22691d8266160f76f91e17fe3fed01fa010f3129a5270f033c17782833bb165c

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample260722-vwpbjsdp2s
SHA256 22691d8266160f76f91e17fe3fed01fa010f3129a5270f033c17782833bb165c
MD5 a0c0a653a492ba136dcdd41ec4fcd248
SHA1 18ccddc2ab471392671f45025aca50e23e725dd7
SHA512 9360eb2b889db529d306d6af3514f5148259f904d0f11c614bc30a6786784815adf56fd278e7bab064f2bd32a1561bd0120c700ebb1c30fda1f3194ba41af58f
SSDEEP 24576:jdP/PWfeHsQfgmBhvn/++1Li+Ys7Uv+ahF8MlMPuuICiJS:jdP/pMQf/Bh3HBt7Uv+MnIIC
TLSH
T1C085F119A39409F9E9F7D23DC492460BE2B23C558B32C38F07A216576F33691DE3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1716	elevation_service.exe
5052	elevation_service.exe
5064	maintenanceservice.exe
1760	OSE.EXE
1748	PerceptionSimulationService.exe
3844	perfhost.exe
380	ReFsDedupSvc.exe
3712	SensorDataService.exe
1032	ssh-agent.exe
4996	AgentService.exe
4448	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c431345ee62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a5c217dfe19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f6fc07bfe19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000222f97ffe19dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001695c680fe19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ab8a87cfe19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006882177cfe19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2128	2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	380	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4996	AgentService.exe
Token: 33	4448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeDebugPrivilege	1716	elevation_service.exe
Token: SeDebugPrivilege	5052	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3044	4448	SearchIndexer.exe	100
PID 4448 wrote to memory of 1488	4448	SearchIndexer.exe	101
PID 4448 wrote to memory of 4816	4448	SearchIndexer.exe	102
PID 4448 wrote to memory of 4528	4448	SearchIndexer.exe	103
PID 4448 wrote to memory of 5000	4448	SearchIndexer.exe	105
PID 4448 wrote to memory of 1516	4448	SearchIndexer.exe	106
PID 4448 wrote to memory of 4324	4448	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_a0c0a653a492ba136dcdd41ec4fcd248_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3844

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3712

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1888 1492 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1888 1492 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 abfbdda5e315683352a9b202d67dd799336bce4e8a22e3231612d12c1f31925e
MD5 92f2ec2cf095348757f41d0800396a28
SHA1 8213838a1363ffe6aee664c4a0ad84e97c5b92a3
SHA512 db0710d1e53251d218d9146eb9797185e6c9277279b4bd85306ce3436466279790dca39589ea02795f1feecdef05e54e82a845fc7191b351084b88a32f6fe5cb
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnit7Uv+MnIIC:13q6HjBVGGMnI
TLSH
T190D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b13fe2306e28c01f5ea454d277a88e8c4b52b316ef014a89085986a460e12c76
MD5 6c8425279cb3724e1930cf5c01b6ef2a
SHA1 ee37b591c9be96402d75521387d3c9e2c3db10bf
SHA512 fdb8e626742e0d7d043cfa3aef5d6385903831c7cfb33a5a98963f451ec576d47b2de8883441405504462477b307e0817503901c5ba0470843b9dce7f63ee52b
SSDEEP 24576:zXYfDtczAk+Ys7Uv+ahF8MlMPuuICiJS:Wtcot7Uv+MnIIC
TLSH
T1C3650128A7D408F9EDA7823CC8B28116E6737C914760E7CB03E495765F236D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a261dc993ff103490c64194f6a1fe7dd0af4b3f608ef836234f9091a318753e2
MD5 e087cbd994d8d0208e1a9568bc4b1e2f
SHA1 8fe8c29c522a9347a3d46dfd5b03deec31907b16
SHA512 530767dd28b37743c4f4f40f4198b174cb56f8f1b5a39a43363e0395fb6288e885d6c140f60abde2ba480c3792b80c7bf4c59e52a896b2896274d9bb4afd276c
SSDEEP 24576:V0Le5ji0hmxirMD+Ys7Uv+ahF8MlMPuuICiJS:VPji0Aczt7Uv+MnIIC
TLSH
T1CB85AE16F6748335D073C0B9C5D2A69EE97130825B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3599bb5c30f66cefdc4d005edfaacb347a238a34d9fd7987e7f7fe1d24bb72ff
MD5 86c6d91afe7de9e16501b3a3aefa3acc
SHA1 a91d684d217d2a7b70417b4eaa090d0521fcea60
SHA512 bfca127464539e9360ff164d25d8467bb50fbaab35a0731e78fe61ea7aed890a04f3d89a588a50bd22295c47090e89efa636c0346c1c84bacfce37bad7290d18
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuV+Ys7Uv+ahF8MlMPuuICiJS:W/ezSC6vUzPvxHjyvt7Uv+MnIIC
TLSH
T1B0755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 909759c874d273aed906ccaac59d546889338e0948038e4aed512ef067c2e599
MD5 79fc84087df1b71403b0fcc47f8c78da
SHA1 6949dea60152ce6840700fcba75622de938240be
