59397a3fd93c35218e17286f4e64bcc83097eef8ac2aab71331c2f00eb9baae7

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.5MB
Sample260802-r492favfpg
SHA256 59397a3fd93c35218e17286f4e64bcc83097eef8ac2aab71331c2f00eb9baae7
MD5 23a6629785cf7c294ac2542d3d050a70
SHA1 76d1491d6a42784608e41f657510ae2b6cf658cb
SHA512 04fbf999297cf9f2e17c9fcf5c84f0bed0b6e9aa59a39988a6a452d3c5f904da1a939b251479f2e787d59378c65a56c77ca849d5451d3dca4c3c8117002c56e2
SSDEEP 24576:cNNo2uGjVQ6ccYDEsqjnhMgeiCl7G0nehbGZpbD:cNSyxHDDmg27RnWGj
TLSH
T14275F01EA3D849F9E9BBD13DC6928607E5723C559F30D38F03A1165A2E336909D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3424	elevation_service.exe
3452	elevation_service.exe
2872	maintenanceservice.exe
6140	OSE.EXE
2940	PerceptionSimulationService.exe
2632	perfhost.exe
2188	ReFsDedupSvc.exe
5984	SensorDataService.exe
1796	ssh-agent.exe
2416	AgentService.exe
3372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4a365f1ae62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000029e9eb48d22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e6b17f58d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b82c8f58d22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000af3bdb48d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8e605b58d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe892ab58d22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5960	2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2188	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2416	AgentService.exe
Token: 33	3372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeDebugPrivilege	3424	elevation_service.exe
Token: SeDebugPrivilege	3452	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 1608	3372	SearchIndexer.exe	100
PID 3372 wrote to memory of 3384	3372	SearchIndexer.exe	101
PID 3372 wrote to memory of 4692	3372	SearchIndexer.exe	102
PID 3372 wrote to memory of 1500	3372	SearchIndexer.exe	103
PID 3372 wrote to memory of 2516	3372	SearchIndexer.exe	105
PID 3372 wrote to memory of 5156	3372	SearchIndexer.exe	106
PID 3372 wrote to memory of 6136	3372	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_23a6629785cf7c294ac2542d3d050a70_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6140

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2632

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5984

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2536 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2536 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 85e771ac277f8c35635fffa9629395d48e3435ddabe43387808867e0c6bd320d
MD5 8b6cf1863806b7e3c9f01b38742299f6
SHA1 40f321b3b7d63ffb9e1d33b78e76a345ae414609
SHA512 3db15fece83ed560c2cd0afaf526972f8c7288160797f0ec291f5d5d96774169d2e5ac3fd0a775ddbd07e0693ce1bbc101562b65ddfb30551703ef3b2a254adf
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2Dmg27RnWGj:43q6sjBdD527BWG
TLSH
T11FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 241b56d5a781c63ff14b81cbea603c652ed2f74df1fa1079fe5fb66f500a8aa2
MD5 b74003915a9b6fe979a4d3bc1bf31cb9
SHA1 6a5bc2639f3448f3453686fd640f15565b682a71
SHA512 f77357c6e8282e47ef467d6b1f2a9c62685d9c3176735615b2b003b12a2f2eea7515dbafa0208f85ad47471c029c9069f8bb8d90b0f7b356861e2015939ae312
SSDEEP 24576:gXYfDtczANsqjnhMgeiCl7G0nehbGZpbD:XtccDmg27RnWGj
TLSH
T1C5650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a986f7b32354e8a44ef7c10856726a025ceac12233cddc296606192094c43de4
MD5 ccef7f8c52f7d84de87ce483ce7277c3
SHA1 852a41f159bea5142664f8ff444cff9460064649
SHA512 a5abde4fa4ff50e9a71f6bba2957e97165e606826c2414dd0b229a72b25e5817e8610bea60446f7c3c048e42bd5cffea985ca230b585b5e81bb1f3ffab06d74e
SSDEEP 24576:00Le5ji0hmxxrMKsqjnhMgeiCl7G0nehbGZpbD:0Pji0AjTDmg27RnWGj
TLSH
T18E859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eb855cb646deaef2d4a762a1265f73bdc509632892f15dcff844f4f6bf1de631
MD5 7d897cbaa9a813970b04789d83e7c2be
SHA1 2b6b0908c8c102df757da559f7746dbba47f6391
SHA512 8528ce7d7ed2c34f8553333bca2afc5f699662aa7fbc385b48118cc3c2473803e50a26acee31a2c58c3b921b77cf1edbe92c97b3fd017c7aec301d7a7c53c7c2
