5f4af4e2d38a4be9f10f93fe0b71a86a48a863a98a18e5adc78e0d0e30c221be

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 1.2MB
Sample260826-b7a4hs1emf
SHA256 5f4af4e2d38a4be9f10f93fe0b71a86a48a863a98a18e5adc78e0d0e30c221be
MD5 f606db437128d8695e917ce37656cc41
SHA1 7b03c7d9544c8c46ab90f0e4780e1ae7ad4c6e59
SHA512 ada9433093f024b9bd2af999fcbe2da35576dc678d5efe1bb48e990b1f20fb574157deda25b51187e9c1d261d3dc5599978aaa976306404c3012d41039abf312
SSDEEP 24576:jmAXIpeFFZS83/H2hj4ko6Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qBIFyhEd6QLNiXicJFFRGNzj3
TLSH
T14845DF216AE5C436F5B353305E7EDAAA142CBE640F3984EB77C4591E29706C25B32B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3972	elevation_service.exe
5456	elevation_service.exe
2776	maintenanceservice.exe
2128	OSE.EXE
1568	PerceptionSimulationService.exe
1036	perfhost.exe
3732	ReFsDedupSvc.exe
4836	SensorDataService.exe
4912	ssh-agent.exe
5684	AgentService.exe
5492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c2cc0e0923e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003580fccafc34dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c2776cafc34dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1132	2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeAssignPrimaryTokenPrivilege	5684	AgentService.exe
Token: SeBackupPrivilege	3732	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3732	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3732	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3732	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3732	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3732	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3732	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3732	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3732	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3732	ReFsDedupSvc.exe
Token: 33	5492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5492	SearchIndexer.exe
Token: SeDebugPrivilege	3972	elevation_service.exe
Token: SeDebugPrivilege	5456	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 5772	5492	SearchIndexer.exe	100
PID 5492 wrote to memory of 4848	5492	SearchIndexer.exe	101
PID 5492 wrote to memory of 6012	5492	SearchIndexer.exe	102
PID 5492 wrote to memory of 1372	5492	SearchIndexer.exe	103
PID 5492 wrote to memory of 5884	5492	SearchIndexer.exe	105
PID 5492 wrote to memory of 5008	5492	SearchIndexer.exe	106
PID 5492 wrote to memory of 4040	5492	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f606db437128d8695e917ce37656cc41_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c801177b1ed003f56ca56afdc0b044fd15c99cd719abd753bc75c15fc5c1e97d
MD5 7f7e1a836f717887d4dac1dfa4895dab
SHA1 212d59cdc2f0afba0841e22c2a2dfbd3b3766abd
SHA512 79f92dd47646fb94a91bcaf118b2ce41d2f19a50e028efe53977d7472897f24d68f33c5458c2739c1636321b3fece24928ecea846d97b71f97ad22f45c9d80be
SSDEEP 49152:tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnwLNiXicJFFRGNzj3:z3q6mjBv7wRGpj3
TLSH
T1B6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5c76afd9d66adcb0f3fd075c87661d7c04942539980616a4ac015209681e63d5
MD5 8add190f45d16a3272401588ff209b05
SHA1 1ff118d08175232e3b3931c9108b9efb5d20fe18
SHA512 eb307d0b897d846cde6ee4e7401aa532db16e8f8847020258b7befe06e39a1b7528150e58978057cba39eda7bef141de0dbe3f365740c1afdd5efa36cfbb0450
SSDEEP 24576:WXYfDtczAD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VtceLNiXicJFFRGNzj3
TLSH
T12075012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0d0d428ebf7d9d680f0914cca5f2dfce4b9a1f69c7566030d4c04d684deb7d7c
MD5 b00f59a50f1061e57f2a6bfeda7f5af1
SHA1 e36f469d43b25f1af6b2a57beb88b741cc245118
SHA512 89c8ea8b7c49233540cd5037c60cf1f4bb14536a109d8825302c0be63fd9e30b6e2f5a7aa89f1c19c826f97e00c01f8cf918c68ec567da332b7893e4660faa39
SSDEEP 24576:L0Le5ji0hmxhrMo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LPji0AzFLNiXicJFFRGNzj3
TLSH
T14185AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b920ff28152af259c57d4ce0f46aeee732ce0fd577109a544a57cc51f6ceb238
MD5 31e9d6cd4002d3633930fb2cf0d6aa28
SHA1 19f79e7aa3be979fa76c93039d26a8c64368f7ed
SHA512 aee24de370923f3fec745c9d8886f56ad800732382bc3b4371c5103cb7b70eef0a76bbee4dd6c6aeefa3341520a52eba80a41f93d905f35d095095afc80950e4
