
T183C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 53b5cdb7c1419d05c3ecc3afebe4d6d1bdc591a7f2b726e021af98d3d98d8746
MD5 7aa5c27e2ca623e1ef588347570d0e57
SHA1 161cbc774faf46b59f2b35fcf05a792cda926074
SHA512 26f844986eb6fcf43b17543d798f94b8f608e5c17ba9b6cb3022aaedca686a3e7a629bf30e212dc26b8b7b73ed08af4f6a948deba9d75f97311a779f73c1642b
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5wMLNiXicJFFRGNzj3:WX2iWphR7wRGpj3
TLSH
T1AF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 601acbaee70a3df32d0e99d3ef87e7968aa3ed2a81cb3d54d5816f5f8cb3f1ef
MD5 8af68ab99aeb1082313c8fe128ed2d29
SHA1 eaa656bae236b8d27fb772118f8244bf21edbd3f
SHA512 af430c88de76eb62d2946defd9b3405fb678ffdc0aa4ea80a4812d9cdc51bca8ba81986885f154bc7e91573ca48ad1a1d7d20933452ab096390f5749e7881656
SSDEEP 12288:z7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B95523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3083D1EA278FEB9F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7a0e376b59c7a77b21eb4da31212e31ff57a27a8ca591c07374c7a577707e15f
MD5 02868df505ade97badc2774c27cd9968
SHA1 188c63624d8c92076807c8dbb51d750926c402c0
SHA512 5a12b9fbe84ee403a3550f096c26df6fbcf60720d41aa5b24bcc95be91a8fdfc28ba34e45f92790f2bdab8ce4f447a404f6fce919ecf319f83fcb85c15850819
SSDEEP 12288:DAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3548955B1FAFC003986754428F5886E2DEB5618E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a95e26095b95fb4ffd0c4e9cfca0e80deb29babe48561f3bebe63ea1cecb94f6
MD5 1e2901f5794f9aace68ed3709f2ef778
SHA1 037e36f77b21c3d7cc2c5b4dde8f5f5684d425ca
SHA512 1b38a154e33a9030c21b91112d978d2be0a8e9762a1719a0d50de70a6372fdd51344518dd93b6f41877f3646fb1c96206449519ab76bd661606293e8c3fda181
SSDEEP 12288:yeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3548955B1FAFC0039C6764428F5885E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b861f1049762517d41ac783def80fcaef41b1c2da948e2d51e0af896c571cdac
MD5 375c220620a4c45c3e1868fdc497acf5
SHA1 a477625ecb819211256d21fe9c5cd0d3b97bce6a
SHA512 f4675373c249f14d432278104dfb3d05bc2161695e70624ed2cc6688a23306715f1ff4cea75f3763ef4e1190e733283dd26c60c52addaa3009ce7ce69f160085
SSDEEP 12288:zVBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E7552393168901F1E9F98039CA764424F2947D6CD7325AEBD3003D1E5A74BEA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 58873b026e722aabc06b3c45df141bfbe50405420dfe1d32ea73264c1f9aaa94
MD5 b7ec0f3a3aa26373091f3e69f0d80a1a
SHA1 586dc572c03005effca752ea10c971d2bd132a5b
SHA512 a7336ef93dbab20773746d8ae2e8022015060863555c7d27ae527ef3152298b2c38ded486dd3aff9dcf075cd7f83ca8db1f1bc5c5e52eae305fcc39e4c23be27
SSDEEP 12288:tJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a2a5c032e9ef1ad5ff108605192866a82f076a897ccbd0ac0f5f7ce1aee9e973
MD5 2cb123830f03c4c665e693dca8c91839
SHA1 67d619d531c41a7035575b2503ccf8e6aefb4dab
SHA512 3ac7b9c74e1f842fa784db9cae602d748192f3f35f4f54e42e7f9df4fbb882bae8922755f9120dfa64fee75215f5925b703e10dd9ae56f92cc9ad56315dd6702
SSDEEP 12288:cEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3558955B1FAFC0039C6754428F5886E2DEB5618E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 99018924bd197cce4879fc0daefec4bd46816a26f300f4536fd22dcb36cb306a
MD5 f95af94c01155fcf12b9a4e8e03a8219
SHA1 d188588e2e09adb2875d269b0b9f0780b3213fab
SHA512 f254e0ab2545e0010a36c529c8764f7979ad559533bc267cdc812647bdceaabbd73f3cd0294c69e630719472c1528ba5375847a9b1afe9538b11cc5454403bd6
SSDEEP 12288:dIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1635523D3548945B1FAFC0039C6754428F5882E2DEB5659E3E2083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6ecdc8d81da59403aea37c185ae6d8bf467a24bcde5c2a4af5b32fc5fa5d0735
