ac977ae404d9d388964d262945f7cc635da759f137104cae2f5f7f96c3188868

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260731-phzbpssepf
SHA256 ac977ae404d9d388964d262945f7cc635da759f137104cae2f5f7f96c3188868
MD5 1da7e4c46f7f25d68dbbb0ac947c87e2
SHA1 d59c03004e4d2af0b3a79ed1d850b82bb44acd62
SHA512 968d9e726791f8dd2d5a050150aa2fca50db817b2f755a316e10ba5e85b8487856550ba19108b1c000b85a8c04b5a213955c5fd175a166d828dd3872a2fd1122
SSDEEP 49152:uFNmac20zS5QEkoiZqDfEFiJJ854TJQE0:YmB2gVousfEkW54NQX
TLSH
T15F85AD19625C01E6F1666234C99ED632E6B27C0617E056CB02E17D6B3F3F6E27E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
2912	elevation_service.exe
5720	elevation_service.exe
4704	maintenanceservice.exe
2260	OSE.EXE
1420	PerceptionSimulationService.exe
4312	perfhost.exe
2284	ReFsDedupSvc.exe
1468	SensorDataService.exe
4220	ssh-agent.exe
4528	AgentService.exe
4272	SearchIndexer.exe
4760	RockstarGamesLauncherInstaller.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\407735cad744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053dd3711e720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b5fd50ee720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083c9220de720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001eef244de720dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee90c70ee720dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4760	RockstarGamesLauncherInstaller.exe
4760	RockstarGamesLauncherInstaller.exe
4760	RockstarGamesLauncherInstaller.exe
4760	RockstarGamesLauncherInstaller.exe
4760	RockstarGamesLauncherInstaller.exe
4760	RockstarGamesLauncherInstaller.exe
4760	RockstarGamesLauncherInstaller.exe
4760	RockstarGamesLauncherInstaller.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1432	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4528	AgentService.exe
Token: SeBackupPrivilege	2284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2284	ReFsDedupSvc.exe
Token: 33	4272	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4272	SearchIndexer.exe
Token: SeDebugPrivilege	2912	elevation_service.exe
Token: SeDebugPrivilege	5720	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4760	RockstarGamesLauncherInstaller.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3320	4272	SearchIndexer.exe	100
PID 4272 wrote to memory of 1372	4272	SearchIndexer.exe	101
PID 1432 wrote to memory of 4760	1432	2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 4272 wrote to memory of 4908	4272	SearchIndexer.exe	103
PID 4272 wrote to memory of 264	4272	SearchIndexer.exe	104
PID 4272 wrote to memory of 4660	4272	SearchIndexer.exe	106
PID 4272 wrote to memory of 2432	4272	SearchIndexer.exe	107
PID 4272 wrote to memory of 1548	4272	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_1da7e4c46f7f25d68dbbb0ac947c87e2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\RockstarGamesLauncherInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\RockstarGamesLauncherInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2260

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4312

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 99bb4c037913cfcc45d79e377018a33ca9206354c216d7defc2b97e12cd0d76b
MD5 b722d7e2466137fe248b225aefa7dbbf
SHA1 582a4365e8d65ccdaf676081d23f41ded9644d04
SHA512 17da095b7dfc41759debd7ba8d693e01baf2791e5315a8051bc05ebb431441a3ff2d35017382692fb3868afdb47d73a3a13c3142845b6c0022865bfc26cfaca1
SSDEEP 49152:Zb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnrEkoiZqDfEFiJJ854TJQE0:v3q60jBGousfEkW54NQX
TLSH
T188D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a700a4989526bfd7bc8161453a98b2b80468f860b8f88d7e5e1064d0675a6407
MD5 3e7e361e918e0e4990f3cbae33d0811b
SHA1 7f78c090b88f4fdbe497b4b7bc28b3961de4630c
SHA512 194f7516323d1dc1ac19a7909ae315ef8070cadc15258c9cf2029f0b805963473b844f3af2e9a91b2a0420ff0423a2d6ca6662405d293e6938fe688ec6fbab4b
SSDEEP 24576:tXYfDtczAQEk962hZqDfX0Fiz9DV854P7JQEtK:4tcZEkoiZqDfEFiJJ854TJQE0
TLSH
T1DF05F12863D408F9ED67823CC8A28512EA72785547A0F79B03E4952A5F337D85E3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3d2e1af9946fbec3a1ffdbdc47edbd48c0e5d2b49717228d8b53ed207b123abe
MD5 a4f8a296dfc47c3d9e23ecf9c16ad44d
SHA1 fb62b0620392d139ff4759228dd170909f81c37e
SHA512 b46528ec9b30dc5b6c7229cfd717ed577cf7cacf0134b6904781fbdbdbcc9a91492991df93aca70b3d1a998c8dff72ff294549507a22acc9d29a749c82ec39ea
SSDEEP 24576:q0Le5ji0hmxNrMDEk962hZqDfX0Fiz9DV854P7JQEtK:qPji0A76EkoiZqDfEFiJJ854TJQE0