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWj6q8wyuu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T/ezSC6vUzPv+HjyZLNiXicJFFRGNzj3
TLSH
T1D7756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 64f270898ec72a3430615c292d05d41f01e47c8f0bfb8508a9189a150b9957b5
MD5 2928ebf3c31b04fd49438f5c46054f78
SHA1 b0d67a8d4e3a4bf86d9d72f13990bb811042ba55
SHA512 63bc99f8e75f95a7a3b803f7e9a83fa4138815cc27ac46aca041a99c7e2a16175155ac22bc8a1e58cf6f09fa9911c36c69930dd2d5708e4739d7f0780c47eb38
SSDEEP 24576:VVbqPb88hv/l+B//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VVO88hXl+lLNiXicJFFRGNzj3
TLSH
T1C7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7974b64030b1681401b7e508f7f6d7f4e1526d8ca9fa0d561ca4a7d7f105c7ea
MD5 e958d8c6f86d33dc26a1418ac003ae6a
SHA1 5a947e339b174e6a962fb2f8a499a04f9688ad0f
SHA512 36886c332ada1c31f7233d4700babac75b3eb902b14113e0a28b3aee56521ccca8f69588566f895e07d72930ad1b625e6d24c2cfecc614b621b7079a035950a4
SSDEEP 24576:6GU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GLNiXicJFFRGNzj3
TLSH
T1DF5523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 aa48698ef03e2af5d0fe5bbbde2fa7d2843017d967828b32578685f707c62e4d
MD5 849241e5f6135b92c7e604c4bf53b7d6
SHA1 2e5e51a5041277a57d6a1a2f73b94c223bd56d1d
SHA512 7b231b0b0b6bc8a745833a0d9c3656634f4762625b006d0867fe230f62fc0453fbb7d389e6c17d466d744a0d95506952024a59b85a61af8e52d8b3825cb503f7
SSDEEP 24576:nJIUX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nJIUXLNiXicJFFRGNzj3
TLSH
T10C75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 73d71d4d4823b36486c6e159669bbe72ed9e95a77e146f0b2a8a8ce92536fa5b
MD5 2360c292ed6d6ffb9d63c34e082cd37e
SHA1 54bb8f31f0547f46b973fbb2a58a8868a62efb35
SHA512 210e37445a8b2e33fe423275872d76d49a51bae5f4846df74c56b20935054e98d23869675368b2005765e9b26d9b7e395d339ba6241909183470e521abdf6a90
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THD:bQvGAdlCEL8c/WRNw5C+7wRGpj3
TLSH
T164266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 40f801db0ada30df813b99c34e5e3364e81cc2fcd175b91d8e0e610e1df9acef
MD5 1091f81036020c2108e2950890fea9a0
SHA1 d1d8ecdf82de1ac37e066199578a9166a05535eb
SHA512 650976e4202e4acb87236d36b337f461fc7d74f8fdbe997c994cd2d7af0a92db1aefb5baa1997b54ba4701ca36fd5146abe1f0ea768e75913b2f6623e81dff9e
SSDEEP 24576:cfewsAjV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+ljVLNiXicJFFRGNzj3
TLSH
T12175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4f46f13ab719e70abbb0ab27c156386ab233933c015963d2d83eb443c62fbc0b
MD5 c96b1500d4412108160e9686612ea502
SHA1 18b454838779315d8dd4e8d97af9d8d3d0925fe2
SHA512 87d222990f1d8a8876f5bf4cb59785f50ebfdcc6e21335023b51fffa72c839e8a4d8c99f7c15647d86c2820a89f75a5285c95976b5d511cc9a52d56710500249
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHBF9:yUEtQevvqc2W1cpV20I32X9
TLSH
T14B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0fd2c8911af5e079cafd78801b22b0f6b21bb3ef348f1f94a323e79edcf46f0b
MD5 219c7bfe5bdeeddde4807f8487277171
SHA1 8f2d369886326f7ea9cd4cd0752fe745cf8a8ce2
SHA512 6f0c4702400cc649104582ac8ca959342d00be6d4bf152abf453848a91845fc330d3ddcfa63e87dd9f3cac8e7f8b7d27cca9d97661da4b0e3a03ce27f3872fb1
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/z1LNiXicJFFRGNzj3:/oq2Vjnmy7wRGpj3
TLSH
T156D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 43d738f9d1d5f2c123bd6356c75ca15b8906ba4b0e5959f6ee923c46836de03b
MD5 eb0853ece1a40454fff0173c5afad3f8
SHA1 d32c16e6b117de5d339a1242729cf4c3bb17d862
SHA512 4449183f054102016fe4a8e6ba023a738aca8a09d7144de3a8b9b5878c5223def1e7511c7ce8ce46d47592d4f58732720a7a9f4469ca371e741a7ebc5a7516e1
SSDEEP 24576:jAhGL6IFoiwtA5l7S53S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jAM5Foiq5CLNiXicJFFRGNzj3
TLSH
T110359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 023fe271aa3e7f94a12a009ac3dfc7463ddaf55ae7a5686603280d9133882e59
MD5 f1aa63588f3bdbee8d373f55df39964f
SHA1 08b9a183c693870dd348b3af33e9c24b9f0ad61b
SHA512 19f604be84089caf1ad222cf45ee28ae357bb4e6d2843b85876f53de6e8cb401b43bf3dd45623fea2722c80c4ea44bb8be42f84fa8c2449f86a01ef9837c7826
SSDEEP 24576:UwuROW5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UwSOmLNiXicJFFRGNzj3
TLSH
T13F65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bba7e0835876b1ed60c0ed7826fabafbc1877bdf3d9b3356d5154b869e049cfe