MD5 9dbc1422be3d385ecfd616b97c761dd4
SHA1 e55099080f2d22a13eb1cd07ce3fa27013275310
SHA512 8152dcc5d64dfa0cfc14184b494c176aba09ff7401d064082757e56c72e8ccde0311c0db064d0e169e20d31723b0319384e6a460a07c2c06e535d92a21a3dd2d
SSDEEP 24576:hZM3zFVSOy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hZM3zfeLNiXicJFFRGNzj3
TLSH
T129750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 64d463466a4de3c6ed730d02c485db469ecc230eae6f510c857030117cec97be
MD5 8ce38804b5e37063772a83fd8f32d52b
SHA1 b6335a7f5effd4ffd57730b60a71fd94d62a3fab
SHA512 07ff45d63536dc3ecf1481db9ea7f8ace13698dd8f85390219d7efcbd9786af785d4262e3c5dd6eba0d2d05696d46c95ada341c50546e00cc664218b324a340a
SSDEEP 12288:63iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D3548955B1FAFC003D86754428F5885E2DEB5618E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 86e0e85f57ec4f30a1cead8cc7772a8ae6a68de151ec3645b7aa5c40ff2457a6
MD5 3088da9d34904ee14d9b5dccb452e398
SHA1 68ec24c01b8823ab3dc7348241b28be1300db924
SHA512 95cefca5c344e5f822a9036ef8bb2ea46f5f18ce9e60bcaaaf664c1455d6faa121854609415cc58eb6747fc18f3737cbe3fee8b70707cdf851cdbaf825956230
SSDEEP 12288:xTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE5523D3548955B1FABC003986754428F5886E2DEB5619E3E2083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5e4df4d1c13747a697079bcaa26b3eef594d3cb632fdc29bc7876980ea8eaa7f
MD5 7cb192f14eb49cb1c6c225ba57ac55e9
SHA1 15f09b510ba8a3d45b631a8f3ee3af409c4e3185
SHA512 d7b2836810a9f1c1e1e9c428642781f2c4a019b5e0dad396ae2b3b142dd64ee01853bfbe7796b171b672cb7391fb6616bee452d5118e258fd20ba107fb1c6397
SSDEEP 24576:nzyG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nRLNiXicJFFRGNzj3
TLSH
T1E0650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 05ae5238695f72be49173d9c8c81512bb790010dd868bc0f913514f4e9d81f54
MD5 04b8740770d2801dfdb7c14d83e6089b
SHA1 7d1405fa5c322e9dde96f9122d9f237baf328583
SHA512 ece0fefaf2fbaa4b3c3f0732f0566877bbef50cd2e74c707a753ab551c8f39df823e8986b92a96c9cc5746f1281c982351a127865c75daf857b6854df4d67fb7
SSDEEP 12288:A3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D3548955B1FAFC003986754428F5886E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c6829d8069bfaa93cc12d1a8355215460660ad2d9bfcada5ce49a2c6f74c6ae8
MD5 2c64c358012a12efe30effa1bbace46f
SHA1 d9fd74d159509baad9da5cc044a6df2e3edfff88
SHA512 e9d19f8c390fd0e3b1e424867734f6955a351ddda5e1e069041623be58b16243381a30d7e4c704f9803aa9b92ad7b47b2fd90afcf37f739fe721305160222945
SSDEEP 12288:Q3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11C5523D3548955B1FAFC003D86754428F5886E2DEB5619E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b2c511b5a94198d8deee716883be9e878011ae99e00acf212f1b0642f65ffc4b
MD5 5a20f37ba01427f45279deff8d7554fd
SHA1 f1e2c086ad6aaad43c324fb04ce23f05fe4c3ced
SHA512 5140756907eab2d7151545f8f175c158174f2d196da075a74c695c8f774e31e12b66b4315aa4e224711b41da2d76f0b5a2bfa87605bb1fd9f615586120d25ae9
SSDEEP 24576:SzyG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SRLNiXicJFFRGNzj3
TLSH
T1BA650247629530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1d770ce5e5921665bcbcb1086f1eca3306615b701ebf92fc5fe58c68bd32b986
MD5 1eb64dca872946ef96835c4e50a870da
SHA1 e56b1cb58bade8ac5a301f77b886e3a6374dc18b
SHA512 9640856a2e139e8aef2d6861a64ce01126b8f4355da91ccb3ca92b8873efa5cff43ccb4af0ecfb6b8ed646960eb7f99efe5ce5b2f7db9e7d5ad77d1f1c51f539
SSDEEP 24576:RT8aLl3z0zDY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RT7Llj5LNiXicJFFRGNzj3
TLSH
T1727502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 68143a333cd40a3c1743d7d6e34c0e94f04b922eb714dbf5cc9df3a7e8be1586