TLSH
T1B135AE16F6748371D073C0B9C5D2A69AED7130861B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc45b9b70b51d8e70f60585681198eb9a65294b050858ead71ceb7ab8a9611af
MD5 ce73d9cf2d32cc07e896558e6a681c8a
SHA1 35c8cbba903057c355a5bf592c7fb734a81930e2
SHA512 ffe4fb77164d7fddebc98e5795084beb53d33e1c962e0a05d1dedd04609b9cbf7595dd175e421b1fdb452c4802234f8b0886874663f04d4e901fffb119f33c47
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWr6q8wyupEk962hZqDfX0Fiz9DV854P7JQEtK:D/ezSC6vUzPviHjyWEkoiZqDfEFiJJ8j
TLSH
T10D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 67715363ad4f6b24e734b1f97a0aa8cda569f86f84dc2bd787228451d2e393a3
MD5 969bc106f47b7b6001e201eb23953673
SHA1 5f65a2e580d997ead57499b703cd2433555d8e43
SHA512 a2ce1d05f58fd7854b425d6ee40b7e8983d1793752a7c23da230c41026cb86bb25788663d825bdeca0f05190899e46250149c77e48afdb4132cffa8090264d0b
SSDEEP 24576:LVbqPb88hv/l+bEEk962hZqDfX0Fiz9DV854P7JQEtK:LVO88hXl+YEkoiZqDfEFiJJ854TJQE0
TLSH
T184559E65F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8dddf6804f96c451a88b825db510c6b00fb2d869f9b182c14fc7ee3f69cbd1d3
MD5 f07019f7112239fb88c67117bb1b3a38
SHA1 69c377e473d4d79536715ebd8b74f6222445ef26
SHA512 3a0a243516fc3d3f05a478f5ba6f5963403874f40b2af512d706e0a4d3312500f425ef31f7728f0b9bae312dfdf5fe4eadf11f1b02fc641b4f0cc5533e5de3a5
SSDEEP 12288:0jnDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:0jnEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T14DC42341455428F5EE730634E4A7A4E769B87C899FD0B9274B81F24F803EB21DD2EE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f426b2fc3dcf6f749eed2e989cf554c106b94b618e38db91f0e6702b0358c61a
MD5 ed3dc9891aa1bf042fa8272f7a3c22a9
SHA1 c823564e53d12531df005f16e0111a798eee4369
SHA512 d5fda031fba8363345670a968019b887b8441d37c904eca04d72946049c4a8ea046c1c2d16bb81599c8d1dab32cab9ede10a9b18268792c1507f162064beebb6
SSDEEP 24576:HJIUcEk962hZqDfX0Fiz9DV854P7JQEtK:HJIUcEkoiZqDfEFiJJ854TJQE0
TLSH
T18005CF3BAE28FCE2C67A4D785691C640E77278304F51A3CBD165C20EDE236E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 73a056d8bd7af388ec42dbf0f68020d6a9a353f9e1391a0ffd237ddc24779443
MD5 8d4e4b530fd366e6d1c9a422c7ee3de0
SHA1 323b398ccb17a7c91b9c919ecbc1d3b5b23d5f83
SHA512 ca6f845b10202ec92b3ee903c3aea53644d033e45fb0b80e85981517122e786dfacc054d04fc3d995995b9a7dd6dc7e51dab8c430e3b7345929edb30d468f861
SSDEEP 98304:7QvGAdlCEL8c/RRNw5CPousfEkW54NQX:0vyEYc/R3w8Au8+54NQ
TLSH
T1CC266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4716a08c3e2c4c928d8018a294a77b7540d5ac3dbb5512bf7bd7c6dd9b7b93d1
MD5 a0a82d70a62c3efb6650869602ce76a5
SHA1 287882fbaf207f05f58287034a226a9d9070e66a
SHA512 9d46576ffb149e592b78f8d53e057c3802bb31d9908b75382754ba6c1d6dfae8ca81b9f41c57b5ac857f5622f07d9d762fa165b551a06f92f681f4246d502f17
SSDEEP 24576:XSewsAjKEk962hZqDfX0Fiz9DV854P7JQEtK:CljKEkoiZqDfEFiJJ854TJQE0
TLSH
T12315E031FA74E436C67B0DB21B36C716187C79204F9129C3E3E89A9E59342D2277AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0555bf535d962b168593deaf11ca92642d7c6838db1d59b33f03b2b3585d609d
MD5 5d4dcf01cb4d6ef9d6b5ceaffa2b6a2e
SHA1 ba6b52792427ce4122388b3fd0da57fe9abdcd21
SHA512 fe972ba8eb623eb0bc6fa4dc29e2a89b01402715469996c1d99ce368bed84b2d66f195d3d213efd6ab2d3becedbf9fd263d9a896597729e08b30a746c2ca575d
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHru8+54NQ:8UEtQevvqc2W1cpV2RI3268y4W
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b5a8814266ff2cc0d707e5237b7213d2980747e5d9bde7475ce113f094696031
MD5 4910cd00c2195aedf8cfe479fa5af6fd
SHA1 e496a3df4d8890082bdc7b376adbfe0dd94243ab
SHA512 051372066b3cf7e4e78943c349bcf5c3cb665d65a02d5244756ec0e8ab27473becf57f12e55c1907c8a8c794d46d59e9f9ee6792288b150e41e0c2fa958aadd0
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zqEkoiZqDfEFiJJ854TJQE0:UoqtVjnmrousfEkW54NQX
TLSH
T19BD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c028bcbaa15a3cf53a1b7ec9ec8629d2982d0f85f2e2a78872ab82af296f3bf6
MD5 27eac339619255a0bc39e606fbbfc676
SHA1 4db86fc02a3f02a20b28bf948bae7513cc8fee82
SHA512 cd528ac45812965fa9180205680a0bc127a790343c511340bc16da7899779b3d4fbe8595f6e1f007967347b414b2a78e334b3b0a7b440453e370f68e7f4732bf
SSDEEP 24576:kAhGL2IFoiwtA5l7S53FEk962hZqDfX0Fiz9DV854P7JQEtK:kAM1Foiq51EkoiZqDfEFiJJ854TJQE0
TLSH
T14935AD80E7F955D4F5B3AA7899B69171EA76BCAA5E30D20F2250D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0de48c688bd57ad846f26f2bce78fa934631440a0fff1257f894960272c54cb5