MD5 17f11e9a5996a78ab37fa8a437d770a9
SHA1 f54ef1719ca549546a443cd228d3324e205d125d
SHA512 5f9b5dfb85da8f7da33076ff8d7f585d60f79013d0a720b33fafb6c9e4de9bf76e3e43a57e2bff43c95844ad2a527399f631ef8d728bb509c4cf05717adc8026
SSDEEP 24576:WZuA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kLNiXicJFFRGNzj3
TLSH
T13755129622D820F5E6FB003DC9B54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 76a71e5bfa25a809484803ac222a4001bbdf6fe626043b243e71381edc43443b
MD5 749325a564040c43f7a66aaacfb7c20d
SHA1 87806763649af8341c13c735c8756ceabd680451
SHA512 5a980afd9faae62127870e303f78fa6574f6a88d7fdaab4eabaa1e5c44ca2e9b3e3569bf9d9d4b7b866ed63e338dfb183ea58e301cdf05112e7269a0dfa44b22
SSDEEP 98304:PQRQyi36YOcPDLvw2gAf+PN3b7wRGpj3:+QyiKanX+PNvF9
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 00d06e6e68ae15d83f2233748e3ce777d00c451dcd7cb45e6704e114155e1be0
MD5 4ae426339f257711c65e3902d8e63c35
SHA1 3a74c9808cb1c0e03a5c311d3520b48b7e4bd3fe
SHA512 15ac174d37ce6d746b5415e0682e8f7b45499fea8ea0a192c2dd04449865ea133da13bcba6743457578a1552c694d44cfd717c33124357e7859c84b79f5601a2
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3b7wRGpj3:GQyiKanX+PNvF9
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9f9b4343f5e67e0129ae7928b0a13656827a80b688c75b0f56987e5f9f3c1808
MD5 73ce66e5ce71d64135f302845e89e108
SHA1 eeb4c67e4ada0e63181e2a0fea264410379c61a0
SHA512 8a34c7a7da6563724c4358c2f423c40ab1e954d95f9f58f370c4b4804f4a3867c55825e576b4ed746939bfdc9ef6d0f8e9edd3a46b6f5ff69aa21745faa3897c
SSDEEP 49152:568Qg55nhkeWu7PNU3/FLNiXicJFFRGNzj3:HthTRc/F7wRGpj3
TLSH
T1FDB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bba10034f186949656ccb2cdc5a7ac6d166aacca4bb6b70b36d86310a1e1fefb
MD5 8f35903b56d0e121a775eb9550f996a8
SHA1 d2de724d205f85422f2d064ebcd8e00432df20e3
SHA512 ad3659efe5d0f916e4ad7e09c4dc930c0c85d25910d6afbc5cd91b5d85fbf8d4243a681e1c6c940f8b4d4af408da1b779815259cae6ee0c17356d7fcbf8ecff9
SSDEEP 98304:jy5112gYy5azzVvU69nLKnhZU7wRGpj3:+LIHRWhOF9
TLSH
T1D7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 36c159ea11fc8a724de763d96d71e9e1c7669acbc4ab28396c747719fe9bbfc5
MD5 d959fa8799ef39c0678b462817dad608
SHA1 d5e63be2c46c116271348fa2e82b5d60a6aee410
SHA512 5d01d7e0b24107b0f30656b2444b53de6f5d1296b7cb5712585b772c6f462e337ef922730673430dda87dce4a8d8d92ebf127be25d71f0a7af4c7610b25aaf0b
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glzLNiXicJFFRGNzj3:Ju6JmIxd2dz7wRGpj3
TLSH
T172D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cdc37af72288a60c325b9680a116fdea04cd719f943c5ce7e511d057a2fe5251
MD5 0b64195a0234a0b9d8ad2e547874ed8b
SHA1 a3d4c74c78191ad6ece5255593c1beef7af67b88
SHA512 46f7bb768a6f78047c8aab53efe92e3c39031df4b8500517534ec157a52bb8ee959037b11ca231fe0607d47a22fa6d5c4cb8c0ea394709b8542c688c9ef62c8f
SSDEEP 49152:e1hpsNoJpF1A67U44CwH7R4x3LNiXicJFFRGNzj3:emifPqRy7wRGpj3
TLSH
T1E3B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 75474ab25846e1baf2c028ef08ad28b307c6b2f587de9c6b47c94286b44036b4
MD5 35c1de5786386657634160545c41c04f
SHA1 df3b0507c7671bf6995edc243a137d3544073ac6
SHA512 6861e892f3b8998df9c4fcb042eaebc14c006cacc780590b1db0c381286286eebc5c7f2681a39c46712258222ea2fd36a07b9f7a802ab093b7ba4c245bb42a50
SSDEEP 49152:YSuZQIY0Be2KkRVtOnks6NMHqALNiXicJFFRGNzj3:C5dKqi61A7wRGpj3
TLSH
T1D2C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ff061e084192e9502f446651a05fcabe6d5f207f0636cd5cb7e09ecf04c40eb3
MD5 f6c5fc5acdd8b122757d81283b396f1f
SHA1 5f882162030e475865a44d349c8da304fe11e6eb
SHA512 97344f9aae9ba4694da4ea153b9d826fa857d34e79dfcbd3d38c9a17150ade88c06850a7ce60ce5194396fc9a3828bd7bb36f812fa90eeec45c63226565a9af7
SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5wDLNiXicJFFRGNzj3:GX2iWphG7wRGpj3
TLSH
T13795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fd97a7238530e8b765b241e17f336660caaa0fc8fedeb2df81d765cf3b4f6c31
MD5 9bf8a943a127d3613ca33eb63f56023d
SHA1 3e14180b59a1a274f0a15cf3bccdf009db779a32
SHA512 7d7fa7622698ec889f8ae0cf66956231011a238f21835b48506e93baf2fab63b915ec34c3319b2387d17b47a33c98c01f2c56432c82b67431c3f9b76cb57ef04
SSDEEP 12288:YKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3558955B2FAFC0039C6764428F5882E2DDB5618E3E3443D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c60169a0df6aab3ef5d67e4af979d8cb5b7ac49fa457e4750eac466f4149714e