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWn6q8wyuQsqjnhMgeiCl7G0nehbGZpbD:m/ezSC6vUzPveHjyXDmg27RnWGj
TLSH
T180755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 155a89a15cd792e071cf306aba3e26fa0dbabbd671a36199cedf7efbdcd35ad5
MD5 ddc3a41766f7897e4247422c1aa03376
SHA1 8256b4b5e2efabd2f51a112c84b9d9d98da02a19
SHA512 7387afa484ad4c47bcc83c69418aaf52a53ed81bcc6a0b2168892ca1e1eddfcb5a5de6a86010e89bf2737b92f0e4dde2440cc3f5be14d360162705d71de05e4f
SSDEEP 24576:TVbqPb88hv/l+YJsqjnhMgeiCl7G0nehbGZpbD:TVO88hXl+kDmg27RnWGj
TLSH
T19C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f7dc8e0ff698f6e1bf70c37af0a9a58ff1ec159d181ec619e486c2147b6f33c2
MD5 195b3fb7998230ce2afccd23391a2623
SHA1 cceed22bb54df9c686e05993bf64b4abb763545a
SHA512 ab0122240b506350acbc1dd734bf3aa07cc37fe7314effa39f33c7568c990cdd1c46458c0c0d4e95a1cbc882dfdbebc31b85eec52af0514298afe2a0618dbff3
SSDEEP 12288:1L2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1L2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1744523BF864C50CAEB7608B5C3E9F11EAC137E56982008536AA37DFDE5B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fa0c7e325b0acf619d3121ecdc956d8a0b7f3b2aa167f3ae49274aecf4193a0f
MD5 ecc0f876f9883b0a51860c8a35a4e59b
SHA1 5b6e1743fdc52cfceac0283465395d278a05fcdc
SHA512 c203299a9876d590d2b51e00a057e84735a5cacc36b7b35006b67450377d22258611ca7e1a54e959d95cbf07433012bfc4e8f3d0d233fff453509563d9be76fd
SSDEEP 12288:geBNUbTVO86UBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:gJIUBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5d7191c6bb775cc0bfe3143615ef474fe23f0f8dfd3ebf7e98b88f24ef5aa22c
MD5 3b840d816316d699511fc11aabf2ca05
SHA1 b0e8fc2ea9618946dd8ece961113cd7b48183904
SHA512 3129aff9513dc415ff6318253c259d7326ec4d8ff66bd887605d6617f30c36a0a053a8fffb9a33b273fdcf9e5a1e7c536178e7c8d2f209172df937eee43ecb62
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:rQvGAdlCEL8c/DRNw5C8D527BWG
TLSH
T10A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 366c2929f6621c6a71348eeffb13dff2d3da2a1c9eee64e6edac0932dd397ab2
MD5 01be3775bb52e701dc1b5b20f372664d
SHA1 2669c99391c8e4d62d36e3861377711dcf754780
SHA512 ae7267a49b9af42188134e971aa5e0e3c0ef4a27bd05e5a302fe858b22f53c3b2262a9d7102439916538271705ba9a10f790ab1b3ddad281f394e714f0d2062e
SSDEEP 12288:4AwSfxL/2Dc3RDLLmt0LDQewsAjfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:d0ewsAjfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19275E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d44bf5d98d0fc34217a737135cbe201e134d97ff0f2f8fa4f606faf932a28a6c
MD5 79dcf9e770a94ca5d7fdd64b0ee05e07
SHA1 ec7f78618afa2e694e8ff4a6778267fb99e7a0a5
SHA512 bce52e083b19f06eaa26566f382e091c1ea859d89b5e26975d40f8c8675ee77502dcf8c8521d8578a61eb4443e1a060343b0838d7de4dd45b2a4c6f3b4886e50
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbVQBWG:zUEtQevvqc2W1cpV2tI32yB
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 52ba770a6525ec73d3042bdbb79e4089a776ed6ebe6b99f1c12143eb65fcff60
MD5 a85659cb3829493519cd12020da932da
SHA1 d472623dcfa3a5a3f7a39e530f9e9e83c15347a3
SHA512 377a0ecc125d72ef5a72a1e31162ff46cf85a09f6780b7c1f68c597fff24ec702f128378c26f5b4ddf298440ff5dd417287fc37bae38979bf31a8727673f2375
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/zjDmg27RnWGj:4oquVjnmQD527BWG
TLSH
T121D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 051f3d321d7a0a61072e6ff937e845acf8928e1b0d4d97d3202e171cfd66eede
MD5 a5cc149e0da329c50c95e7499bb328c8
SHA1 6db39f686152793962f87aa4d787a7ad471e7b81
SHA512 9ed61ffc64bd79f632beb5fd08b5972598b27393ab4939fe83c4263c3068dbfa8af9c870042e84d37d61dd3f9302d963471d5b0f959696951f098d13bc6f7178
SSDEEP 24576:wAhGL3IFoiwtA5l7S53UsqjnhMgeiCl7G0nehbGZpbD:wAMUFoiq5ADmg27RnWGj
TLSH
T1C3359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 80efd2e257eaac3fba48aa7876d477e443d87c6264477422be072db445d893dc
MD5 a5fd5b8d4abe45333c6c8ff515f05940
SHA1 dbbb7cbd2b44d3efe838bcafa92b722106efd8e4
SHA512 ed459aafb4cad4b9113b5de30d5efdbc727e13bfc0d6d979ceef1edfec68b46c17d9c0bc43b7d577970013cb57d684889bf7db1f6bc4ff6ea9397d5988ab172e