MD5 35df7e689f02263ec24567fdd8933eb5
SHA1 bc7b2bd56417aeb78c506bef3b43a559bcacfa0f
SHA512 3b64fbb96154fc23fb53f074236be8ed2751b4ecdf2a502118947f4c32a638d5d1d011aa1c4475d67ce0253cc43d484bd9362de9af5a6accc3d041e4e4ee84bf
SSDEEP 24576:PwuXOW2Ek962hZqDfX0Fiz9DV854P7JQEtK:PwsOhEkoiZqDfEFiJJ854TJQE0
TLSH
T18E05F04666A41CF9E9674238C597C136F7F2BC062A61DB1F07A0C65B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 383567ca6342335843c7811d662d3f383f343d3511d6413f7618dd9794bb85e1
MD5 4431aa94f2c1e8ee2a2e8abc76b8dba3
SHA1 c4fc3d4a47b9914ed3002fe44f86ade38394b42f
SHA512 c1a4bd491b32f43463c77bfb00b54337b96c3d3acb44acc79af3e7a717f4559a13244a27e431c0275fabde8140d30f80ff6e170d179e9a24aea8a0a4e87919a9
SSDEEP 12288:Y/Z1IyaDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:cZu7Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T131E4124522D430F9E9A30238D8E29586E7B078566BB193CF0750925E5F37FD25E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 97f90b03b6a896bc33600382137361f9e7e20739169ea9def2a5caaf3884b24f
MD5 e4205a0e06850652551bc15493ff7cdc
SHA1 5303dfc235e0198415ce175e837fe744846d24da
SHA512 d6c7d773433cd8d11e1b94752cfad439daefdfd19c5ab1a42432937fc4da0ba265bb74a0622923a1f837a41d200ad332860d9cedfef8e701b8a4600575e2d856
SSDEEP 98304:YQRQyi36YOcPhLvw2gAf+PN36ousfEkW54NQX:PQyiKahX+PNxu8+54NQ
TLSH
T120667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 57e34fa681afe2509f656da84b2150fd5878f412cd2474cff64de4ed4787143a
MD5 ec9cc7b3e11f7434feab9acb7b75b64d
SHA1 764d978aa1935a75b4828262215d080a8e66916e
SHA512 81a58d8546a5ec89273918d25accb4506add1da7150544be169de3c9f51a310dcb76df926aaa3b5621d4a7d9b984324d213512e11022846b549a06dfb967deb6
SSDEEP 98304:wQRQyi36YOcPhLvw2gAf+PN36ousfEkW54NQX:nQyiKahX+PNxu8+54NQ
TLSH
T14C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a3a8895f8b229c53a5b8790a5c429c12f4d01d6d054cc77b2eedd71bec03fcbc
MD5 dc8fa1719d7e33b47fec618bbd60d048
SHA1 fe6ff7076b76c2b330f11f503e1c28cb8ebeff6e
SHA512 c6d968ffcec68fc3392a23bb370c028414fa668fb008da929d6b4ab9789b41fb73e381c41b34b5933b0e014129f1ec1587c5bf5ab75fc34a2e2638535ab789a5
SSDEEP 49152:G68Qg55nhceWu7PNU3/6EkoiZqDfEFiJJ854TJQE0:kthLRc/IousfEkW54NQX
TLSH
T156B55A33B2F200A9C44DE1769F4A973196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fcafa7b7725fb1122e2e33365c758b15d584be77dffd39d97eeddb58f7453591
MD5 2dbd562a3ff4b8e65e2fa1d3bf0557ad
SHA1 8b8413058484b9c2bae1ca774dd4d04d566c17e8
SHA512 26f5440f63865a1b0fb08ea359ee6756caacd7a7add71a6d060419567c7a4b24e23b54b2a2039830a5d3f3af394752cd3cbf12909409df03257788b0c5ef9c7f
SSDEEP 98304:+y5112gYy5azzVva69nLKnhZpousfEkW54NQX:vLIHjWhcu8+54NQ
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d350516310affd2e0c4c73fe7c7c1572cfb975dbfbb3191167fbb74363424661
MD5 4fc66dff2a98f2d87ff9f65b141b1724
SHA1 6bc29ee121c70f812e1852e619ecc26a12799078
SHA512 a433133ca4c6e1474967c3a9742a29f48666e9fef3797e6d4d51669615f1383fa60eadc27e93fa807eba2a38f028eea5fb04777271cd1fc28f9a44915cfaf5fd
SSDEEP 49152:nB+taZ3usBWOBr4tEG20bqx0z+n217aau1glAEkoiZqDfEFiJJ854TJQE0:pu6JmUxd2dSousfEkW54NQX
TLSH
T103D59D13F1DA01E8D06ED578974A9233F962BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e6497fff336a261757eb3ba47527ead71e31421714fa256f684c278bc05a8dfe
MD5 7115acc7b388744bd3cce1147ad58149
SHA1 0fc66ff5b543c91251da5971161b1df6ca01cb7d
SHA512 b7ed7e5ddd621b8f723d41bc75a9d90e0031b5bf23fc2b7244d6cba98825caf353b949e5a88673cd2e97c8d756db2eb4e35d54b0518e1ac8e684e107af5af3e1
SSDEEP 49152:k1hpsNoJpF1A6BU44CwH7R4x8EkoiZqDfEFiJJ854TJQE0:kmifPkRrousfEkW54NQX
TLSH
T1E3B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0065823ea073f4efe6b98f7233ef29524067de55df18b87af2ba418b8866b1c1
MD5 b7ba5fa9e358cbeaf2683eb03e8016a7
SHA1 051d64e4e06c7c78422e94d459e1a32302456c62
SHA512 aa2bcd0d5018ce6cdc04620c9b9daf8dbbdfcb6f1d5fee4c60b01247505b727082dbaeb8de1d27c7e5484901afb5d0b17f5839a999b5294be44ac3420712e09a
SSDEEP 49152:fSuZQIY0Be2KNRVtOnks6NMHq7EkoiZqDfEFiJJ854TJQE0:l5dKvi61tousfEkW54NQX
TLSH
T14AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ce143072d5c916299383e9bb57760cd5a9f576d0935b297387d65bb7378ba455
MD5 94537aed28ebfa76f352bb5444dda653
SHA1 f2d26e020acd8acbda9cdcc537da375d51aecb83
SHA512 e865444ec8aa03ae2568fe137362d6fb9aa5740fd05f1112ed007dbee118408e286ef150a62e23671dc25b3a548cc7f45e17ba267d251eb036073cbc8ac6e1f4
SSDEEP 49152:OhtSn8EApI0figXgiDn0AP5wQEkoiZqDfEFiJJ854TJQE0:PX2iyph3ousfEkW54NQX
TLSH