MD5 ea66881252766f22027b7211c92b1fac
SHA1 80af7d9ad27e2f25cbe0afa862dab118ba3d74a0
SHA512 51add821bf7ab55e0d26b5a1644e8159198348556a9b54ba2aba1e4be1aa7657f9a9238617fa513fbf3c209b4d062c8967f5c9ed2217b4de79cde2790fcec950
SSDEEP 12288:rdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3558955B2E6FC003986764428F5882E2DDB5618E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 494101f3f6d18dc8b8648072426b9e97e369d1c3cea3f9702c60f94c8cb77119
MD5 5a12fd2c067c7ff15f8fa4b7f51874d8
SHA1 85c2176f9c0aaba8d092a8f118fa4090641e3040
SHA512 7711327f0727be928cdc35797c3cfca256440e86a5e70c7976eace6b279d0684f3952b1f1a34f7686626c9fda936951f72081fc0ea58e83fd3105c192ff25df3
SSDEEP 12288:q7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D3558955B2E6FC003AC6364428F5881E2DDB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 414e823df9b4e1090f5482d894f9f7c23e8a6539675ceccbafdd6c720664e076
MD5 48034d484a3a9cc537cef838fdbd29b1
SHA1 2b5616720729053ab925a3e6a4667e263537df5c
SHA512 50879f3b5b0bb94529a7320504d1455af566fdc1e32a03d44afbb2b28d8893e9f51bdab3477be52d39accc86db6a268000dbf3be740165ef1e3c29f935152e7b
SSDEEP 12288:CVgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T102552393168900F1E9FD8039C6764424F2A47D6DD7325AEBD3003D0E5A74BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ef8d67e44f802515d7f7699073464843e62e4600227484fcae0717e2ccbce94c
MD5 4a08bfd202e883521e7d7f8a4ff00a94
SHA1 ca72686187b58dd0c664a9159ebf6759c88af7c6
SHA512 d685f4a767f49cc00078cac231a9c0b3c24d8d5deb4bfe53cf73f07a4b41eba2ff16fe1874c67e41998ebbdfb664d59891313ffb6d2a64bf8928de0452446217
SSDEEP 12288:UIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3558955B2FAFC0039C6764428F5881E2DDB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 94d9d57945463541ea792cca15f208b5daaa2540f5f29124ee19d40ba445627d
MD5 6286b056221e6bf339463ba08f5d6a65
SHA1 90bbfe04d753d533432ff188291fda44ba8b8fe4
SHA512 0098e147b5b85c1319a7bc7bef5920a8d523c738080be01d296e55ae94de41ee1e353a5094209f5295dae4674a55a648ab20b75994a05594b2a4848c31b736a1
SSDEEP 12288:/hiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB5523D3558955B2EAFC003986764428F5882E2DDB5618E3E3443D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6dbd6225c0d5a2cb451fd8031bf70494e90e5f9181c55ecd4557510b872e1810
MD5 b0154a9d928fe21ae5daaa800c240f90
SHA1 36640952304997c19b04618964b8be9778e3ff40
SHA512 4e32740b1e6ea66041e4d7b52ef49c1e5c93fe7db36b5820cfe0834e20ae860ac50362d5a698cc420bf7e676e1a73778df0790b6d4fddc7ec52ff5f284e7f5c5
SSDEEP 12288:iliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ip/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1365523D3558955B2EAFC0039C6354428F5882E2DDB5618E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ddc4360df7026d641c2e07491c1c198623815eff1874834b7ed2019e25775d61
MD5 425d9d5adf211249612159715afb0842
SHA1 5cf87eb60159d18c4d910cc7ec87b0033e3b8716
SHA512 d4441c3f4bfa8870dea9c834c3638d97e807b5d3740ff79c79cacd07973475edd0e21d9d464c00bb6199caf3e6d67156d76a9d5155f87e9909c43d540eb966a2
SSDEEP 24576:nZM3zFVSOh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nZM3zfdLNiXicJFFRGNzj3
TLSH
T1DC750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 22029e4e81c49c0d41df58ae9f129223ecea3596b6fe73dc24391c21e0763049
MD5 bee6179099f027a090b586a491042791
SHA1 9938e5838a37718145befb4e7e3f0e184b3eef6d
SHA512 7f80d7b5f7fc6646aa2bbf34a35d7692944a8f6e9a5dff13661b3b74f73cf4dbee8933fb722441fb005eced36ee221c470f13f61bc81a2b05dfb039fb3ad2c38
SSDEEP 12288:mmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3558955B1FAFC003986764428F5881E2DEB5618E3E2483D1EE27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5c20da4f4581c52860400ff4bbbf18b73138b1a470c26696803bb182a70645ca
MD5 f7fb017b8e8b3d0d3574937665bf009c
SHA1 70904a06d1c131c4c5ae6d8b042e97719b7f39f7
SHA512 4ca777e15b4f45821159dc72949e87d0654938185fad1c7c7f51c8e7868d38ce32ebc2d65cccef2e0d50244fd08079da3e78d7657046121415cc0432dc190f70
SSDEEP 12288:EiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ek/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3558955B1EABC003986764428F5881F2DEB5619E3E3083D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9f20616d80965e4e5000a66caa30f198edac2b245e52d61ecf2ee74ae6b40603
MD5 0c8181dcf10258317186f1f133508508