SHA512 f829ead9113d5645e41e932d13edee98d3afc635a55452c83632f445c431f3a277b19beb306cc1e5c39d1a5ccd49cc2f6d74821411a49d0fac1406c8edd7b5f2
SSDEEP 24576:/VbqPb88hv/l+6o+Ys7Uv+ahF8MlMPuuICiJS:/VO88hXl+2t7Uv+MnIIC
TLSH
T18655AE66F6748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f82a82f15881f983fe4702def3339ba34a498b8a47b99dc4a3b1ef26091ccf1b
MD5 fb31f72e07ca16bfbec07a5a2381e92b
SHA1 84a352a14be392444d9921de074d8582d3f2a4c0
SHA512 f5f140495e6d6c3d9682778da88cd3769e6efcc70a1d24a0cd78f41a3823b82913530a28c6bcb0d407648e62001a580c471074465b5174227624e616ae1ae238
SSDEEP 12288:OR8ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:OR3+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1EF452361CB0510EAEBE96230B5B9819B71F1BEB4596316C348E07163ED7D893DC67383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 61f3c9dc34fb8c6e9524ae8df76326975c5189636a30462c7bdbc530d1af8a1a
MD5 e061c8b08807d918bafe8c2f9aa7017a
SHA1 474059aa91b00db9a145303f6ce5cd1f78f49596
SHA512 add7f0b497802274054255e766a462c667237f5ec5678b67ae8cc217f180002fd8d053dd0b0d94c2fa2730a5edc39fb4f902fdcbd1a3486ca5fa516c27f7ba5a
SSDEEP 12288:beBNUbTVO86Udep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:bJIUg+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1C365CF3BEE28FCE2C27E9D7856918240E7B278704F6293CBD164820EDE275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2845ec8c2e2bc1cf59c6467dcac5320890fdeeb4ceec839bd3764f356a95c778
MD5 757462e0bccda9d28416407f45b036d6
SHA1 03bb368738feda86fc8691edb5bb4b02c3958800
SHA512 58de8ae7c125153e57e638559a346294e356d048d7f57fbc6eb01a7bf70510249f5d19eead18a696f476e6260112a87092dc0e8eac2e4a3c404a17ac670f0604
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:DQvGAdlCEL8c/yRNw5CIGGMnI
TLSH
T1C1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 38afe50da92cc068c4495996d12743536acfe0a6cae3e947e1a164022878249b
MD5 14d50d54ead193ab48ad4aae9858e421
SHA1 270c8088b14dafe0d1256751361b3929720f180a
SHA512 de04ab5a3993b5737a5692e45642f821140cb322aff2199b6911da87d3bd9a9df260a2518e5be2d12cd55066eb658c2cccc11f5b84a3712c6bdf47c5c347f0f5
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAjDep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:BdewsAja+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1A375E031FE74E036C7BB0DB21B36C716147D79604B621AC3E3E88A9E99341D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b7b73d88e7289ebe859091f1c4cb31865ea61741f30cb8cf24ea07b054fb6114
MD5 d2b3705bfdb14c61cf4b104a899caed6
SHA1 123f20931d45356485af43701f5a78873a4088d9
SHA512 259f58d2661078a5cf0ea08f7e75b5678e1e0d27df7eee3a4da054eccd6494f3805a5e1b48b72f78a49025bb2b6a04d77afa695b3e5b07185ce4d7d94bf5fd97
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHq:aUEtQevvqc2W1cpV2EI32q
TLSH
T1D7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f0df59ecb13d309edc8ace74b9dbb479ad6a9776ff34836892f4e09cf1e46378
MD5 e54a34645071c9f636b00c6777859a6a
SHA1 d557b0be7f381dc6658875b3189e6b311d2173c3
SHA512 2cb84418fea1dd8c581013fd0d98629ff0e3ca8d2d83b23c96cb9365725111d9f9c63300bb2a4b0a7cc6d80941fd79e6ddfe49d1579d679e6665b45142c795ff
SSDEEP 49152:mCbRquA/m2yL5zifFiV+XenmE3/zDt7Uv+MnIIC:LoqHVjnm0GGMnI
TLSH
T1C6D58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 409078f8bd47ff364504b04d18c256dfa59325832241d8e0daa672b2b86fe692
MD5 869635ad99ae07cfce200745a932dbfb
SHA1 cb9f344debfb55dad4cad8d45c2ecc45fc341983
SHA512 37d5216cad6344c4b7970944a7e7f99902c1f6f4f146782b7d66d6dacf8e6f8c7bd935784fd22abe36995759ae141aaba81794adedddac0cd8225b61833db663
SSDEEP 24576:FAhGLJIFoiwtA5l7S53x+Ys7Uv+ahF8MlMPuuICiJS:FAMyFoiq5kt7Uv+MnIIC
TLSH
T13C359D81E7F955D4F5F3AA7899B68171EAB6BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9cb1afaa62db859868334bd3ada5c22242292480e8749878b9eee8bfb6f07090
MD5 b5a1c1e8d06a9f0d1ec6541c1960c65a
SHA1 dc01537f2b71e4e7206923ed94e5147c02d8c305
SHA512 a2cf0fd9221fec762998a1b08fd3bda43491c1650e00b5075392e2852293c9fe628a460bfe78af5025b728c6db8eea65d2d9e151b0d76d7e85d1ddcb81c3578d
SSDEEP 12288:Jmw5HEjsChNVBFgl0WDm+CGep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:EwuoOWG+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T18565F14577A40CF9EAA79238C597C136F7F2BC112A21D71F07A0C65B6F37261AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 072ef187662c25fad8f92bd26a2a3fc4fb95dad0c78263ffd39d50a52b99dcba
MD5 94343499baf48f368d9e64f71260316a
SHA1 9f2fd57a70a38d6b6c334dd3a879a87e86ebf376
SHA512 9e1b1b9a69c9378231f8527b1e420fd2209316cda4aebd9cb2c2052faed8ad46c9d111f2c56cd93736ff389c775dcba1a2f0340c63fee9398f2132543a9b7af0