T17095BE13F2D900E8D05ED178C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4a8b9ed672f7f96e94dece08c1ae10c81929abfc777a8f44bafa3e3f7f50325e
MD5 4907b0b9f6bcec9f410e4cc125b80557
SHA1 60ed4b509a651e3b8c60a54de33d56e5e9dd25b0
SHA512 e8f983de1cf27b12b9bf212a9f6fde8d1d8786d2ef6f93f486c6b40ebdb39edbbe384749ebcff309c4430aa11358d1981351a57a7b48a693f038fbb18ca07cd2
SSDEEP 12288:O/DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:O/Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T11DC42341445619F5ED220234D4A3A0E7A8BC3C8EAFD1B52B5B81F10F927AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0f16d41ac3109f4ab9500e610e3b4f5afe6aebf051d8c0a993fce8b7e4cfd8e7
MD5 021fec8a7ae1639a830efaa300cd0199
SHA1 1474f492e3086bcf7b1d02e1028397b2da9729df
SHA512 40655ad6a5c5995935784961ad271ea3ae5538cfb1425dbfedb32cf6402fa16c7fee81adb3132029a9b62c655091434eff1cd0bd7080a136fcefee512851f11f
SSDEEP 12288:e+DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:e+Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T17AC4234144561DF5DD220234D5A3A0E7A8B83C8EAFD1B52B5B81F10F923AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fe02f2e69c4d50727bd2c6300e31cbc765055f5ca168fdfca63f8e292de0cccb
MD5 42ef8468cd3a6f36fe4be1836a48ef96
SHA1 4f9db61d44e48abfe5bd0a7dd1b2e4d7bc4b1326
SHA512 c0c3fb3e1046f54f04cb76a1e937987776489121471f68a57bb73ff9c96501f53c1bc19a7c9a3a38ef03df5c931d3c18adb20a1178efbb39a69230eae29c0e18
SSDEEP 12288:H0DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:H0Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T114C4234044561DF5DD220234D563A0E7A8B83C8EAFD1B52B9B81F10F913AF355E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f9a08b8a06df4f79d36b5738f4e89c4337d4deaf9d6f747ffa935b807073cbfa
MD5 4261a7afecd5071da88a4bf896dade27
SHA1 b710021d9875b555a552ad919ce9da3154ba7d2f
SHA512 ed400a6d39ae1031a66f56acfc7b5d292314c975ac87ca7edf4d9ff201524237925abd246ab5f358d2237814b5c0a49b45549f87afad4866f9d9b0fa26bd9eca
SSDEEP 12288:DVlDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:jEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T112D42341069518E5DC734334C4B390E7E6B87C99AFB1BA6F9B40A10F4A36B205D3DF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 086a550d2ccce85400f99cff3eb2c00eb5cd2106c1215ee656dd511ed8b41e5a
MD5 c064b41958595d220050fbd1a25d1f16
SHA1 c1792bd4abbeac3c3a9aaf7842a33def0ee5349d
SHA512 9d7f363c6d3bfe4d50ec849e0cd38637eedd126b2a958daa2d9c547f47373ce6d0604d6fb65ba18214081e9fb7169f3424b1f6d3a7d2fa295bd3a7e176ef2b65
SSDEEP 12288:qNDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:qNEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1A3C42341445619F5ED220234D563A0E7A8B83C8EAFD1B52B5B81F10F923EF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 108caaf3e2ac4cd4eba1fd227371f7e5679bd81050f142ca87e4248c875ae3db
MD5 458c4bcd8a74e87e67a2c4c177d3d73e
SHA1 b180954ac4e51ebf385afc1aea7c086a46fc55cc
SHA512 f914549457a50e7e009b3a96f89b3c0fdf2950d7cb13052ba31d554f0f349810819bf6ec10d3f738ab266f6433e11031f371349f2b1f99ef1dd89b6b51921f9d
SSDEEP 12288:9CDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:9CEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1ABC4234144561DF5ED220234D5A3A0E7A8783C8EAFD1B52B5B81F10F923AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 28fd2b646a3d242fe1d9e2bb39f06b793f3427e40f5a611068c7b4689dce6c94
MD5 92f40789a89386662d2ef446f651b291
SHA1 776bcac5e2b0cfb33f9122c6454cc750dffb5064
SHA512 097381951047c741e5c3a73dfad487965d98d6f05961997b99be0f3e9683c3b23fedd65a43838f7743629a9d08c81e60a55450afddba2ac7c8750dfe5196c365
SSDEEP 12288:qmDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:qmEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1B4C4234044461DF5ED220234D563A0E7A8B83C8EAFD1B52B9B81E10F927EF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 02efb03deb1c3f5ee4a2718bc5f89c88cfec1cd1d0a65a6c7a94e82a5a5344c5
MD5 f0696494c8db64440e073b4fea2db433
SHA1 3970a131615cedc2dff8fa08d5d51df87d3e3897
SHA512 a92827cc80c780c52c01f242f66f51500282bda83c6a9c4018d8c3d0fed8f7de76dc5f51922fa766f5960e3442b83cc40074c49e03251589eb5eefab394e993e
SSDEEP 24576:mZMMzFVSOeEk962hZqDfX0Fiz9DV854P7JQEtK:mZMMzfSEkoiZqDfEFiJJ854TJQE0
TLSH
T13205F195B3901CF4EC63423EC9668956D6B17C5A0BA0C61F03A4322B5F377A11D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 741821bdd64c4e721c06aca84d51c72fdf34536fffc4b78fa06f07291148d734
MD5 68907ef4e42eebed34343bf26e7dff7c
SHA1 dab2c7fa6ee18dcf2b8401f5b73885651ef6e6cc