SSDEEP 12288:/mw5HEjsChNVBFgl0WDm+CwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:+wu4OWzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D065F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c310480f69e1ad19d3282df636f844fa91bb1353de6cbdb8e600bff03bca2e23
MD5 80c461c06765ce0ff8d31d42d4e97181
SHA1 854920db8ae65cba63abf8b3abdae527fc31a885
SHA512 f6f897259ebdecf2b21e088ff070236d53f91b4ccf57c4b04073981b871d35468db38955eea3ca7d9fcc910a226e3f35603c9ff75656aad5f860307d2e14cb0f
SSDEEP 12288:QeZ1IyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xZuisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D15512AA239820FAE1A3417CC5E5D609E7337C62673043CF166659AA6F739C44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 653d91e9cf8dfff7bd366a6044e8561d699a19fece024e6f6c34f0a7db97cbb1
MD5 4c2b5c871413c49b9056cc796971b14e
SHA1 cc8ad9b6d7e35be561bb590254378215b06de4da
SHA512 e86f1206605e2cb8c00213050d7146cc4719dfa29bc436544c46575242e925e8b4906a485d4f9bc55aa5b6b41b04e5be2b84593efe0ce1a1fb0de9f67f67bb1f
SSDEEP 98304:UQRQyi36YOcPbLvw2gAf+PN35D527BWG:7QyiKa/X+PNJVQBWG
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dd6dc49638f1d5f2bf39fb5c30f0a118f6a36f8600138c630261a4eaa4514e37
MD5 226a9ace8125aa02765e1fcb34425f90
SHA1 9c3cc84f4fa69ad7a51abc41e8724e390a52998f
SHA512 521b32a512f3baa1e642c594995ea257ac2b579e6504c4a263b3a5e30f10a6ae61788999b03335f3257257a752dfeffa7d50c182f1107ed800c92ca920cd5954
SSDEEP 98304:9QRQyi36YOcPbLvw2gAf+PN35D527BWG:0QyiKa/X+PNJVQBWG
TLSH
T178667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c92001edc0da52344a1d1f62844030cd4ee5e09ddf296ba5dbb783202c41764d
MD5 6324e41a4188684ca8d61afcbc2c73dc
SHA1 9722b60915e1c12bd9749c7113bb054d071c75d9
SHA512 21a704caa6bbb66591541ec90f4d5b5ce83b4ba022c886218db90a8d5561d150f2a8b361d1d725f73dc7d90209abec4ef33c06bd1972eed5f4b4f2f4d0cfa18b
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ysqjnhMgeiCl7Ge:t68Qg55nhceWu7PNU3/TDmg27RnWGj
TLSH
T167B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e11eb91c56bcc0620a2e4964531733fa122306b6f872335e66c2648c81c08510
MD5 f3f288fb808bc9f2720182d9dbbc60f6
SHA1 819224c56f31f96606c8547babf4058753795a1b
SHA512 9a5671d377ec4b967d8d7de0673cb9677479b69b5812811edc9c3e64a94303d0e1731a4197d0bb35e967216cf28be05f5ed1f820bc51980e7a4f7c01510665dd
SSDEEP 98304:Ey5112gYy5azzVvt69nLKnhZ6D527BWG:FLIHEWhoVQBWG
TLSH
T18B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a7b8e7850a0ba1159f149349f6abfbdb812c2742e45c63360c696d7bd3f1c8bd
MD5 a0a274f2bc905d7dce2193a32148a227
SHA1 68edace543ddd8d21045d6e85c1b376a6758da1c
SHA512 3b89b7a102cb75d90c2e9f87fd5f1826b6d3770cc4c3dc22b259d1b8718944be8e34b49daa4654a236fc61a01ccdeff713d2e1e0156b1bbfd207974e302bbe32
SSDEEP 49152:yB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glBDmg27RnWGj:Au6Jmdxd2dBD527BWG
TLSH
T1E8D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ecdba9e97e35ebc523420c044e827c926aa8f0cc07c2a8aac0e980f0c399be58
MD5 83a6dce4905af363ad290c804d4b458d
SHA1 634040c7901f4a877679bc7bae79bccf6a9c9a67
SHA512 4027427f5880c29fd772efbf4c935eb9b93d209e01ee0b88bc14060186e5cde824e7b35a50246bb4d459b2ed8890d43abe473b3a60a37718e7688dd4d63ccfb1
SSDEEP 49152:Q1hpsNoJpF1A63U44CwH7R4x1Dmg27RnWGj:QmifPWRQD527BWG
TLSH
T11AB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 435f4d92599acf63488a9e109be264682890f59f337a6f15f1e4db450e82bab0
MD5 e6ad945e9a5e8d29c2354a4224f28637
SHA1 b42ee511e72aa65c592e04a43b4465440ac2dfb0
SHA512 a170c0c3792ab376b2435cb5db4e84bb7fd4d1732ecfcf0d665b4e87ec0cc75f9d1f36fe795b749a32a05a6168f7857b0ac9887859cf4bcd0f43ee50202271b1
SSDEEP 49152:iSuZQIY0Be2KcRVtOnks6NMHqmDmg27RnWGj:85dKii61mD527BWG
TLSH
T108C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ad0f1b50d8b257e2c494dc86f6a4a34e5e973f0958764cb7abdfe96c6adce24
MD5 ac1c08289660441619f8a0c27c38361d
SHA1 a5b5d24ba0fcfee41fc6805fb662b8d0d0a543ee
SHA512 12b945d7a15a6f4d904b75796e95b50fb1b142830bcdd7a864e478b7cfb48f4a09ed7ceb5fcce991886b6eacbd962e0ce1736283decf5aec3886f9e7c182f88d