SSDEEP 12288:BBZ1IyTep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:vZub+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T13D551255239420FAE6E7523CD9F5824AE3B278A2677343CF15A042666F37CC25D3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9a3a194ef9ad1cd08e1767556aca59c344144d186c042163ccffe1e3e4585814
MD5 0d5fe072522461b587f8dd37c5e07151
SHA1 7fb3db551664e5a06c3698c65e205ff8a2397d5a
SHA512 2ab5510b2ae0d6cf26f58f9a53cfca5215e86c249c1e48cf8d5a9c09d7096796361cd29d1b8ad877e3b93f853c306188d9ed8c77ac8b9ac4dcebd0f52e03fd2b
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:IQRQyi36YOcPQLvw2gAf+PN35GGMnI
TLSH
T18D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d6cec6ee03e40140d43de3348d6220878c4fdcda543e13ff2a42e26d0136afe3
MD5 e2a8902fa52b6c97d7ea81fdb1b0fdd8
SHA1 88421d9c69fd77121d72b297d8dfd6240f2d6644
SHA512 85a978340fe6571093df99859d74aac488307e86f876dde51fb1e3e5f6043eb1e99f6976611463024eb9ad23da19794a31a2cd77ba1720ebe5916c01255e95dd
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:kQRQyi36YOcPQLvw2gAf+PN35GGMnI
TLSH
T1B8667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1f82d72da4e58670b516a26c78a3c129da9db374ba89e1908a2e1d891322b643
MD5 658aa3a70c095867c9fcb7fd28b9957c
SHA1 8cb6312a2274d9dfeff0fc057be22af99f4915af
SHA512 d0653251a4bfc3fd6b163011919d8f7bfe0675ff40b3d5353de393f9faf157e77f30df50aa215ea95f390beabb4a85494ac00109c7702b2e0c7ee0b743feba23
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0r+Ys7Uv+ahF8MlW:z68Qg55nhheWu7PNU3/zt7Uv+MnIIC
TLSH
T151B55933B2F200A9C44DE1769F4A872196E17C758FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e24d96a10d69c74dd0142a1806632a933d7f0101e665466d403b65dcc857adb7
MD5 06fcd401b20037f81fdee17a2fea4368
SHA1 9c1526c8f2c28b23573a918034f789be827ae54a
SHA512 5fac41c53a6caeb603e7e710cecc4634f1b6945dc4a0bfc21840015aac280d391f6a214356c04ec275af5e39f113086a9cc2e4a289cfde266d4c2115e9ab3655
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:gy5112gYy5azzVvL69nLKnhZOGGMnI
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f83222f21053b3f8e8016d06be525726aa5ddab0304f7e215af17dfb5634e63e
MD5 a06a642ac2b0ef4c5c37f0649f0ceff2
SHA1 cffeb886634cdac8921653fb313afeb40d1f8d24
SHA512 01c060dd32c32e65745bbeed583d8ce689f0eefd63ed7a062f9d6cf9e00a04807d945d06df38c3f39501189d050e4add1cb1bb360a7b45b80f6f77550dd04b0a
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glht7Uv+MnIIC:Mu6JmVxd2dhGGMnI
TLSH
T1BBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0a9ec7afdc04d18f4a1fe21655f58dd889802cbe164553cae90f25f73ad63894
MD5 48277a98d2a22e1b2f992efdbf3b3910
SHA1 2f4bfcef999163c41c6f522a331d373e2091918e
SHA512 e7b0236fb9751a8a8275d194c60fd788203119d9b9c894f438cf67dc915a7055ac4b83ce92bc2e03ee10464bec3fbf02fbb52bcafd7183c7d36edfa704f418ca
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4xtt7Uv+MnIIC:7mifPbR0GGMnI
TLSH
T12BB5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BAE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 496d77b0976cf271a2d09cbc9614ebf9809928bfbeb1011489c4f8a563502cc7
MD5 aad0531d4f9471c884426699ef11ce2e
SHA1 9b045957170bd41f41609d0779811ea1a8cf4879
SHA512 ce69af6dfa2e7a09bd6755b852787f3df4b4a00696b56f1b80b719f789d63e3d90a273e803378b043d0e391faf1de5c1207341ba4776eec44133ef39ff7b4619
SSDEEP 49152:aSuZQIY0Be2KRRVtOnks6NMHqSt7Uv+MnIIC:E5dKTi61SGGMnI
TLSH
T11DC5BE13F2E940E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7e2a8f3aca094cf1fdaece2869a30e462ddf64855facc86790a75acfb65eeee2
MD5 e3a701aed4d6507af83bbd34e4a1483a
SHA1 7de4b7aa01d90ae5a942fa976abbe2be543d13ca
SHA512 025c670dc5f0268fe827c75080efea3925834d4883ce57ad057114227e81cf7410c5ef841b0d4db1d9e2f0313ad1c241d03b99ecb0d0eb3fff13cd334fbd7c5b
SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wRt7Uv+MnIIC:0X2iyphgGGMnI
TLSH
T1C095BE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 581725ab38c9baf077e3b8d0161d5eb8c4b185f4c4307fcbb3e131b6a817b367
MD5 f50a3e1e726b44f16dfeda45de2b8fb2
SHA1 6cbb62c18453cfcad155c335f2fc7dd8b23b693f
SHA512 6af6e0604945a1f3db006c99f6cf6093b861dbf4827dcc62af70b9fa5946a2af58a8e9ea69a3dc0b5e54316c98f1dd2fb97f6acdd300f4c083de9352799835ad
SSDEEP 12288:VUep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Vv+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T124452351DB0610EAE7D85270A1B582DF70F57EA5AA6302C368E46023EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b5eec154984c8fb0e98221145effc9ce0b9cd800c24fb85a0ae88fdf945a45b9
MD5 06f7a40eb44ccc4333941ad7d5c04f5d
SHA1 d746e4d7be4e7344581833c0b3721341851ec533