SHA512 69331670a0ced4c80f83f76bfe51be842a69b5d2350864ede61ee8ff4eddcc3f4ce4af1ba8965bf7abbd8f827fbffc334d17f674ed7e86b9442ee11702459823
SSDEEP 12288:RLDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:RLEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T188C4234144561DF5ED220234D163A0E7A8B83C8EAFD1B52B9B85E10F913AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 00e14d8cea1bcc0ed8ae724e8e7aa05083daacd8b71c7fd4383ea00e0c28c5d9
MD5 6d0646006062ec5d291975ebbefa4f36
SHA1 449f91e41d80926506bd6945b74f6a42cb496fad
SHA512 9fffc754d31847f4c33a2381f332eeeab4fda65e550da0cb4764316205d12e9d384dd36a0a110388bc51d9624b0364349e8b764c75d7fd981e4157533fbc322e
SSDEEP 12288:S3DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:S3Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T15AC4234144561DF5ED220234D5A3A0E7A8B83C8EAFD1B52B5B81E10F923EF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 41949883b171f451df6eeb891fc54ec7cfd4dfb63a645e793ea06927532286f1
MD5 89e2724ba8650a720ac3d60478ed83c0
SHA1 978e059fd68edaa0c1fd6945c8ffb812d03447e4
SHA512 e524396b958c6110c239d2ac8ee63189edd46b78b4b6689ddccd23b9a7b2c5b5db53e802562efa4d2608b6c4049b462a032443257b02af4c6ea93d141c4250f2
SSDEEP 12288:myPz5L8aDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:bzyaEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T18EF4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B1F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 1ef474146fe1a2cd67059960ad03b8ab2a61da6ff938c2989e6cf61f7d727626
MD5 75eeb3c293485a578f16836cfc80df8c
SHA1 b54615b85b61604c32e8d78ce5d35d3d893fdd56
SHA512 133d6b5b3994e1313f177370367357682f30d6d17aea249657ee9c06046b93f4dc4873a3e6e2710f66b78c0a53d9a02616f285a33896fc3b8d46ce1b24785e43
SSDEEP 12288:lLDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:lLEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T176C4234144561DF5ED220234D563A0E7A8BC3C8EAFD1B52B9B81E10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cc2f918b690d427a1c425730cd636a6365eba691e7af5bcd6b21817e76d7c58c
MD5 d437e257a89e20f770ab39df1120e2c4
SHA1 fe01c8348bb73bb4d82d5446c2254f89dc17ef1d
SHA512 9c9f23cadda1d76f59b36322a5ffa7db92dab1f30e5be4840bb95384ef07ff5ba2dcb79209f3c7e7aa4bcc4e5996bc6c29b1075ebc3b0a383d86fc72a0a3e27f
SSDEEP 12288:DLDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:DLEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T171C4234144561DF5DD220234D563A0E7A8BC3C8EAFD1B92B9B81E10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fe6165ffbc87ff76bc25c277d05d90cf0ee6c9f1c0bbf60745054838537f1b47
MD5 0edba979285501a86dcda62092eba5e1
SHA1 028edd24ffd77d250c6f68a29e1abd901bfa922c
SHA512 3b3135aca1af6217dd320fe05fb5d9440c0972ec6fffff6d20abd15b9621cc8a8bccecc62a078865033d133bad630b073f7034b65d68bbcf76ebcff39dcf3cbd
SSDEEP 12288:eyPz5L8aDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:DzyaEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1ACF4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B1F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 be1fc5c514665d4080fdf99359c481eb6e22bf38fde03d5fe34da8a54efcd8b4
MD5 f802d76a46f9d91fe302d36d7ec216de
SHA1 bb6d7abb9fa92b5babd7ca9d2837ffc06aca9148
SHA512 96778f7a4f1bfc6c0f9f442de746eae3250386f98e449e7a32b2aa118fdfc7a5a8eb0398d1862e1cc619d8640b399758783e7ce5b250744224864793a48905aa
SSDEEP 24576:eT9aLl3z0zDkEk962hZqDfX0Fiz9DV854P7JQEtK:eTQLljpEkoiZqDfEFiJJ854TJQE0
TLSH
T18805F194B3901CF8EC63423EC8668956D6B17C5A0BA0CA1F03A4366B5F377611D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 17ee77b1586b1ca8d7ea10b11304f8baf3c62213eb6f3b87136278a34d281742
MD5 4c2dbde89a10d5f147539ea65a9fe3c0
SHA1 0a0097d04637f35f037ea7165dc50ac1edbb1468
SHA512 2de4cb6190fd962dd4d53f026b712cf23b871b30d5f43636f8578680b57ed56d6b8d74e45a44568a5acdc795f27af9ede881056c40d98448a5f36df66efc6dcf
SSDEEP 24576:L3td9CHKy7GZIEk962hZqDfX0Fiz9DV854P7JQEtK:rtd9CHKyaSEkoiZqDfEFiJJ854TJQE0
TLSH
T1F425CF90F3E414E8F0B38A35C9765512DAB67C5A1B61DE8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 87cb2e4e6d6deb8ee17367b6d35ee7f27b7af887f1ed438e66a4412f36dd9372
MD5 5ab9c8af3735113c7c9439bf108acaa5
SHA1 03766e7beb1125e0fef341e74524fdaaf11245bd
SHA512 db6a19e87bb532a4d200f43823959a45ffb7a95d86fa74ce30ee7c663e757578bd68970f9d82107d7d6d18eee1269187642f5aa08a21955a0f50d53e356327b1