SSDEEP 49152:MhtSn8EApI0fig3giDn0AP5wxDmg27RnWGj:tX2imphUD527BWG
TLSH
T1F595BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 27eb9939c8cfaf17570b82e06cd16e1b4bd7b1805f2a0d0400daf28330d23dbe
MD5 bd83e61396ebe77f3d13e94648d717bd
SHA1 0e50ce13b4bd6bf8c0e064f95c711028e9aeb17c
SHA512 4009bdd8202778b2223c83ce9753021ea41109d004f82538a5a443ffd661b9dc9f76fe213d1d3c1a9ae6d27819daba35b16d3a5f2e481026ee43b4bda9ffc8df
SSDEEP 12288:hOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BE964C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBDF6B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cf770ed2c4aa35b340da23395719925459f4d709d70f927959a1b71f86daec1f
MD5 bf0df63fc5a8d8191203cb83cfffd365
SHA1 afcbf94afdf938e553dd0228cd18c1f8c76cd550
SHA512 2930bc7e0f430bd074a26e117aaeaae8d41b16efa635086211e18b25c0ca195299085fcb6304c5b3824995e46b4850606be9f9ed7c1b0552b2b543b2d2a82d0d
SSDEEP 12288:jbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1224523BE964C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2213a872896962f6954f2c309fc8a7788f26571ce406c1f72cd7d0516fdd50f2
MD5 723b352e9cf650bf8639cfeebcdd670a
SHA1 dffe23bc5c98b4d189bc5d38cd32e79d3987e8a8
SHA512 fe18cd3b792e4fba718dbd31ba4390fea47a3cbf8df77035c224e5bdfbeec1baebcd1c719ce90333bd57e499e810a37ca5336b2d2ec46f11ab5efc64e6167b85
SSDEEP 12288:FZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 89016ebf1b46f377be8bb4ebd3b06ea54beb40b86bd65c64d1adba28a196bf53
MD5 5b8d7847067c163577f1083fea7de341
SHA1 4dc21f01a8a48be0752c5a707234f5bef481223a
SHA512 a61e2d0b214b3227b03d539c76d53ac710f24c0c7e8b0a69cb08c403848197f013cbbac77c6190c231be58c629ca032d788bf0e7c6b9c1ac9529df402f2c4c8e
SSDEEP 12288:FV0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A45236F575C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d7f226e0f4b44fe8a52c6e0719cffffb1b2fd126e690df9cb4601399153b121c
MD5 cbea4c8581925de4df670d0796b1bf9a
SHA1 a7edacd7e7f54b5e8d9cf6313aebfff6a51b22b1
SHA512 ed0119233308ed1b388550d9deab13e4a182997aa85a39ff1c2338f7792c8ef929c673c1b2d9093a1f05ee852d84c3863ad482a8ca5ff87473db6f3eac1e76e3
SSDEEP 12288:VcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE964C41CBE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B28584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 54ab8af3a987f7a89dd47a4e280fa53856dae74f7fb891e76da6c6470cca7faa
MD5 7a3c70d3507b2eaa2890c431a0840c95
SHA1 2e8b34d8401f210a64710925ff15279f68a004f2
SHA512 b4e16763dab6441b6ce124f2f428731fb2513b05ce7e3b46ad645b5e638e64186976b3d1349c6a801f5538939bbd977d53981166e30e9d3475923e2d70722eb5
SSDEEP 12288:93Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:93sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8d4660df9049977e20fa49238e3e16a9a3ca1fadceabf6e3b2fed2547a2e8e61
MD5 d5fe34084949f069b8c6a9538000ab72
SHA1 2d0075bfd7a36e49296ae5de7751d99a36e5dae8
SHA512 de6bdcc35cbf8200e7c5bbf849a9ab13ca2445cb5bd5be2c84fce9e17f235658405bc788891582bd0b82ff140f1d8a0c43c27b3ff6fcd4cda1b44df57bb9a421
SSDEEP 12288:NDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BE964C41CBE62644B5C3E5F15DAC073E6BE9200483BA5B7CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 39707fe0033df0ff57ae0be41655b9a9a3ba5fd604954cd9ee3e315f33f4224f
MD5 d94b5d78575cd211db05b6a5fda5e8e2
SHA1 0927306c064e24b19a37cdbcc8a6356b5e833b1e
SHA512 62ca92a2066d858d6584cb42d2dfbcbbde7bbb33183f57804f5f464630449468d47971d18fc57fc1c75205c0c22d8044e69946a390f061623fa2e93b6ae56b6d
SSDEEP 24576:5ZMRzFVSO7sqjnhMgeiCl7G0nehbGZpbD:5ZMRzf7Dmg27RnWGj
TLSH
T1E46501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5a7b748079ac2b9c504524a89fd7c9d0509c2db90f6e98f838775efec51fe28d
MD5 38abd5047d5c4021287417f69e7a52c5
SHA1 459039c9716007358f8196e909573932e54b0616
SHA512 00676f327d8309971d87fc92444e7dddba8b4365e029bb906bbc5f10ff4270dc2fe6a2ab430ff1c6e113e5b82788a32df67e6e130db2d32d62110197e3f61ae1
SSDEEP 12288:mSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D74523BF964C51CAE62644B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d9781daf96898370a815d5b53a352f76b9310e1d907dc3bca4b5324efd72d068