SHA512 71cb90f422b77bec0d198da4bceb1e0ad787f080781d51bdb117d5e7bbbb195185260578b00770fc06bf2ea1a401ada0e7c1ff948b0a65b865de97be88147edc
SSDEEP 12288:N/ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Nu+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1EF452361DB0504EAE7D85270A1B582DF70F57EB5AA6302C358E46023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1dd38b09c4a87066196cc87133c7a4313191a1fc47260b08942e406d8f72fbff
MD5 662991672cd9788dab75b3ab6233cf7d
SHA1 11a63f5b230791dc6522ebc5d81d2237e1af422f
SHA512 7c2b7ab6d1d4e9c4f27b0efa034e86ee1ebf97192c57803a7d8f63de2cf77686695aecc0b3aac5355ea384fb5145c82c194e368a62a4778ef6e180c8416d8af2
SSDEEP 12288:o1ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:o4+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1A1452350DB0610EAE7D85270A1B582DB70F57EE5AA6312C398E46023EF7EC935C276C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 81b6502dc48d08ecb20abdb2bde8f03dc9abc88011fc9a0203b6fb8719cee519
MD5 85f0de158f7e50d9fe88781eb1bc892c
SHA1 73de845a3db2507502f152f5c63cdc40674e45cc
SHA512 0f84764c495f555e55bb0979796479e26c6a59e2f7925af2b82ab011e8d1c2c0071ac5522f035fd95caf3965bab98b40691346aa8158b8da708da3bc04812d8a
SSDEEP 12288:QVKep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:A+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1B2452351971500EAEAE5E334D5B6819BF1F1BDE49B3313CB999001639F7A8D1AC33B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 786a6d930617fc13f609c87986a2970a9876699cbbba55f3276da2bffb11aaa2
MD5 51a15499e0174370dfbd7ed468d982e7
SHA1 f7dc781b4bed230e3b05555c577d9af48ac92059
SHA512 1d01cfa2db66e70fc2a773c4e646657a638a8c082b7bff1f3bd396183bcf9871d107e6671f96db4e20f427e8652725072311206b68672b14ad868388e6f26b47
SSDEEP 12288:wSep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:wZ+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1A3452351DB0610EAE7D85270A1B582DF70F57EE5AA6312C368E46023EF7EC935C276C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1a89c6c7e11531e67f5020f91528b0c46628fff4972b90f6736824a2a5a7a0ad
MD5 ed1203e1d04b4dcf444974afbaf7d87c
SHA1 81ae1d168ec1afae798bd16b042a9397bb712ad4
SHA512 6071a33a9425f54b1557ac971d6b94167ba2caa6eb8ad1a1d6f06a962b1cfd24c83d2eff2d92bae54d02706e3c4a781f3802c73fc5c586fbf720cc618a3e6572
SSDEEP 12288:ebep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:ey+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T176452351DB0500EAE7D86270A1B582DF70F57EB5AA6312C368E46023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2b1bb3478e9ae19aee2a19584806f8f28c236268feb014719487766b23f470b8
MD5 c8ad05d7e414e735b77d26ab558a5451
SHA1 fe6e07033cc692af2b5947bfd9544d29c0ac5c85
SHA512 6690c62ad851498b8c9a0c871d05d8c88b65cb22c9ae8f75bf34da6a97c55597485b6c06e4ddccffd6c0bab6163a3e8d6f99defea1b49626290237146f901980
SSDEEP 12288:rHep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:rW+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1F4452361DB0504EAE7D85270A17582DF60F57EB5AA6303C368E45023EF7E8935C27683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 76eb6c75ae7c23b92647529e5769be2042b5b9a424b6395f88c3f69d573669d6
MD5 2643a01a5527474ac1db69ff920b65e7
SHA1 62a444deb73cb0e37213dc960c344c6e6b9c6149
SHA512 a687cd3bcd037e5503dea0a74b9ad1236795bf9663ac4c48f2d776f340e3e5356fbffbe7d1669f7745779032e4a8f4addc6905e7cbcaae142c02546c93e1a8ef
SSDEEP 24576:RZMSzFVSOO+Ys7Uv+ahF8MlMPuuICiJS:RZMSzf7t7Uv+MnIIC
TLSH
T1A36501A5B35018F8EDA7823EC9658906D2F27C690B70C64F03E436675F376A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 440a6cfee440032e3f8f970a12e3b0a059870c217b689d25daab5c2fddf98469
MD5 087620062ba651b70d206dbf718e2ac9
SHA1 cf8bbb0913985e80d2512afd379735f67bbbe660
SHA512 bd313b7750e95a809c97265c13df21a942e7c854d02e8814a34f3fff51604bc9e1ae25332251b77a73999dcc2624ad8323506c9a5dbc8bb0ec8192c3865c4f54
SSDEEP 12288:d4ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:dL+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T133452351DB0610EAE7D85230A1B582DF60F57EE5AA6313C398E46023EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 947ba3d81cb3ce0ae0ff778aae6a81f72896d844a110344f5d5703ad9368db02
MD5 b67a080bd57b998f714f0a07bd824f22
SHA1 4324d62971bb7aabf650cdfd21ec2260afaffe90
SHA512 ec3b27a313aa326953b1841dac67701fd647b2f27b843614b3651bf377e49317504c3c897775cefd16f0f7d485f190ad7a00665e22df41e4305d2dd86d685d90
SSDEEP 12288:AMep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:An+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1A5452351DB0500EAE7D85270A1B582DF60F5BEE5AA6313C398E45123EF7EC935C27683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ac8baa5028e7f191f885644645cea8098ae37493e9774f00a6486cc008d14e60