SSDEEP 12288:5UDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:5UEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T12AC4234044561DF5ED220234D463A0E7A8B83C8EAFD1B92B5B81F10F917AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 edfac4fb4721e0d57583869e80154020f4c9302253e785754d1026d377ad6b6f
MD5 0f58028ed3d8c81c9c2596de8823e4ee
SHA1 a973d9b209c44b20d28a9bc6654aebdbeb73246f
SHA512 8188df66e446009fc1f8137feb7ef2bb388de10d507dd2f774ac401dad097d96656fb646de59581f982b27aab85981011a20826bd77a167c70b6d3662a09331e
SSDEEP 12288:U6DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:U6Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T14EC4234044551DF5ED220274D4A7A0E7A8B83C8AAFD1B92B5B81E00F927EF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2236f203f377e61ac0f4dd8f7579aeb85979fe3584608fc4f94263c73701058f
MD5 b0137a467f2c0244ef4d71c2588c246c
SHA1 afa097750ae8a3feebe5d74dcf8ff4cefcd1862a
SHA512 4dcd2d4c19f0709969d2d52eee1cccf5341c971aaca724bb1ac38f1ab9c24df3f90dff40a4e80e42a96e9cf9d93aa01f18ab28670b5d7393bab8ac6f7e55ce50
SSDEEP 12288:uRDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:uREk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T124C4234144561DF5DD220234D163A0E7A8B83C8EAFD1B52B9B81E10F923EF355E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c99ad9abf16df71bb1ba7a962f1ddc23d1b1aa93abd2827d3a191bf7232f55c6
MD5 0f4c593891221e18cf213393e918889b
SHA1 210027fb40d7f17b52fbc55b8d27a0639b499474
SHA512 43e8c39cbfdc4dfc59c4aab4c8a1637b3e525616373d33e7a5a4df6901d3c72a62c7d54c3beff2602924deea41466943b84e17c65700e03ad7277681c0b9008b
SSDEEP 12288:qLDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:qLEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T138C4234144561DF5ED220234D063A0E7A8B83C8EAFD1B52B9B85E10F913EF355E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 72622af528617253741b84868e2deccae48eb7197adb8ac6149e11e17f7d255b
MD5 c93127653776d5c03bd06682d8b757f0
SHA1 3e781c21d9b8f23ac0cdd955c80baf3511827883
SHA512 5ffebaeff3e48bd62b0c4b5743f1b16a16fb98481f91d9f36dae9f463f04291efe1de5ddeb8def57dfb3668110b19345a79c3552ca61918614a229a2fb841e28
SSDEEP 12288:1UDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:1UEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T139C4234144561DF5DD220234D463A0E7A8B83C8EAFD1B92B9B85F10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 b6d68b379fc499bf3892a1326f90e8f842817b2ddb436a7f75b1718d63e9beca
MD5 19c8b40b6423af94551730b45f5bb1f5
SHA1 31a402aecc92247df184878174d69a3219077168
SHA512 5a18da5c8f6ab897a724906c0e3c6252dd48c5cab5a34aaf5e451cfd1fb554a7a3a761f9a06be7962b8f358dbf30bb6b8efb86b727030faf6dcf1b0e379c5237
SSDEEP 12288:DzDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:DzEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T18AC4234044561DF5DD220234D5A3A0E7A8BC3C8AAFD1B52B9B81E10F923AF365D1EE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 4309e3f2893acfbd53306fa3e7c7daf9b8f6a994227b6393855e0555d168cf36
MD5 d5e2ee081455145537c79090b7518631
SHA1 1eca1ddb3ecc2a697026351fe14412f05f0ebec8
SHA512 451dbace8a30b32632eaa97e5d0d6bc72d6089fbe8b84ecd9060898a74cee93e167dfb1029cb23470936b32682dac1e31243072a284008f244a29727d266b736
SSDEEP 12288:yNDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:yNEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T12CC42341445619F5DD220234D563A0E7A8B83C8EAFD1B92B5B81F10F913EF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b300f6a997d8d85b2e514a00475950a7d85e51a64f9f47fda7ce0bacd6363cd1
MD5 1844e892d2efae85cbed4b88ca2c0d40
SHA1 7620b69c0d85f2e2843b8358d1cfe9f494c80415
SHA512 be657f8824e968e5d2639d3efa6448f7217ec2a0a0b9fdcb5300355dfabcd1b76f0ffa952bbe35ce41b44795405ee5e5e01416fceb615f55b755e9d93ab7da55
SSDEEP 24576:Cfwvok9RX6wkyAIHEk962hZqDfX0Fiz9DV854P7JQEtK:2MnYIHEkoiZqDfEFiJJ854TJQE0
TLSH
T1A335DF29EBD808E5E177923CD9B3460AF6B178591B31C6CF029A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 54c14589b273d28fc4a13c5c3700bc9330e2f2ca6d955da023932a5c8d77c0cd
MD5 9e7e066abd1fa6bc0afccd4b161bedf0
SHA1 4691d350c6d036ba95391539ebf1779767ad5d10
SHA512 b9340e62d05daaf5570b7f4973e5f845e2415f5f6f121c9cf91bd5428c31ff3efef6c452ef30b572da3dc028db60fada2c26e7b7a227c7594237f695c90ff6b7
SSDEEP 49152:kYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wEkoiZqDfEFik:MySzPaousfEkW54NQX
TLSH
T199066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ad20bcf12c3ed162adb1068da409adc5cf4c6a989037ed1ebd140a1553ff962a
MD5 166af67249a47ce7862e43ff63864a02
SHA1 8d0b81afaac847da60a5905200a24d5bc5e884d3