SHA1 77c3a527f8dc44b0abafc97371ae29aa70d8e192
SHA512 0c9344e56c9c2dee53adfbd2615527719bc0a50f0004095dc43ba51c716df3f1130879b2f2f55dbf9bfe4987a773c6234d1b8c19b06a35649f07829e86ddb2cc
SSDEEP 24576:kzyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kGLNiXicJFFRGNzj3
TLSH
T10B650147629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 26cac24b6769726273dca4364f9cf0529bcce1cc33bfc918f8fde2ee16570735
MD5 b46458cb2899cf919628af45c8deaba9
SHA1 fe2431202683c093815ae4c7af1af4d3e46e2614
SHA512 96b9d2781d1fdc52027517f9ee2acf05de7b3f43509776cceaf078693f312b13d739884d2ea812be85a211f97384973a5453358bb69f2141c57d6daf29b9041a
SSDEEP 12288:ImiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3558955B1FAFC0039C6764428F5882E2DDB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0f4aedf756edb85f9b6771c5ec2c525da01301f0172a301aac831894e5dc4781
MD5 3199b943c7cd483d42d1242cfc171416
SHA1 3d517b8d076dc52987663dcdb20db5aa3ea3fa64
SHA512 0a94e73b641338f1b9396a4c4ef17c14f4ed54c485db075a2231c53c34c25cb6df607d49f48a4a82032aeb761e64ec39cba65ac0512084a20c94ddb95f3ea6fc
SSDEEP 12288:ymiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB5523D3558955B1FAFC003986764428F5882E2DDB5618E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d145632e8e18dfcbf1c892f8b75a4e85092ab341de1462117adf596963901bdf
MD5 5a924b85830d8d7da909732c2d0983d4
SHA1 1ce2a6647ddd4241133d8e68aec3659ab8358b36
SHA512 5067bed1bbca6d87e15410cb2616df75e53bdf03faae7681c0f0d036bdae4c05a280e675c09db73a0a58b9818aa38a57c711bc2ae8a4dba91e2411efb3ae0475
SSDEEP 24576:8zyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8GLNiXicJFFRGNzj3
TLSH
T117650147629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1ed6a8d6a39f436aad10a4f3d35305535eecd6f922ade32ad993e104f39987a7
MD5 8be88a9f2a77f7944453898b116193cb
SHA1 babb5474ac73ae2c50fc77cd102d25fc808f9b3b
SHA512 46a8921b4b01440c547a7cbbcf37a1890224636aa2a6d501dae80d505d4e276d2ec2d9d0dafbbd97d56a9bae3a3edf88d05b45819b68ff881eead8e38ca16c9b
SSDEEP 24576:QT8aLl3z0zDf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QT7LljuLNiXicJFFRGNzj3
TLSH
T1E07502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 93ae8ae715eb7daf224e4c9b5a14971172dff00e423477a4557b5bb363978ce0
MD5 e4d966df7e4bf643acbe0fe790734d12
SHA1 e69a3f72dd6b4b22ef16e51b754bc9f087555e5b
SHA512 7a22a0c941927c713aca326a0af67b0f49807d859a5c681a63148ed861934d20ee26b07ca37ee1acdf65689140b4d6a1fd899ac7c3d085bc4bcdc1ebe7b91d60
SSDEEP 24576:B3rd9CHKy7GZ7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xrd9CHKyadLNiXicJFFRGNzj3
TLSH
T17585CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 380559f877f5044c167015ab082756822735abe3f6fad34e4282ec13abb6bd75
MD5 66acf7a2d6cac337c48bd352a75aed74
SHA1 07eccf51a5b84d1cc20dd090c4205bb365f43e90
SHA512 6326f774789807c77e86dd66201bfb34e992c458499423dc0c9f53c855f6fb047304b4df05081867d133cea8000857bb69d476968b280f2cd97df5c1988aeff4
SSDEEP 12288:8biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1185523D3558955B2FAFC0039C6364428F5881E2DDB5618E3E2483D1EE278FEB9F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2295590387066314ffdbc3e99a9ada564893185d675c94671401aea45a469a76
MD5 543275b76aeead552a569049b96a68b4
SHA1 bff15f7595e21a9a75e031780fd29881aaf83c2f
SHA512 8fa7a19f7a0ffc05a65eb7b905c030bb4be561235f5784c029c6e34cdb60ddadea430defa78062c263473995b94060f72c12b2805ee9a1237397d7e56121b511
SSDEEP 12288:NZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D2558955B1FAFC003A86764428F5882E2DDB5618E3E3443D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9fdeced0ed96ea9696c0d390dbf1de5d2652e15961b6fc8ca6f673bb6b420e36
MD5 3f8c53ad113604c3ff34d861c692b1b8
SHA1 91608935f20f04903307829c042c489c520bdd07
SHA512 57db57005e92fdd7aa05aaf35cf98cd7c1a44f91fc91525c517f2da6ea05a17f1c34416ee8bb597fb9853cb3d0b51a4e6c1f71c118160eae9159edbda0cd9a91
SSDEEP 12288:rsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E85523D3558955B1EAFC0039C6364428F5882E2DDB5618E3E2483D1EE27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 529d5add5bd77d36a30e1ae068efad59fa0c7eba0c2a41973c49e3fdf60f6adc
MD5 9ad5c845d4ed0fc14142c2d541dc2983
SHA1 37f09961cfc790b8fc34f2ffa398b4cc6834fcfe
SHA512 5a4170194187e2283f0b4bca7ef834727fbc7af12294bdd649a5eaaa9626a88afdda3b82a4c9d42d7958deb446026bb1ac20dee4eb8855eca70f197ff275cf42