MD5 d8add53b8d390e3154ca904b7ef6e73d
SHA1 96cac82f466f81d4eb9fdb29815e61fc92faa643
SHA512 139a44a7bf3e816badc1b1950302fe4b46689e6a991a338b5201acd544fe476e38cc5d6200eacb58e30ef1bf8b9f1393058e26afeaf7ae38cdb5aad3721adcd9
SSDEEP 12288:2yPz5L8Tep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:LzyK+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1DA550217B7A130F9D1B69238C8A20646F3B2B87247218BDF56A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a3ff8afb210a67fb3db4774173459ddec690b76f83d11f81bbeacdcf45d93153
MD5 911eacb066da31e34e35eb9648b8cc59
SHA1 640ce3e165d886762268c7dab12f5254fb145eaa
SHA512 e8fc2322de823e1af9e4f3c30c23e55a008183f7446c22327125fd393d3b80c39ad33dead8fd230b1f757f961e796931b89cbca24a9f38ae1b05ffe26ca4dbf8
SSDEEP 12288:K4ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:KL+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T136452351DB0510EAE7D85230A1B582DF60F57EF5AA6312C398E46023EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 590216128fdf4a74933ec7029cde6fee78fb3df234f4d453f893ba21bd792fb2
MD5 d324e05b516a11a52b4e34fc1229108e
SHA1 40a15890ce074ee45eaf21098b18760be6470cf3
SHA512 fc79c83e13de762b47dfb9b756509fc837cc73ff497ae1f3ab99728f9c1d483b54767146c9124bfa2806448d0ed0af2b760f5a65ff09ec10f6ae004ec727f84a
SSDEEP 12288:u4ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:uL+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T117452351DB0610EAE7D85230A1B582DF60F57EF5AA6312C398E45023EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9f77423570eac6e8e150adb8bed41975878890b854db7e7ff8716fae14e657cf
MD5 2df5b030a23fbd70781dc4179770a76c
SHA1 33fa7664f86374c6154e35c41df8e8ae594c1975
SHA512 e2fbdf478b65ad5802b1175676ba7a01a9436d48777f0e2f2ecfd12527b84bec03ec9dedc12d1b5b7fa52887a92f185168f6d8b3cb2fabc55ce5a5a8c38d8fc7
SSDEEP 12288:eyPz5L8Tep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:DzyK+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T102550217B7A130F9D1B69238C8A20646F3B2BC7247218BDF56A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cf8aa016ce572f0bcf9be752476784cefff4bf79699fc61d4cb2dd1645f5a7cf
MD5 0165d4e629b64d3b4a93902c7879706e
SHA1 3fcfd47a32b25e4e2b7c20cfc138bdceae96291e
SHA512 aff19628d4a3092dc6a150bfb19906b9de62bba60a8c7a125821c71661a7c3b7de54770f58511e3fe39e4ea907645d0347bfefc9e508e19f6fcd5082ae93c6dc
SSDEEP 24576:fTHaLl3z0zDI+Ys7Uv+ahF8MlMPuuICiJS:fT6LljYt7Uv+MnIIC
TLSH
T1136501A4B35018F8EDA7823EC9658516D2F27C6A0B70C64F03E436675F372A15C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 744791559a676ffc37aec81598665c6ae5ec85cc0583cc0b9155596805370bca
MD5 2d61202e419a2dd53d3b08de07e3bfb9
SHA1 5d70cfde3f20f449f46ec8bcf5f540ecd811c3c2
SHA512 d099a0b9ef40f5ba672163424c3fa754a5a604546064564897873f36fccac1f7503eef415a62eaa3df6147036114cb93336098e18ec8959b7cb6d20f9c2a207d
SSDEEP 24576:H37d9CHKy7GZc+Ys7Uv+ahF8MlMPuuICiJS:X7d9CHKya7t7Uv+MnIIC
TLSH
T16375CF90F3E410E8F1B79A35C9764512DAB67C991B31DE8F03A4265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3c79840b827891738b67874153c95cd6cb1455fabda66a2bf77dd647c8e466b6
MD5 df2c3f5e1d0f9b409466bb9d644ffd9d
SHA1 fefb0ba0b69d7294872b09af0c166c912a96d638
SHA512 2c9024c568e6ca98825717605bee157d9da2c13f3f3799e2b60b4df05f4d7b679f50cbfb7c24a2c45fd4f7ee6846a1ac00e873ea84d902fa8cf6f73c457a47c2
SSDEEP 12288:YVep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:YY+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1C7452351DB0610EAE7D85270A1B582DB60F57EF5AA6312C398E46023EF7EC935C276C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 45d7dd26f289e5cd33e5989cf71f9bde1b3cbe1e78c21692871787617afe84e9
MD5 f65fbea4e959ece22628f3ab1759031a
SHA1 54c52ef0981a72a20b03f206f4501ce44964d6e6
SHA512 d9de29d3fa2f58e8f796ace4184e5a7727fef96532b11cf8e293df8e8e3ee520b64ef1147a02be960385d354e136f7c23927acf109ac00821b60bc45e759bc72
SSDEEP 12288:8zep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:8q+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1D1452360DB0514FAE7D85270A1B5829B70F57EA5AA6313C368E45023EF7EC939C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 405bf739e1378700ba6440cbfc63d51045f973043978a3b7c78bfe459193f914
MD5 da8c278a11741f5c78e6e2c526a2f166
SHA1 39f4c86e80991073265515cb4e2fce1a014a0951
SHA512 2f26f21efe273cf0ce0bf1430b6fcb38b8707e7cbfea68bd543fc4e2c4b04bce8b7203fddd3663bb3f592ef4b658bb154170f75a567f51321a5d3c180059be33