MD5 921491462732d91b10e193431bedefb5
SHA1 ff5c416e04a70f8c86d0569c8f087eee0d73f7e1
SHA512 499cc5a6e3d43031b729935cf4644accf4a4a611003b80cdd231cdf69340f866a87e4be8323cf3f856fa753b016a81169106b6082b5ae15a8b8232c8dc0c18ac
SSDEEP 24576:c3rd9CHKy7GZk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Grd9CHKyaeLNiXicJFFRGNzj3
TLSH
T13E85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c5db9c88f5985203c59aec2bdf05f9041f745d0065b5946ae5f0f149492b4003
MD5 528dd4d6feb71a91d2b76e502e9e2a0a
SHA1 6e83647a6b91383139c721c670de6035295149a3
SHA512 95ecb4189a3a1f49d94d217651fa39c0d28fd804ed7c3c19435e4f586a8f089d8ef4b5491bc872f279a921b6dcef5abd71fc958b427a05d3b279d56520df0daa
SSDEEP 12288:y+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 825c589e4d5f2e6363df5841542b6b0d2b6a63625775214aeb5534eace8b526d
MD5 1488287b8048769a2df752ed2e8c88ea
SHA1 f6ee886740ea878cfeb64a005e4056227435cea9
SHA512 2b89a4c971c139dc9c84fbfe1ea5531dd815d57a76087cec5da4945eb3ed00c5fada4e234b020d22bdbbb9a5cd9633301fbc60aeb9d3befa67b87824239750ee
SSDEEP 12288:JciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11C5523D2558955B1FAFC0039867A4428F5882E2DDB5619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d24458a48f27a86d4e8e88983d9ca6a4cd65c8dcbb9b9619eecff4ccf8f7121b
MD5 36c0a7e7e06bd3c3edd1d73e91f08608
SHA1 f7f469c8682d222dfc06a6817852fa6a9994ad68
SHA512 f7772b1c9259a66787f75c136578edff48293fec4115c6576c647a8bbb7fe015c024242f1a41c2eae76b2dcf0b0024dee255b3b8b6a8ea2f767f6d8f3cce43c9
SSDEEP 12288:x9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1795523D3548955B1FAFC0039C6754428F5886E2DEB5658E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 31cb9ff9fb713e9a9aa5100b6947e3bbe4cca7578d92b7020d9c20ba1ac60feb
MD5 c7d6cec7c61dd8bc0aac62c4334523a0
SHA1 838080b4497a951be1a01c4ceef50675c03679e6
SHA512 f3ac9cff9bb1352174cedb6cd4236a508b97b7e088f4f157cbb855e724de03fd88273ff2168adf8fbf2f5ab32fc20ea8b9267a15dae54f771b5f8289f1f8ce0e
SSDEEP 12288:o3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D3548955B1FAFC003D86754428F5886E2DEB5619E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d4b4d9a73bd723646683e2afc499384c194c84531ae1be71618c5330a60bf422
MD5 9af65cde1f2b7b1cc1e6913203fb8450
SHA1 59555f99e52b499f3a5704ac0604cf5cfc31c7ea
SHA512 54c90cbe06306db3f5f4b4e758d3e27ec11b24482938c65685ce76b30cb47900e8f5e5d167fb56aa587a8fa029b25cd0be1bcab424403ca592322042043f3e55
SSDEEP 12288:x+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1925523D3548955B1F6FC0039C6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5f8361ef817b4327dbd8400098cb69a26f71fc75cbf6d056eee36a30829206a4
MD5 9edb5aa2728915b694de86b0bcea6134
SHA1 0be87a9f05425d0e383c5a36891fe4f95dbd7314
SHA512 a5c566dc220ecfa8a9f8e3b1cba9cc838c0b467ac6e7b05307103c57961e13c690e935a22659c09417a98db592cb9ddbe575b31dfd14b5ab129988e32e2ed7b3
SSDEEP 12288:4/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3548955B1FAFC0039C6754428F5886E2DEB5659E3E2083D1EE278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 375085fd131c9eb40f6ad8ef37cb8bab6b8fa14d6860768e7d34217c204ceae1
MD5 993c4bc852e712b9b6cbfccc92ce9934
SHA1 00f66fab7e2bee387b03ebe3eedb2d55e5ebf82e
SHA512 e29d762872eff9c2361308aed21ed1d2277de4528fb29f4b85bdaec8127a035f0d7b1e791e4ee80f53b8f2437a5ffda34394c3d69b4afbd8ab3af2a04574092a
SSDEEP 12288:hJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 a0936d54070f354e5b4365577213773eb0c886f33a420eb3223ea35bca2769f1
MD5 ca2d837c82a2cfbf31a9e5c8645c6283
SHA1 f54d63ba8dc9245d2902503a79eb0be59f861c27
SHA512 2c5337af1160d9865e43ad14089ccedc4e0fe59498956f84e72338ad69ce6491dc2bd648b81cdc74944cb0d43977f3f16add05b93942f2d72715a66c27de0714