MD5 e1cca407bcfabd4979a7629eead3c54b
SHA1 b1a78681fb3397bff8092d5e17cf978c00d3a1a1
SHA512 09891f8a169149b64daa38a4da9dbff07f9b300869d00eb65f20645112e796481cbc7eaefa273772672f552d3583c82935d466fe7cde3c138c8596ea6bdddf91
SSDEEP 12288:dmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BF964C41CAE62644B5C3E5F14DAC173E5BE9200483BA5B7CBEF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 879bc21387548c9e59e3555b5bd71576ead98861b4b51f8838fd112de4ca89f8
MD5 5fd9e8fd10af95294243f877a705ef78
SHA1 7a4d4c8764144ac09ce88e0aa30355d4be26b15d
SHA512 d64431d71ab5116d9c11d7c8ac8b498e09c4cf6e5a30bedb80f9aba14f56f5173e1a31815aee528c919dd75948161d1edc8c3b78e1109f9ad4ace89f0a06b8ab
SSDEEP 12288:TyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1af9d93233d2bedd47ab2c4214c07363c214d945fb5621b337976f9229aa0230
MD5 76daab51a4eae90ce50436acde7f3db4
SHA1 ea0fe84f49920b28bd067b95e2fb8caa4bbc096c
SHA512 8511e95910c172f350e59416d5ada5e33a0ca96ff8f6ab6bb2bf20c6ec32ffc2e7b0ea46bf8acb1cae60304955e04bb3737a72fc73c35108a922b78490207f45
SSDEEP 12288:nSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0f87866683f00aa5355e9a25e45337fdaf1ecc19bff92f944fad389de114537a
MD5 6b2579c988feb962be1101de723da05e
SHA1 4fe858b9e9659f92f35a9c79842c8849bd6745cc
SHA512 9dfc77f5265f98464d6e35aca33f9edb1c95da58608b33db1464be1153eb96a4f6e76432612aafa09be8b7f0d01fe0a453a10ab4b55f8d8de047ff4f8ad98677
SSDEEP 12288:uSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 96cedc77b006d76fc43901601b4b12e2c8b8fbf2a0122366f4926fcee08ebec6
MD5 c707d1e267b889f249102ce4723694ab
SHA1 1e72e16013360f584a0991fa857f724369bdb506
SHA512 2b1dbbe930cb87e7e9f709e3afb0582b160ab9618b11b75ac5873095525c22e5246cb9feb4a2e7c5c58ab532897c24cf92b289daf6941d51b1821d36e30ab63e
SSDEEP 12288:AyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB55025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 824df7cf4cb2b4347f64a210840de7cdf33d89b59610bd271ced640c757de111
MD5 62d142653d66756fbd14c1f276a88ac3
SHA1 26def9d74c838b2e528f5312ad327a1c7210e381
SHA512 b663f08c37df450a3859d417f037a71c05e2efc4f14045997f19028d66d6ddd2a4654a413cc6fdc772474e17109d3f452cb5805120f3a47e6d0b147e819ee0e3
SSDEEP 24576:ITDaLl3z0zDpsqjnhMgeiCl7G0nehbGZpbD:ITuLljMDmg27RnWGj
TLSH
T1096501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 48c3620b2e1e6d8aeab64ee462d66b6c6c8eacefe591673cfbf03970e6ec09dc
MD5 1220cfbfc4f2f77c7042f9d7f3e55d6f
SHA1 d032dbc93990a72fb438e6aa266ddddf2e93cc73
SHA512 14e5e3f28d3cddbb90f264b60ce8636110c73a52ad18d29b5449a28c6cdc38988aefaf05339889b08b3c028ba6d973c138a0953329b471a27698621971603a11
SSDEEP 24576:U3vd9CHKy7GZlsqjnhMgeiCl7G0nehbGZpbD:evd9CHKya7Dmg27RnWGj
TLSH
T1AA75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7807afc7e8e3466d5ce0a9fc5f9283e9cc098dfc59f219aee215f92cad947bd5
MD5 15297165173209e8433174541af0b816
SHA1 debc6a442016c0c624836559eac7ddc8311a7ad3
SHA512 860ec3e076318862c3d7c51972539aa4c7fee5da0b818048f6b6dffa869381571e9f33ce4460198e7075976520cacd70e9316d584ef250cfe43d8d8c0af2d2c0
SSDEEP 12288:h5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA5B7CBDF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 942692397c2a888599e5d1ad3767b01f0b92557f5380d409a080580644875b48
MD5 0333b488c1b68359ca3aff8a8806cef4
SHA1 68443e9513efb2b0ca5d636a99ece1d910815db9
SHA512 8946024425cfe155492dc0033ad6e6a5d608fb7dad9831bf43929e75c03f91c3e42af9e8f71abc9ab79e6b8412d3f619de2bf9daf12fb04e1cb0f240eaa383d7
SSDEEP 12288:fvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BE965C41CBE52644F5C3E9E10DAC073E5BE9200493BA977CBAE7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b6ef2f2c65b7a75a87a2b8acb928c821047c914af387d83d630a9dbce329fe24
MD5 10a5fdf69bd687d9486e7b787aaeb087
SHA1 b6cfefc5c2d561395aea6553aeb725e18225a9ed
SHA512 3402423d2ac5641c3d4087bafb919a6d77e9ec8453295d3f17240777cc7aace03a9256c98abc50426b5f98dedf1011062cfcd3a10894473773fc69f1d9737642
SSDEEP 12288:sYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BF964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b070fea697556e59675211f81edaf9b7ef46b4d99189f0211eaefb6ababbb18c