SSDEEP 12288:zuep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:zd+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T142452351DB0510EAE7D85230A1B582DF60F57EE5AA6312C3A8E45023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9f6ce68383186d630eb4f09947a6d2a2e9dfe928244e19f23fc00b0a3808e2ca
MD5 ea8be287b7436ab7fe63efa023ec4e32
SHA1 0b882fe404e16fc9186be0a3bef97868f6b55edc
SHA512 0f82f57dd3d81ca2535b0861f26a4a480243707e64faefd00d984a1834354dbdd530c6d4f755865ef501d19a748699d2f4f669879a0981bfd37d72bc61020ae0
SSDEEP 12288:34ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:3L+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1FB452361DB0610EAE7D85230A1B582DF60F57EE5AA6313C398E45023EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 90bb4996e234967ff7a7ec6c4e7d0c02802f12e524fe44060e448414fcdc0d9a
MD5 b51736bc3a89936d89b390f8bc81dddc
SHA1 a68bde5a0a7153e60befe6fb591f0632459da84a
SHA512 ff9090f82fcc03bf047d3e7295c0f0d049670e41b04b2c7450d00991a2e53dea8e6e1a0317441c281f616dbad6463115810f460312b88f7b182f78cb2581ddf8
SSDEEP 12288:aVep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:aY+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T176452351DB0610EAE7D85230A1B582DB60F57EE5AA6312C398E46023EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2e1d4f8265451c6c7764e3ef3a4a6785ff195fee38e6280ebad7e687ff50ece6
MD5 6266cfcabb6e3f4cfb2752f4184e6d8d
SHA1 e9716ca1d281f7c4f281a19b5667c19514e4edf7
SHA512 4e00d9a0d69e509c9d66aa3f9de153bc654ca80b6491fee7d14615f958fe0c221e607e77f358535d2792b9e82a5d8efd1782c2505c3696f10400d5fa2cf1ef30
SSDEEP 12288:ygep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:yT+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T194452360DB0500EEE7D85270A1B582DB60F57EF5AA6313C398E46123EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a365a1eeadc87b6a9e9f0099e355439e5aa25a499cf0ea3d857d392f972ad581
MD5 c6a412f7b93c15309ec9e0d6bf5dc21b
SHA1 9a9e2328ca2d9ab9e7b720b5e12756810866274b
SHA512 0edeb0ae3bade3697110a073be184e39ed797aa51a10260caec503c1e90e764adb5b3c9653b5b982e560f2a0afb3b193d68ef4337347f047d690d8ae9d981a90
SSDEEP 12288:+Sep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:+Z+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T170452350DB0610EAE7D85230A1B582DF70F57EB5AA6312C398E46023EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 e7fde1723d37d32cd8eadda92c1b694a52fb42844a18510510e5ca79fb5b911f
MD5 a5726eab6c2ff986f9c5e747228be29c
SHA1 b1b738c041f2f9b6d9fc1d536f42339b326c672e
SHA512 a1ee783ab50b3d6277741c594b6ae550cbc2696230194c367e4b3096d06b03fa1f2a227e74d213d8b4fd6357e57e3651093866dcaa6d8c0d09849e287bd11f7d
SSDEEP 12288:9tep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:9Q+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T124452350DB0500EAE7D85270A1B582DB60F57EF5AA6313C3A8E45123EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d68bbe8e22a07dab9e7d271c8ec1bdeb5fd868d6e73c0af486420c96ba83fd64
MD5 0ae25baa979fd3a82c7868a54bbcc950
SHA1 7e117056339e3f81a2f169a2c717e83a3a051e04
SHA512 099fe438e7855da90e2890ea11e8479d2872824d34ef549803e5355d3e76892e35bcd48ef93249a72ea79bdc12681431ad1dc61b211b66b5fa79591bd0bb8037
SSDEEP 24576:wfwvok9RX6wkyAIX+Ys7Uv+ahF8MlMPuuICiJS:4MnYIut7Uv+MnIIC
TLSH
T10085D029EBDC04E5E1B7923C99B7460AF2B178691B31C2CF029A536E0E37ED45D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1c938e1737edb32843700c59f173454d3110a26d5e933bc13e78202700d04ed2
MD5 64c8132adf91f95099b2fc5829c5d330
SHA1 4ea150af8153a753059b14cd68db653452046066
SHA512 6e5f02f106f995a70bce1d1374d73d7784d59b123ba93824a6f494d7f22b6310936d9dedf6e92e592425838a8766b2bd98b4540226db786b79b75369d31b95c8
SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xt7Uv+MnIIC:QySzPZGGMnI
TLSH
T1B6067C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dbae616b9424e6c2db4ce54fe65f4bea204b96f4cfad9c56fc6a13d95d687a2b
MD5 6a7eed9b8e45a90be1ef5acd676af7a3
SHA1 69dfd3d7bf38ab2a451124f04651db38410262cb
SHA512 113676fc29d0d16c7b0fd8e0bbfee6db371c71b3e8efb2972e52617765c23b8e4757b63697d55b3af43dba9326b8ad84b70e5e8b020044308a2a94958a20a685
SSDEEP 24576:A47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY++Ys7Uv+ahF8MlMPuuICiJS:A47JUQj1irIhCnDHUPfF/ht7Uv+MnIIC
TLSH
T16B65AE1DA3EC01E5E1BA927885154A5AEA71782D1F32CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d08490d813b3171b154a2289ecaea6f8c7efe209873b4cada850d8e6c463c33b
MD5 f20eb58460169e125981727e19d6e4b7
SHA1 dc8509d2ad5a21bbf9ebf0d2fbbb29a63d3c8305
SHA512 ce4c71b297315a9431ec1567794aac98f8ca6a8b2bb61b88d16e1efa3cb404c700cbc0291999e83ecd4defbedc4f2e9aeb1b3ac01915b48d144d74506e090b38