SHA512 e65aba2ba0a49ba5772b01ca6729b5cb1e6328ed4b6412246c242c50a380e33ae6bf3d55097680d08d143cf337576458fe27b33d029d4ef899f0bf7f1baba4ab
SSDEEP 24576:A47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYuEk962hZqDfX0Fiz9DV854P7JQEtK:A47JUQj4irIhCnDHUPfF/AEkoiZqDfEd
TLSH
T1A965AD1DA3EC01E5E1BA827885158A5AEA71782E1F31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6bf096c77d35c59993de1ff88b331557de2d6e97f2847c0355e0529f3290101e
MD5 88433a54c18262323960e0d25fe3bdbe
SHA1 17be95bc3b16172dfd9572f126f2d2831b8cb81b
SHA512 7e9fddbad7bacf9abfebf2d1875890c9fce2dbb06bebfb5d27c93535f75bbf3d2553e5ce2412e2a7c8491798a298eb180465b1251371f885c62511013dfb0e0b
SSDEEP 12288:VGsf7DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:v7Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T179E4F109C29412E8C46E5235C7565682B7773C658BE1E3CB57C0F53E0F3AAA09DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 49d8c7277c262559922c777f9b1bb84857490e0d1be57ad61ea36f835cd4c0b9
MD5 bfd3e04b08855f73727ac2cd4a513f23
SHA1 770580bd2b0fc11a16f48060190e6b3b172ad81a
SHA512 f756b54f2a09c8d0427edc7e3eb06277c75b8f541fd25c919a7bdb7de6d61cb643c70d3b18db6634cff597c6e62e4dddc48b4acb0d91639cbdcf754840004111
SSDEEP 12288:lM7jDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:ejEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T138D4230141992DE5ED720230D06B90B7697C7C999F90F497AB41A24F913AFA18E3EF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e6ef50b1a7bfe2eb61811b14bb27d63d9c52bdf59f638b2a238d88d2b2bf3a4c
MD5 89eaaf2254388aeb5bd6f5f61790fe7b
SHA1 a6ed312da3c5fe84e9fdd3b1bf95ffe56981071c
SHA512 9e9d58055d6dbd3aa75f149472f0cc702dc8ace67c3471a0bfe691ffcfec17877d1ec93e6dcafcfded2045e2063cc010f1f2d70ec29c70f7e6b1bc81f6097b5f
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYpEk962hZqDfX0Fiz9DV854P7JQEtK:rgb4mBIBhGFuEkoiZqDfEFiJJ854TJQX
TLSH
T1C465AE1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0e36db2836651b3a040c920463da8ba87678bbb3eabf857f06aa42a77c1151aa
MD5 bc447cc2b34cee53c69a9ced9cc3d850
SHA1 eaf9c26843e7abc3f87682b5b78f6b06225e1552
SHA512 a442359785dde44a8b9349c741688cbf166f6351a3150da8bc01013f02a64b140d040a16bf7c5db4461526cf0d60a94f6f73976eb557ce5ef3c4188bb57abfcd
SSDEEP 24576:LG88u8FpJqH1Wzria7/meEk962hZqDfX0Fiz9DV854P7JQEtK:K7ZFPqVha7/xEkoiZqDfEFiJJ854TJQX
TLSH
T17A35F16566E101F0D877D138C98646A3F6B1B8250360FBDF07A88A561F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2fbca13b673ac1b7f086b03bb9b90e049b829f648a2410ba46cdb432e894448d
MD5 3fa1d18284cd730a4abf7b9963d2c844
SHA1 5b12e401a8113b8142ec9581fa12a840ad1e69aa
SHA512 67dcc21e6632376276e9e305122b9bbdbef141afd931b7e5186ce775a612402f522815cf24cbb727f6ec65fb44f56e01814b42426684d3069ea141cfffce95a1
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCEkoiZqDfEFiJJ85V:cG05lO43bRousfEkW54NQX
TLSH
T1DCD5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b32f18edc547524569e5b8c7ed3c0b4dd8da752e1fbdc7e5cb650012863cebfb
MD5 6c53d8fde8519eb9ba02802957d0308b
SHA1 596e370a9285b0519ba3fd882c978578dd0417d5
SHA512 7ddce61ef2fdb291bb7b8c141befefe0dc657e3e6e93b0e5e3ccbddf239b5ac0df0e9b14fb704964667a7d37f1a12118b429b9c8e82833aacfb5ce35c3f73318
SSDEEP 24576:hfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnwEk962hZqDfX0Fiz9DV854P7JQE0:ha5POZ39Jt2pasx2+m6EkoiZqDfEFiJC
TLSH
T18E65BF5EA6FC01D5D5B9D17CC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b05b6a2358a38a272a4547a385406d95302667bc06b0012b0f87f149621c7a58
MD5 b398f0567c95cefb87253b0f9064b33d
SHA1 99e4561a75df273f9b1bfec4f0231baa373ff33b
SHA512 70e15893ce3029b13712d2e39a8705318cfd20f85eb04d2a981993ae60b472592b66e7dc5504f42a38d44bfb45bf152f25b4b13badcd3db3577f65a65af2d028
SSDEEP 49152:wNc/zEOVHFREkoiZqDfEFiJJ854TJQE0:JIA1ousfEkW54NQX
TLSH
T189858C1622E901E4F5BBE1BE89779546FA71786917308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8b39a7830e0dbeb5a7e72906dd434c99d3340de56bc1d9561853e547ab009e18
MD5 367b149fd9fb66c7f6889702422ea030
SHA1 de08250f96755fcf6f0a9266b4a0db5262851274
SHA512 51f999575874b43dbe92191b9200877f2adf66e969cc52f3cd183f67cfd96d460b43b8be635a41a6464ae6057f20f01a1d8540efb4990e0fed5ab46a6a4d6398
SSDEEP 24576:htkNvNnaFeYhJNtmZBmsEk962hZqDfX0Fiz9DV854P7JQEtK:htMwBtOmsEkoiZqDfEFiJJ854TJQE0
TLSH
T1C755AF6EA6B806E4D1FAC6B4CD238512FA727461073293CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a9d5b30881247d687385334ca1d27b11906dd16c484a6ee22fe81007580768d7
MD5 817e53d4ac61672e75672725a769507c
SHA1 e15adc3951f665098dbecb3c6f38845daa570cb6