MD5 9beb528282f7c304a9baef4eba892005
SHA1 b0f9d23dbd42bd5547471da3a2a37a841ac1d36b
SHA512 57db9b51d8783404f82f77a87fc39c881c2ccc29534ebf2a35733e6a9c883dcb77e4077a1183d5efcba38db77a231b3b8c0f973de19ffcd96b361c83ca12edb3
SSDEEP 12288:gSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e2592764d5aece52e68022edc72c9ed21afc30e0e22c726ed720f890e29c320c
MD5 8a994b2cc34f074a3328a52b890ee04b
SHA1 1fc46c4c04ae9d82fe2dc50b4c7ea32d7102101b
SHA512 40a4b2db9441b0e771f9d949d3316d9d656ddff161675b5a370678f573eb5720061b1631ff172b9a83523cf71092043583ab420f7c1a8cac7a4e6d5071ab341c
SSDEEP 12288:j5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 459fa882c0897d044ca1a8bf32186e1b302cdfefa9616561ef010218b2fa3038
MD5 cef8ae62abcf41acfceb34329a0cb7f3
SHA1 75a4956821e65e1ec4e2fad1ccb463bab60dffe6
SHA512 112dcbacde1f4f65021e999e12d08dba88b645dbb9f8cbbc1d09152acc1f432b9e44b42aa782ae273dac03a1b9d24fe6452463559d01526fcf79b449008eb76d
SSDEEP 12288:MaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE964C41CAE52644F5C3E5E11DAC073E5BE9200493BA9B7CBDF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3ee9a8b382f0c9864dde3bd3eff2c6f25cd35d57da1f991d7b436d2c730853d2
MD5 62ea83ff2b51a659df6b536807efa0e7
SHA1 cfe26b744351ab2c93e8b14bffa0b81dbaacece3
SHA512 56a9a0f11fe955d6e13a50d4dad4c79f1fd6f4acc06018d4b9b57e43b1b4382f004566d6b23396b7a690d5e82fdc941a78cee242baa209e325e43d6bb464757f
SSDEEP 12288:LcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BE954C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 cfa286eb8f1576d2c28f7646089c83470deba62688874fa2b21771ba1209ca3a
MD5 184f3988302f1f0f3d078c0b22d66e39
SHA1 c3042e97c322bb29faf8ad7933fdc9052ed6147a
SHA512 b3e3cce857758dad19917a28a606410f5e58a7f34517e41531a6b9b8955b5778c0696ac89413b6a6020f6da0283a6455868312fd3b85f2a68220297178a6f578
SSDEEP 12288:IxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1704523BE964C41CAE62648F5C3E5E11DAC073E5BE9200493BA5B7CBEE7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 31ca427d72b17c1b8f10eba838de17dbfc46a77eec1bf6341bb49a1422afbab3
MD5 bf21340ea9a44f7251310197dda71899
SHA1 6598e0668841641301aef169d9831969611b1bb7
SHA512 ccd513eeb3f001c7aa2ea8cdd61f9da453112389d7329e4ef57596d2424c8ba639d9e248306e3e6564590df169e84d1b525639474266b0124f8dcae9cc676e7a
SSDEEP 24576:/fwvUk9RX6wkyAIWsqjnhMgeiCl7G0nehbGZpbD:tMnYIaDmg27RnWGj
TLSH
T1BF85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e45fcd951a151d13ca4ee91ca595bcefc87cbbee4c48bd29694c5461d8459170
MD5 756b6989d1c62a8966d2f678a82e3c02
SHA1 f466fca0520f5426fa72043a7d835b790804b23b
SHA512 a38cff5c19d2fc1011e81a368c56d47152003be4508fd299711fbf1f4cbe1b7bdeadbb53fbba244d23ff2651744f4f8eb9e402342a6605cec73f9c77eae25208
SSDEEP 49152:iYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0RDmg27RnWGj:5ySzPZD527BWG
TLSH
T1D3066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aafe4ad2d4d2b23d97411f902aeea6f70966f804ecf22f9d701414436c3e9e45
MD5 eca1b5ebeb4a979f80e138322e85f2e4
SHA1 bdbb8585fbb54b178bb27bf347cb0a31ec045ee3
SHA512 34b05debaffe2da541cedfda7b666bab796da0974a2c71ec9044b931ede2beccfb9312a5f58cf2ea1ea287dcdb4114c71bd7b690f958c6742b905bebf96ef3e7
SSDEEP 24576:v47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrsqjnhMgeiCl7G0nehbGZpbD:v47JUQjTirIhCnDHUPfF/BDmg27RnWGj
TLSH
T1F665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4e8f714daf3d8c59e717ff317994e614f03c56877a94687638451d1269be0aa3
MD5 0d0f7f30f502d97ec3ffaa3158652744
SHA1 a7df4ac8e48b810fba3ae7b9d54ff3327248624b
SHA512 39c0af6e3ee7f7a214aeafa929dbcf7f3149c3167daeabec8e28a77574ec7626ad5e8aa205bc456207ac20bf44af98af90a948a05a1387ae80bc2fbefde75392
SSDEEP 12288:MbsfiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE55011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 b9c6b8713d435a0062a0e4bd0d22c6d4eaef89e1e0efea158f3ec0fcf3bd924a
MD5 e67430dbb52992d03eeefcdcc44af399
SHA1 a81bad493458afe58907a7120d73bf53c2fd3b35
SHA512 f61ee1b69ca0376f8dc6e154baeed07b8c5f7e98e6a51914ad3a6cfd79524181e532366efcbb143843f6ea6138932edcc09646041429b5fd9f959a6ee5f67e45