SSDEEP 12288:YmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D3558955B1FAFC003986764428F5882E2DDB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 86b013ddc1fea924c0c1dc1a795b47f0d94208a25d6da4b0423c7a1fe797676b
MD5 e990309429040935db7c3de9172dcd3d
SHA1 daf86af3fb707e89886df4104c7e691b3d980a17
SHA512 af49809a199ddc7458e954aad94071c6d94ece195ca96c6168f8ae5ce8fb96e677537c821b8e8b1f4f88b7ea00d07f912d24fbf3b84a703a97109f8753501066
SSDEEP 12288:vbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC5523D3558955B2E6FC003AC6764428F5881E2DDB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8704fd9a7b142fc7647d25602bad0f7d8ff663f39e0a9e7ea9effa63c7b6cffc
MD5 246f03a96eb087ab18c0e31c1214e972
SHA1 4b0e6dc01eae29baedfd48b048abca6d0c06db64
SHA512 3255ddafff10594fbd87bc19d9866f901cba32e8318ca8b075714f8f5db1b663a16e1175e1004fedfd1cdfb6b5f0112b46f7aeba8b7f45d9b36a02d8cb1e1a08
SSDEEP 12288:ouiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3558955B1EAFC003AC6764428F5882E2DDB5619E3E3443D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 01ea5d33a370f1c24db6b0b3537cbe6560fc685c2ecf1c6b7ae233d05c5e3e48
MD5 cc74cecd00268ada33436a8c6ce7d882
SHA1 9708107ad5c46348f07bf8371ec8944b9b82e251
SHA512 04d1eeb82d88bd254ccb8f13c9c58f1b51be15348284fcc6fb44b55e1850c9ece6dc6edbaf61b2477b68492a704c4d85c74f5beb63eafe0b0fd54c44b004950e
SSDEEP 12288:uIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3558955B1EAFC0039C6764428F5882E2DDB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 b0c1553395da4ad2b2f2aa6e2fb87765d7ed632dbc60196ab2923f9b656cf851
MD5 2491ff08fcaf950f7be7aff9467a278a
SHA1 2e7b3467abeef37f195cd638027743c17783bfa5
SHA512 7ed107965ed429cacb8be69d2a389dcde36a1734d3c014468e6a7923b1958de8998dcfdbc0a7dcef643304697f766b80cf5b8e72cd90515cbec2934ab1e081f1
SSDEEP 12288:/TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A95523D3558955B1EAFC003AC6764428F5882E2DDB5619E3E3043D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 a0f5c5eca5ae3a8f391dfbb3058b6ad7fde09c8420e51b50b33c7bfa5adc9b62
MD5 908eafb73042dcaae769a504229ddfcd
SHA1 317ce945f83c756e46132152f3670a3130a1b39c
SHA512 3a669a9e57e6de68830f3b96c031bc64381739d0d33baa9c8b5fdb9a6233c9495c0fb83e363ca669fa2f267885e5ea7220acea15a7afa57a1bf2fb730b821a41
SSDEEP 12288:xIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3558955B1EAFC0039C6764428F5882E2DDB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c887bcbb14e4c4b4517385340c86084b46c11b5d47bb470ba3320ed3f8c62541
MD5 144572c72d4b17941908573cd5088677
SHA1 327abd11ac61ee0232cf7e8f5e1c6eda0c7c2cbc
SHA512 ad9be63f6bae02666784a11d7b211096affd2d636e560913da1ceb716fbe8171f02146fff485f85d1bd58a868fbecedb98e96c9fcf3649650d84f9d3875800c4
SSDEEP 24576:ofwvzk9RX6wkyAI0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bMnYI0LNiXicJFFRGNzj3
TLSH
T1F085DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e79bc4f13a89566b0ef816b87445438a857601934c8c258e444fc610176f02d2
MD5 c6ee386d44c088dc0f77156638b6a791
SHA1 f7d360dd137236c0d2672f152b0fd78f7b82f9d1
SHA512 2d21c2752043456058b547fdbebf6bea7754d688afab6a6b2cffb446398e2ad2c2df6e20df3fc27fa70e31948eac22cafc8ea958e301bd2ab50ecfd1e4dbcd3c
SSDEEP 49152:aYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jLNiXicJFFRGN:FySzP77wRGpj3
TLSH
T127066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 17d5a5c79d25ebee3d726e6cba28273f76cd5e778cfd346eb348dbadc51fa4e2
MD5 80528d518daf913e6bb67f513544ec37
SHA1 6ed4fae043c1ccaacf463ae8223f6680eb334bcd
SHA512 cf5d72ccc2015700ae7075ab0db7ff277a3cb7f4a7d302a43ad7e969bf5e239ff180d4d0fc78ef67d3bd6c7e43de0df7b393ca27b39cc7af4efc880f635315a8
SSDEEP 24576:Z47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z47JUQjqirIhCnDHUPfF/zLNiXicJFFS
TLSH
T1FA65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 34a8f9bb7ae5fa7d5a349740a2161a2eca47e04d666d3ffc54017f8825ceb9d7
MD5 116b362e1709bc0e292ed5336fdd37a5
SHA1 27fc52230b4fba538ba6d72b7aae4299fd8a0956
SHA512 268046ae81bf19089e3cc2fafb538fd8be192a5cfe2450015a15a5f8cc012da7cda606894e3d0cad696eafd022427b527c6b27c2e5acf5e61877403abd3ea532
SSDEEP 12288:vpsf2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB65F15AD28802E8D1AE5139C7664900F3673C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d10d939bfd07198941b963c1b45ca095beb84fc5afbca86c189b6ee8282b132c