SSDEEP 12288:RNsfoep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Wb+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T187550119D24801E8C1AE6239C7668642B3737C6587F2D3CB56D0F13E1F7A8919DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a8d939bdc503f126bc341972f738306a698ad3efc357a96aeafc55de97cbdd83
MD5 9747e591a50cb4f77e57e7547f833da9
SHA1 38077d64d72a19824af52c9ef48b293b4087ee17
SHA512 c6455f16129d05a00716f933d954fb7b66442377d5a5fd28d02eb50fe5f286b9ef4a92052a983852a7db43aa26e68cfe367361c62734284d6b0b0f11b47e979e
SSDEEP 12288:aFs8djU3f2LNy9yg+uM9yYLayM7aOcOzj1SpXhplZK:aS81UPCyvZB7a1OzjUpXhpm
TLSH
T19E452740762AC78FC6A950325E36D6CCAB707D01FE05AF1773C8473F9476668B6B6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 d390c72f61e4e6ddf23a5754a220d46851ddb3ed312ed5d26165b29a72393c11
MD5 b6dac7f8c6784322550b67648c09af41
SHA1 7c25e89c0af334eebce95a2fe6fee25451cdabff
SHA512 d2840af5f10b10ad925d7aa816db55a38af971bf1abc5439314820c33bfb3b352cac226a80070a7d3fa515fa3079868870f712794a81bc52b04f89779d1d9db7
SSDEEP 12288:hCeOuFZwfWhN5DGpLSmixOTUf5oL5zqEv8bSoN:hCNIKu/56L5B0bSoN
TLSH
T1BB452A01A5A7E35FCCFD50370632968DBBB49C07BB452B0573408A3C9877A7EB5E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1509721e4bbec1a1a08af90364b97c9284f4ea3f6a5eba1e250260d964da27f9
MD5 e2d575c0aecf4962a504cc5c7cde4f0a
SHA1 e0d6027f7194ddf9fa950ab006877fba5d918690
SHA512 d179b731a1d7593a5251341f33fd18d9a88e962262b1fbb3b50b2181b9053679380393a189a5439eadf6dd4217fa009fcb153e87857d14418c80137f71287762
SSDEEP 12288:zz7Qep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:jj+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T132452361D709149AFAF863706179C16A31BABEB45F2342C3A8906163EE7DCC29C73747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 90d288a12580bd3c17eb066546e3e5502c62a8973d01e5341290db2a9fe9ee38
MD5 0039917e209b3486ecc5eb624c583e31
SHA1 64179bace91fb4238d44260fea9174e34c4bad12
SHA512 beefc795fa07fd6d01785117462dae035f3653e718e2dccf857b9a3b5cdae5036c4721cbd525f77c99e2d5702ed4b449b012c4bd1b44de70ca5a12b7b0f9ebd6
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYV+Ys7Uv+ahF8MlMPuuICiJS:5gb4mBIBhGFXt7Uv+MnIIC
TLSH
T14A65AE1E22E802F5E1F9E2B8DDAA4417D6B278160732D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4a2ee6b398d705cad23572de29a955bbc83b2c5ff4c21cabbd511dd559903cba
MD5 39f84050cc50bbd29ce1c5b0ea053070
SHA1 9443eccf295f82256eaa0d6bafb7f914bbf8d34e
SHA512 2b9aa6b37d68035589ac3448604037ec010557cefb605f7e0808dee2ca526f3052d4fa76276378e599b8df0d03e387ef2b0b1022e9e952f4304ad48728f8f046
SSDEEP 24576:HG88u8FpJqH1bzria7/mO+Ys7Uv+ahF8MlMPuuICiJS:m7ZFPqVea7/wt7Uv+MnIIC
TLSH
T13E850165B7E101F1D4BBD13889964663F6B2B8250361EBDF06A88B511F23AD14F3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 78c218ffa024c56ab1a5a5efd0a3a48ed6eace1eb04a1769167b619b82d5b1c7
MD5 565ec1c25180bb32a42dd2511e158b65
SHA1 93181eb42a9f92a971b53f5e98419ead6cd07a19
SHA512 37a5cc64d346dec0fb34912d23d61cdf86e3da9c786c51073e9d323252c89efc5f0f47574e638075a3371a09639dabf623ad172aadae3e3d379ec74850ee9f52
SSDEEP 12288:kHvUrBFrEjwaQrep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:kPUr+NQi+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1BF65E12F62A918E5E676E17C85928319F371B862171292CF02E0817E5F67DD8BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bc3c34da6cc3dcc774a9815bd66a58147ea0d3172bf9f663c5318d4db151bfde
MD5 f8accda8aea6febd48f2b5a149c6e39c
SHA1 7787d157dbfd4860b5126f5814ac851eac8e92c8
SHA512 2447f4c497f7eb032e3dc2a63db47f88e69073a917d0fd923cfabaad331f737d4cb9d6c3f1acdd6586dcd398b8b11f2acd0bf11dbdad39f7689f08a80fb52892
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLt7Uv+MnIIC:tG05lO43bmGGMnI
TLSH
T1DBD5C06A62EC11F9D1BBC17CD9C6460BEBB23825033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f27a9cde45ad9311adf91d37174a8c23239f444e4fa001f13a7c09822ef0c447
MD5 957984c7e510e992f373c8447b8273b6
SHA1 645cad83f7c75054a13951fe485fbcf6f0b5e928
SHA512 8ff68a6ba9b5144cf4619542fcfda6de8fdc771b96946fc0ddc53a702c6e42431b951cda3928dae83a77b818157c8102d6113ca30166892c6f87f2f6f79e419e
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnE+Ys7Uv+ahF8MlMPuuICiJS:la5POZ3+Jt2pasx2+mzt7Uv+MnIIC
TLSH
T1D065AF5EA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 18c5ba7a513bcb1eee06dcc9800f3e70a9e68f9700cd21e205250fc3dfd83d10
MD5 0bb651e97200a755dd33dcba383d63e9
SHA1 8471124ce07a0365676d7c1ffe8b21def8b49a74
SHA512 c12ddea8a41e1b219d51d44e40bd6b2e36d3ccbf9b4c95ec2dc5240f2ea4a28faf311b085abadc52939783db99e7508de338a52f523897c6a50054d003e338c0