SSDEEP 24576:xJsaUPy7w/yTJkAPPBljHQMyFVp92g4Gw:gaUqUK9kAP5tHQM8VT14v
TLSH
T139552741762BC79FC6A950321E32D6CCA7707D01FE446F17B3C8873E9476668B6A6382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 208c92cf781c055bc4fc9f2258f8a7d1ea7f11b579e743ce3c966c901c1f671c
MD5 b6337bd52dfe4348ae61c4faf0238998
SHA1 e41da6c4e4932a21e48e90b8ce823633a4698eba
SHA512 4c3de5173e26cb16fc6d99e7e5db27863c8c95543dee1eb6c33bd540bb3230da5fedb3a0c23bfa59cd079e803bda73142e73449a2d3d6758ca9e41f425fc3f2a
SSDEEP 12288:1fxBheYIgXt/U+oJX7IXN6LIAkHCMtDHUmFeqbwxwBmwZejHA:1f/AjoZpCIAkHnD0se7a7sU
TLSH
T11C653B41A5A7E35FC9FE9037423286CDAB756C02BB463F0273444A38986757EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 05584fb5d9358143be84c878c98cf93246e6d76cd12466325ded11d39269f16e
MD5 79ae0f8f2567e8dcb39e3a61d84a879b
SHA1 f15508a48d9eba416c1ac61a975be078cd4e2d0e
SHA512 94cb58621a51a6b59fad032ec548574f39b8fb8426f35a630ad7d9e33ba550268cd55b2fe63a3ab1607a43ec88d3a5b3e5049c6a8261988d1177892cdf238458
SSDEEP 12288:S07qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18645237B934C518AF93609B482E9E12D680B7E6A9F1044C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8cc9e5ae089a8111306880d9bc274a20f70bf853c5a584978d18f48adf2db671
MD5 be091efc3949ee9881da717dc684cb02
SHA1 1d7d5ef8886e44c1e4ba2b42f506b598f54ba55b
SHA512 6f5432134b37b05c165a6f074a754aaef8c104068d27a6f1ca889b4c0be47e56efc373f31410dfd6419d6467846a4b4efaf703d53a63009100ac0c214811d147
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYQsqjnhMgeiCl7G0nehbGZpbD:hgb4mBIBhGFfDmg27RnWGj
TLSH
T122659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 880d1f01194299773e82d8d823a90114e8fb4314979697e871b8ea0d495aa31e
MD5 d66764223b203a7e023bc6ac184065f9
SHA1 9f970094f9c108a7221b08d0245cb733a8c829ae
SHA512 e81d505cec54273d5b325baf248e0ff041f7b0e6e5dd48f45cf4942fee2ba6fcd85aa6eead85040cf5c2a356a81e2e9374fcb710f7c5d98d8a35bd52929cfc50
SSDEEP 24576:9G88u8FpJqH1bzria7/m7sqjnhMgeiCl7G0nehbGZpbD:Q7ZFPqVea7/kDmg27RnWGj
TLSH
T15D85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9b07a8c24eee2955127e0135826aab7989f4766c63bf3ca12a8e073d2a0898a8
MD5 760ec01b66e2078e5b8a3deb578b6d28
SHA1 77a0ca22802088821de69f2a51b0d5c8ab57ad14
SHA512 ab10cc90ed89e7c1770b9ac26992837d97c36cfa53b0390dfb70d276af5805c980cc66195fa41e305c70a7bf727befc4e3f1302091f9c7f2f4eda550a51a7fc1
SSDEEP 12288:zHvUrBFrEjwaQnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:zPUr+NQnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14065F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8bf5e562f417b888e75d0695426a6e68fe7009c76f899e18c1f094e07157589c
MD5 6dbc8992af7bcf180ad6d28a65f876ad
SHA1 f50c27306c48e85b40702d605ff39c15064ed808
SHA512 6d12768c4b0d1def31a09da8d02a6e77e121e03443a24842ddc765d3a080cc055a2aa93e249b3af92acb414372ea97f834fef11e0906d5136a1016db7f0339a7
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLDmg27RnWGj:sG05lO43bSD527BWG
TLSH
T1BAD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a4d42368af6f6776e25ff797c86976e785738a9d54f4b12d4a1e1496113d0c36
MD5 cf8452f9cb28108a903b67554f2ebfe1
SHA1 21224b66d27170a23a486d5ced757dc7783295b4
SHA512 bd65675500606ab0afcc297f27479e2d3610efc30aea81054e23ee5ba343bbd394acc7aea9e9a5270c32314a873b0da4f852e719db17414661821f05fc78c91c
SSDEEP 24576:0fa5POZ3dpuWVM50JicR2hG0lasx2+47eidntsqjnhMgeiCl7G0nehbGZpbD:sa5POZ3BJt2pasx2+mTDmg27RnWGj
TLSH
T11B65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7b47b2922ebb084f7b4cacd456c2ae5a790edf730aa976f1fe5cfb6754d4cfd8
MD5 7e3b507a316be0255c788a9a0223708b
SHA1 934e62c57d54cf8ef993d1a05cfb3d4088e39c8c
SHA512 2b1349f9f989e1f536ffd6120ebc41b33c8ac7e47baf255cb7c9d1e180daddc94d446868477091b563d5e7a8293c9493371d34d315d9777c3be708957e8dcd20
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkTsqjnhMgeiCl7G0nehbGZpbD:8Nc/zEOVHFEDmg27RnWGj
TLSH
T164857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f0408ab80f7cf568b9c5720e5a2bac1c08c2cbf46cc560b9c5dfc9cf9423222d
MD5 e22a281a8b29a4af13da2c69cd7dd70b
SHA1 a3d4f56acceb98bbd57b74c9f0ca07cd2f06e8a4