MD5 622b656f60d5b2fb13e8b5f90ebb3150
SHA1 847b8dfec8b29a8b3f2fcc267b5466be3c788c35
SHA512 296be164102184bd49d7f6011e363442fe584c6bd8aa02b6af14e4649261a2d346267416f9c24625ca31e3263cdc9f51f1c7244b7f743a0555194efcb72c2524
SSDEEP 12288:8DYkCU3fREjNtoZRxGzh13Ug4BJVMsqhBFfT9vu/:wYrUPUtSCbUrBJVfqxfT9W
TLSH
T1D42528517666D74FC66D40321E33D6CCABB07D01EE04AB0372C9972FD5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 675fb4f2740a1754a01e7bcfcb94f9c2693133a714fec1f3ed5aba7e8460d4a4
MD5 814ea926f1931315f8f440b9ddfdfa01
SHA1 b96a06969051c7c60fa5386d904c5b84c5577258
SHA512 a7eb70a017cef3e88691135b42fdb10555afe09e64c3f6673c3ce2a4ea0e0dd1a53644be874101cb8afcab8f709963b901b78f3f93b66976c1e07e36a3519487
SSDEEP 12288:ygElE8Km2LGsnMka49XAZ7WbFVkL7zF4T5OPb6qSCIt8+t+BayQTL+GhD24/:ygElawT49XAEhmSCIt8+tNTTLbDh
TLSH
T1AE65F9405536A3CFC0BB6072072AAB4CBBB4EC16B7095F2673C9453AD86A715B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a260a76100190b975f0bd5a57170c0ab19fac551bcbc4aae13f2e718c82e6d9f
MD5 23aa6167093937de700456ffc0ef7f1c
SHA1 a203fe1a3ed9e1b222cf6eb69d3bf474d1c3ab16
SHA512 136e210e57c9320a51452aed4c3e478a6a187f7cb0a96a78dd78ca251779a2edace5b1b9d36ff6b69e31c2da451c3c2f370245bf0bf83140851593e77dc46d31
SSDEEP 12288:FF7+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C552393468D59B1FAFD0039857A8434B54D7E2C8F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5eda4eac4af222bdd936ab0db9fe485428adb93861341aeb385c44e8944770ec
MD5 194054be40ada0bd92c9011591b3079c
SHA1 1b14c923f7a6c249ee5b648c97522307e3761747
SHA512 de1bb3197cbdfc5801388fc04b17c423af5ee699021ab9d660bc166dfab993be7640d8c4cb23f78c4f53a2a8089627ccf73a39edde59dbe3a537346f88d9845f
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fgb4mBIBhGFxLNiXicJFFRGNzj3
TLSH
T15C65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ca53f57cc70030e47219966fab62bb307d33ddeac4658b9c23c9350ec490a967
MD5 a5fdbac5a64add810cb6c9ecda342387
SHA1 1bfa9ae25769eff75081cd4cd7c218688b1a002c
SHA512 96c2d3c7c5df933db11f36d5965e44c334a9b35728428f368480088037303bd209264540766629261f8d6e0726cd77ce2120fc4b344257f2815c1f4e4fb80bd0
SSDEEP 24576:uG88u8FpJqH1vzria7/mh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l7ZFPqVya7/2LNiXicJFFRGNzj3
TLSH
T16885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b10d388dce5e99eaab818d24c25e8143d19534060f4e3df34aa09d58e832ebb4
MD5 9b3de89b162fd7a59a3ee3e7a1799245
SHA1 8b307133e8922acd3cbb34f4ceb9b1994e4ed771
SHA512 3acc6f0fb745b17028b6bbc85342ca236b59ccc59e531e2a5f376177edcbab9346e70b93b66afb98c6ef95a27eef0d5fa2f5fa3e415461e4d0b211f915376968
SSDEEP 24576:pPUr+NQd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pJQdLNiXicJFFRGNzj3
TLSH
T12B65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 986b832612cb0ad4b00003935e1983abe6ebebda1c4fddb2bfc2fab142fa4d4b
MD5 b143153494cf48a89dfb5e469cdd8ab8
SHA1 cf74a0a36a3c9e593e3eea3196ffa8c37f3192dd
SHA512 deb8bc5f42c863a8c99a020664b3430a1b3f2157fd307bc57758adf6ea24e84119d36d255345a023bf0ff8d342d6eb44c654bf309b8f7a5d8292b9bb9ce8f09c
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNLNiXicJFFRGNzj3:wG05lO43bc7wRGpj3
TLSH
T176D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4fed3182b3985f2bf43b815bd2c36ef8237bb469d1005c76f0a1344528df0308
MD5 1bb08e0dded0f432b06e21930c145190
SHA1 afeabd9381a24e075a2e2f2806f1b91bb9738ab9
SHA512 a326c38805562194b417c0d854f688baf55c98ab2470e630a1044976c5709ccdff839837d69bb897dcfbf77560891fccffe1a0257da619a77f03752b09b000b7
SSDEEP 24576:lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnj/TwSfVcYG3K/cJHlnFR+IGNe8jg:la5POZ3lJt2pasx2+mFLNiXicJFFRGNf
TLSH
T12E65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a2b653dbe2f495f455a133a556efe1f103b62c86fd8a5fa90fb4768d052933db
MD5 dc7e395eceb08d05710b3dbf9e3d3497
SHA1 acdabfa1f59ec71aa6e2da84b710374d44b72cec
SHA512 6cab7c9beea920c9d375afc05401dc43378e59d589096d57b5642e47243ba149d6915b6702b9a705e9afe205664a640829bb47057f2258c6bea3de5067285e02
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lNc/zEOVHFWLNiXicJFFRGNzj3
TLSH
T1E7858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 428c37d35be97b5ac9d744de2e1dbaf276ef9812fb94ad623d109555dd0f1787
MD5 228cbba853da2435946728d4b6fb375c