SSDEEP 12288:GWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1615523D3548955B1FAFC0039C6754428F5886E2DEB5659E3E2083D1EA278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 ce4e66c6a062ffd6204792d7d2474b76fdfd6fa3803addcf7143dc5eb896be76
MD5 40ea3fc217a8f91b024a6ed7d3a9f838
SHA1 6c37df70c48f38291d9a038a76b306967b99d48c
SHA512 7e178cb71477d277b2059b454fca522c0ed394e4d8338386ed654ff43e68438828a21be21d061db56dc47fb1efdecded08f5d99f685f00f70d11776969a224c5
SSDEEP 12288:4JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 cba42d8c83a65c6029a9c09a497bec5742669a24b972f48678290cf39dc016fb
MD5 702c43d76e499894f68dfa2e807fd9ca
SHA1 aa8287712d18a1172f915958fdf55bacbf230755
SHA512 88c5532f2b54b0a3ea6acb0d18ce556c570437a7b0fc826d3d7de29402bf63f387b14ebf2095b10beb0323645a8e53b3fa98d9b3bce0e449c5082adc5f6fd496
SSDEEP 24576:9fwvzk9RX6wkyAI3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0MnYI3LNiXicJFFRGNzj3
TLSH
T19A85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ca957a571402055e6092199cae557f8ed3b047756fbc6acf6a921180e9a5355e
MD5 91c0adf6230f00c385ab7590d8f91c4b
SHA1 539fea56f200dd0268af5854250b93ca623ad8e1
SHA512 eb836575f6df21ad23d0c33cb14c09a7f8710f0817b93158360c8da8847550e4686e5a257b9fa54dc8eb37edcfde9091e371acceae1eea96df03ad4e32acb497
SSDEEP 49152:GYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sLNiXicJFFRGN:JySzPk7wRGpj3
TLSH
T1CF066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d96deb76dd3f87bb7a5d21592153a4b8230cb5ede2163cbc4d5b5b533e2af702
MD5 0ab1351af390134125c1a8d853b015bf
SHA1 8935e2088a7017def5b820060ff396cade516a97
SHA512 58a7ede88d086974be205217967c402b14d3240e36ab288b1e8ae79b1b84b7df69da70f3102e53a3e4176423dd7ddb83b7aa340000460a1e31ccadfc76bb7d83
SSDEEP 24576:U47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:U47JUQjqirIhCnDHUPfF/8LNiXicJFFS
TLSH
T1A665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4f9b2b4ab497831130eeeed8bef671c2423ff597627ce773896285865cd295df
MD5 f3f736a0ef53734963e4af8b4d104e41
SHA1 8da298783fef0488af31b9e0a206dafc0af1a0cb
SHA512 07af9faebef8ce2700fa12e636fbf87d64394843fb0e9bcfdaf0977738fcd495449568ef33f293e108b22e5cb052844282f2cf2adcbb4bb26fe0fd065a302eec
SSDEEP 12288:upsfHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C765F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 924KB
SHA256 d3a2f6a8004684aa07a4e671f0f5d38a59b513ca1519a4ade6e1f750fec32366
MD5 67177f072657fbe1a66df4f090b025f2
SHA1 6bce9397d21ced288cb355757684a1af8b3edffc
SHA512 ac5bb0799d0440a30dbc82ddaa2a4001bfdac13c5517a6e4380282f487f8648febd7d8ece68ef99a42c19f266e59d51c03ea4b5d0051aef164493191e49d92f9
SSDEEP 6144:NYKsBC2naPANojC/h4LqotMxLoAxU3fakmQtVEIZ/ft4aUC+GFhfjcdsSSORz2Jw:NYPyQVU3fwQtx/l4aD/fjcdnSOp2Jw
TLSH
T1D7150500B626D74FC6AA40721E77C6CCAB70BD42EE499B0772C9473FC876658BAF5181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 2.3MB
SHA256 1cbceaae104597cf19da072bfe861aac0ab91eb03341524fdad03d1c822bcace
MD5 6e5087dfb661f3f9350107417d74a8f7
SHA1 7206ff35b2a656053f3d623fc58300eeea100a01
SHA512 5429218b06658e9f2f1552555bc841d87526055cae6537d901857fe779c03a16ef77cad67ba1a8b68bb1e59a2efa1a5f8cb5a0382fa1a17c1f68b1a8d956dbd4
SSDEEP 12288:GELMuHDT4zXbzwyNNNTlSlyo86qNML4A4teflmgpPdl/YWXAcOLAtpDdommGku4E:GELMuHYL8wXhgG0dld4Jkx4llnt9JD3E
TLSH
T1B1B54B4155B7E74FC5BD40734236968CABB86C12BB443F00A3488C3A98BB66DF5E67D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fedce43cb578e5e526d5c12eb0c312bc73fcb6c3d5b3abdf8000fd155c02bf61
MD5 899fb59046d486f0512b83e2a2070bde
SHA1 314bfac95a67e419d85ff912f8a3886d86cd7cb1