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fkm+Ys7Uv+ahF8MlMPuuICiJS:TNc/zEOVHFQt7Uv+MnIIC
TLSH
T1B7858B2623E901E4F5BBE1BE89779546FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 805d449f0146fcc578f883499bd4351d9c61bcc95cb91be42206463e806018c1
MD5 2bb7e2d4d3c8cfe1157b044276794578
SHA1 0aac35fc2102ea4a50904809c5c8207fd12b5000
SHA512 c5f598f81086cf32656a9f92acf341d0a68f0c87b7c896934d71f4857cc08888f7a135a2b8f84260536d3e4a0a26ed428248f325b8f45d8e7d993e8762743b41
SSDEEP 24576:M8kNvNnaFeYhJNtmZBmQ+Ys7Uv+ahF8MlMPuuICiJS:M8MwBtOm9t7Uv+MnIIC
TLSH
T1D955AF6EBAB806E4D1FEC6B4CD238512E6727861073253CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 13103ac015797985932910f1bbc10fe7ed613723b7be4ab095d5459f31374f78
MD5 6b62b4c3a2aee66616aaea07e75dce2f
SHA1 186d47e9b143b3f6a0e0948dbb383034a68cc570
SHA512 7c8a6b0ecb876e7df2d5bdfafb8261852cd563bf06a1f356484780ef4d0af03ea5639dfa1c8e55ee7d039c3af208b60bf2b3177211ea2343e79514afcae6ad96
SSDEEP 24576:mD3FHshBIYQgAP+Ys7Uv+ahF8MlMPuuICiJS:mDVHeBIAAWt7Uv+MnIIC
TLSH
T10975E17DEB5C04E4E57AD1BCD6638606E3B138A9033266CB01D481B65F6BEE46D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/380-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/380-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/380-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/380-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/380-371-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1032-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1032-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1032-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1032-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1716-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1716-15-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1716-23-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1716-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1748-72-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1748-66-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1748-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1748-287-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1760-61-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1760-276-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1760-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1760-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2128-1-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/2128-317-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/2128-0-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2128-86-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2128-321-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2128-9-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/3712-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3712-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3712-100-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3712-106-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3712-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3712-313-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3844-295-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3844-82-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3844-77-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3844-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4448-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4448-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4448-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4448-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4816-376-0x000001FDC4E20000-0x000001FDC4FEA000-memory.dmp

Download

memory/4996-136-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4996-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4996-131-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4996-125-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4996-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5052-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5052-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5052-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5052-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5064-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5064-38-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5064-44-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5064-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5064-49-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download