SHA512 a16dce2c36d78da08cb6d1eebdc3979645c0f7d07b37457c08c552a2c6690c16d247ea527885aef32bfb8cf8cdf4372b367b593820261e4129cefe4d6fd673da
SSDEEP 24576:4TkNvNnaFeYhJNtmZBmxsqjnhMgeiCl7G0nehbGZpbD:4TMwBtOmFDmg27RnWGj
TLSH
T1E155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0f04c9f52160b734d6ddf590f545f73e4d8c2cd6b009c5b232cdff8ca85cacba
MD5 72a6dd8eb4676262ea6b60b8e2435d07
SHA1 0868def1c3b10d4936f1100b2fa581c1b3184d93
SHA512 3efce4552f50e7166c89c7f4939e1e91b63b9fdbb432214661d1e6c7ac3137dce5553ab17f1ee771dd71d600990b8671ef54d82ee50d92d7a1c67f0e15a165d1
SSDEEP 24576:MD3FHshBIYQgAusqjnhMgeiCl7G0nehbGZpbD:MDVHeBIAACDmg27RnWGj
TLSH
T18E75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1796-306-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1796-108-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1796-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1796-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2188-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2188-369-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2188-367-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2188-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2188-82-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2188-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2416-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2416-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2416-126-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2416-120-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2416-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2632-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2632-303-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2872-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2872-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2872-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2872-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2872-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2940-288-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2940-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2940-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2940-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3372-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3372-310-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/3372-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3372-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3372-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3424-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3424-15-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3424-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3424-23-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3452-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3452-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3452-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3452-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3452-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5960-0-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5960-80-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5960-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5960-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5960-317-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5960-312-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5960-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5984-100-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5984-308-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5984-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5984-94-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5984-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5984-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6140-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/6140-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/6140-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6140-271-0x0000000140000000-0x000000014020E000-memory.dmp

Download