SHA512 75f77a4ad89fb3d3ecfc4fb3232109bca1085f9ef945f750afb5f6a049be958688ad9edd847e49782912313719320c5efb9ca72a67a60c5055a4995b618b2a68
SSDEEP 12288:wF7PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T194552393468D59B1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 640fa1054ce1fceb9d78465ae90227cefa34fc96bca1deac667899c83af681cd
MD5 46a1736b68208847e69fb5b9bfc4113d
SHA1 17679310ec5e177edab36b6f717c9c5cf0569129
SHA512 95f389ba79087ae3111182e05806568d059be9f7ff98abff4ed70353d1c60ca8f99434c3d3e48a3d84222a54e3021da64899e28c74f84b351e8b5c7c87a2fea6
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bY5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Igb4mBIBhGFCLNiXicJFFRGNzj3
TLSH
T1AC65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 621841ff7054a3903bb14d1c3cc2be408bc9f4be65aa65ab6c5b1b91cc3dc0fb
MD5 bdeb721ab829d40009e4511c47ca71df
SHA1 1b0f00c453eaed614a9d6f1f58cb82f3c0bce32e
SHA512 0444c59f3a18fb73f35d05b97feea6cf7f1c3bcf32455a302017c3629a6ec808f7525c3e993ad34cd009852c955af221c6ecac422d8d07bd288a1156c4d8cb1a
SSDEEP 24576:3G88u8FpJqH1vzria7/my/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:27ZFPqVya7/BLNiXicJFFRGNzj3
TLSH
T1C885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6d239274d94d5eb752f6da57f789883d345c5ff2574ef635e7121b70b54276e1
MD5 8fa17551ff560077a1f2f553dce80022
SHA1 17029f959598e8c62fde992025fb159d7e7c8cf5
SHA512 09bb4ae77c33a44f748ee3648108c564492f68eab2e3f9feaf76ad2b995c8be4a02b58b805dc764407d84edc259085d7b6f811ecff03cf5828c3952ffe0e818c
SSDEEP 24576:WPUr+NQe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WJQeLNiXicJFFRGNzj3
TLSH
T1AA65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 76faeed028126031768451c3869043b1174856d65546301ccace89a383b54325
MD5 e7a73f0078a42aafbf8007fa1dbecda7
SHA1 defe4bfb333235c86dff5ae5800c18173307f694
SHA512 9a0a253de4672e0a36fdb359ec9438b8472c528f0b7fed2a505c8f263a9216b92fe430c495f3bd2b6d3fcde2ac1b126f429f4c5449fa11ca159a0b3f145b7b96
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOLNiXicJFFRGNzj3:zG05lO43b/7wRGpj3
TLSH
T1AFD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 588f7107fb0f7882671c5306a297a9228a2c21a3a76ffd96fc056da05f258103
MD5 cc63a86d186aa4d8dd35f5c436685357
SHA1 fb8190b108b1f875bdf5cacd5f5163ca8f4cacc3
SHA512 eee6b4184c9a861a22808791eadb16a83a464e6c8ba5c69facd33e5dfd7d8a473e579fb596b61d4cc6eed2262896788629e0f0e9273401f679a0e576b422e6f7
SSDEEP 24576:efa5POZ3dpyWVM50JicR2hG0lasx2+47eidns/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ga5POZ3lJt2pasx2+mmLNiXicJFFRGNf
TLSH
T17565BF5EA2FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 be979cd4a2a0a82f6b3424e82acc873fa56dab5effc53f1f2c461b8f4682b3bd
MD5 cba9fb602070b042f3c06145b09bba04
SHA1 9c185f21b390f818223372c2528c1b80b56260df
SHA512 dc654378bf85c05eaca9e6ed33f47da71435f710b841fff51f41ed6ea5c30ace8bbc861c726b90d45858dd08643ca1bf5b9e8922f22eef677d5c234bf34f41e1
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fkq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gNc/zEOVHFhLNiXicJFFRGNzj3
TLSH
T1BC858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1e567e025d1fd1170313e8237c281ea2666e128f0e9b910102a5ca165eb3c6f5
MD5 fdd6656a0fdc3d5a7cde4907f01af4bc
SHA1 1de66683dd93035f233c088fb5d1672fd53147a7
SHA512 47470d0874d7b692e5f89d1408e9054a55cb9243369a241888ea4140b705fa4e8d2f154219a2e5f077e8798b349817346615896762ae6b460d989741ad06c8c7
SSDEEP 24576:uzkNvNnaFeYhJNtmZBmg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uzMwBtOmgLNiXicJFFRGNzj3
TLSH
T14455AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0ebc0948010600a3f39949d5370e3d5abeb6c33d397070e6fc8c01e3ed0bc76d
MD5 16a78cba111d4930271e3c4002c5e0a0
SHA1 870ff2c4b79f9a39b6cf976ea0e3ea069d49731e
SHA512 70656e4c85f02257c840fb92c29dd32f611bf2b8f319760dc9f56248729f63fd6fd24377087518e65014fb728aebbf2e6f87df6d3252a9351f90726ee27f7543
SSDEEP 24576:DD3FHshBIYQgAP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DDVHeBIAAPLNiXicJFFRGNzj3
TLSH
T16C75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/240-134-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/240-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/240-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/240-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1056-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1056-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1056-273-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1056-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2304-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2304-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2304-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2440-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2440-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2440-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2440-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2440-13-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2480-0-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2480-7-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/2480-6-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/2480-77-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2480-2-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/2480-316-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2488-39-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2488-45-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2488-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2488-46-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2488-50-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2488-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3264-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3264-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3264-370-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3264-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3968-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3968-83-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3968-84-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/3968-78-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/4356-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4356-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4356-383-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4356-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4356-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4356-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4804-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4804-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4804-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4804-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4824-72-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4824-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4824-295-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4824-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4836-380-0x000002F7F4200000-0x000002F7F4448000-memory.dmp

Download

memory/5828-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-366-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5828-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-108-0x00000000006E0000-0x0000000000740000-memory.dmp

Download