SHA512 fc8626ae13e251d4a20f56f203b662fccb3ed81b60d7fd721fa96f4bd242c7935a2a9739ab4c33ebe2e3494da5b9cb0162f6bed96368bc3d81cb68bfbbe5fbed
SSDEEP 24576:KPUr+NQSEk962hZqDfX0Fiz9DV854P7JQEtK:KJQSEkoiZqDfEFiJJ854TJQE0
TLSH
T1BF05E11E22A91CE5E676A17CC5828619F77178621711E2CF02D0817E4F37EE8BD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a344c8ec32078a0b5a020812abe66b715623229eea76b128a37a178960682ce0
MD5 2623ea1094794adb9240d7676f4e56dd
SHA1 0c2f9370936fbc8e980bebc5238e991ca2b57ac2
SHA512 7ffbb93b867257c9ee51eb51e12e0bbe5afa260c9fe4aea237c585cd28b23e6a21d5d97717d5c5d0301088b17919cac446ed1d2ad2b89e311dc4d2c1b05dd334
SSDEEP 24576:3D3FHshBIYQgAfEk962hZqDfX0Fiz9DV854P7JQEtK:3DVHeBIAAfEkoiZqDfEFiJJ854TJQE0
TLSH
T12225E12DE69C04E4E57BC2BCD6638906E67138A9072265DB02D0C1BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-434-0x000001F2C9410000-0x000001F2C9593000-memory.dmp

Download

memory/264-414-0x000001F2C9410000-0x000001F2C9593000-memory.dmp

Download

memory/1420-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1420-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1420-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1420-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1432-81-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/1432-354-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/1432-344-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/1432-8-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/1432-7-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/1432-0-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/1432-1-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/1468-329-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1468-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-112-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1468-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-106-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2260-297-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2260-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2260-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2260-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2284-99-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2284-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2284-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2284-419-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2284-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2284-417-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2912-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2912-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2912-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2912-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2912-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4220-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4220-118-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4220-126-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4220-361-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4272-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4272-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4272-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4272-405-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4312-328-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4312-83-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4312-88-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4312-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4528-131-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4528-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4528-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4528-142-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4528-137-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4704-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4704-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4704-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4704-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4704-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5720-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5720-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5720-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5720-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download