SHA1 f94690b8d44db3c46de997e481d3b586351bfe52
SHA512 8fe9c342ce9f334e6ad059b3d7e0f48459a2d41a25ca05879b40393d4ab7f47ffe5c38bdf6191ae4a6cef3961cddd542166387cc9754d5baadca655b2c9e913c
SSDEEP 24576:gzkNvNnaFeYhJNtmZBmn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gzMwBtOmnLNiXicJFFRGNzj3
TLSH
T1C155AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d513709b84f89cc5c6ed450c1c402d0054eca71951b91a7c6b71d2c322184c89
MD5 8393022d095dd8d41475b2e6a8f0c235
SHA1 7b1c696db785895b6b9b25cfd2653cbb74ee5577
SHA512 7fa4b4387542e1ae89b216d43dbe44a66670f29721561ff3db331af3ccde055a9fae3f2903d3c1764f8187e3f57271ed7943913cb4ad19ce296074302a0d221e
SSDEEP 24576:ND3FHshBIYQgAs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NDVHeBIAAsLNiXicJFFRGNzj3
TLSH
T1B775E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-84-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/1036-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1036-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1036-79-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/1132-77-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/1132-8-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/1132-1-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/1132-314-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/1132-0-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/1568-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1568-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1568-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1568-305-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2128-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2128-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2128-279-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2128-60-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2776-38-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2776-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2776-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2776-45-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2776-44-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2776-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3732-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3732-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3732-381-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3732-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3732-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3732-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3972-20-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3972-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3972-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3972-14-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3972-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4836-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4836-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4836-366-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4836-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4836-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4836-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4912-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4912-121-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4912-369-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4912-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5456-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5456-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5456-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5456-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5456-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5492-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5492-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5492-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5492-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5684-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5684-138-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5684-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5684-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5684-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download