1ae8458bc414045ece0fda665c399303c240d0de111a913be5ad6108b1382546

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 1.2MB
Sample260910-he4npazcme
SHA256 1ae8458bc414045ece0fda665c399303c240d0de111a913be5ad6108b1382546
MD5 3020059f1d2853edefa011e1810df9f0
SHA1 0fb399d67a1bbb8070205e81ef85e897f4d7d83e
SHA512 5424dfe259d54e661bf127d3c5c4a99780348bfef072338e19065a4d51c9cd9caf5a9ce11a0652a84277a94d8d6773bbe29ef6faa160fc866cfb64753c8fb4ae
SSDEEP 24576:SwTYDBdiixe5QH+Ij4aq6evtshyxknw4FYnshx8OfVe247:/GdwaHVECevtskx4x8EVep
TLSH
T14545D0207AE5C036F5B357306E7EE6AA142DBE644F3580EB7BC4592E28705C25A71F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4184	elevation_service.exe
1944	elevation_service.exe
4124	maintenanceservice.exe
4988	OSE.EXE
4564	PerceptionSimulationService.exe
2152	perfhost.exe
3260	ReFsDedupSvc.exe
716	SensorDataService.exe
1104	ssh-agent.exe
4240	AgentService.exe
4548	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\afacfe9b5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a447c53def40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071deda7eef40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6bb993def40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006263ae3eef40dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2576	2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeAssignPrimaryTokenPrivilege	4240	AgentService.exe
Token: SeBackupPrivilege	3260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3260	ReFsDedupSvc.exe
Token: 33	4548	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeDebugPrivilege	4184	elevation_service.exe
Token: SeDebugPrivilege	1944	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4444	4548	SearchIndexer.exe	100
PID 4548 wrote to memory of 5760	4548	SearchIndexer.exe	101
PID 4548 wrote to memory of 6140	4548	SearchIndexer.exe	102
PID 4548 wrote to memory of 4596	4548	SearchIndexer.exe	103
PID 4548 wrote to memory of 3792	4548	SearchIndexer.exe	105
PID 4548 wrote to memory of 2392	4548	SearchIndexer.exe	106
PID 4548 wrote to memory of 5888	4548	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_3020059f1d2853edefa011e1810df9f0_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1cd33bccd5ef0e2db46a1044b4e8af1874aa33a70baeb76c69775ca4170765c0
MD5 54eb784bb91efa8c2c6d38c25bdd94d9
SHA1 db80cc8a87ffbd1b98b088e5d5e8f35135c05e5d
SHA512 7c117d85151b1fd742871a85dfd4b84196a8193d1c834fca25e6541d37235ba2e625f23c99a8c016ef286bc016083c38269d7e1ff6f4a6ba942f1c9551633151
SSDEEP 49152:lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnLx4x8EVep:73q6mjBAix8EVy
TLSH
T1D8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 3a2fd1ac6c25a3b6aabf2ea37e9635529804660425fb42edb638c2adf714408a
MD5 0e2152d5c327b98789c963eca076355e
SHA1 f6c68843f4df63792fd6eb9b068438d3d7910924
SHA512 578433af82fec10567a3a136669ed5b69575a79b863173971d2ff804427e5b7992d3ec801f8ea96385223d1383225c9166fb74851a43df00341f3edee9e9574a
SSDEEP 12288:a1XLsswWkxy2lRq2czA5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:wXYfDtczA5yxknw4FYnshx8OfVe247
TLSH
T19975F12877D508F9EC6B8139C9B28512E633B8554770E38B03F4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ba4c6067160b715bf01cb08a492ac21dc6c6e3a30c6fb1a143c45099438fa6f3
MD5 e55c370cf4000b4b807a8f069831d5e6
SHA1 8ee15c8019026f20fddaa64815a4f9406f278256
SHA512 1e4e4f9f2ae594a29486b2278b51c027e35503a135b357f6b777cfb3a9220a7a3474839c590ab981fc782abe30d40d02c36e8d7fae297b801ea76a5138e166d3
SSDEEP 24576:w0Le5ji0hmxSrMQyxknw4FYnshx8OfVe247:wPji0Ao2x4x8EVep
TLSH
T1EC95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 98e4fe8bf76056f1825eb88c010e4ecaaf7acaa7ea3a2b32238b034852636931
MD5 5e2288356d6534de212502baf8b26ac7
SHA1 1a21bbad6d6a0037d9c6359f21a303f4d0dcd907
SHA512 10d104871eb90fd781dc6fce1beaa8b1b37114dfd3fb0b314ae4f595d851b2d7db0bb0fcb164d65d4c9252f03e65e76ff2a9a435fa8b9615afd0e59aaa744c87
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyuOyxknw4FYnshx8OfVe247:s/ezSC6vUzPv+HjySx4x8EVep
TLSH
T1E4756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 39d3a6cee96ab77259db2e8734d41327fcc61d9383c534fe0baff830b5e2c12b
MD5 ef32aa5c5e30d2b4fbec0eff40e08a90
SHA1 3e2ff5763526db8d54a0e9e7375483c988199f2d
SHA512 819a356cfe6a050b8a0e7a869addeb576e0307ac4abade052308433ac2c4f14946f45c6bed369c5fe2565c96357361590c82d2626f65c0d021420789afeac622
SSDEEP 24576:XVbqPb88hv/l+BFyxknw4FYnshx8OfVe247:XVO88hXl+Wx4x8EVep
TLSH
T1D1559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0d862dbf2f3f1f51e169bd328a77c4636ffda2f9b99c04306884cd052580bedb
MD5 a8bc1020b2b6c41bbd85133c296a954c
SHA1 55389af827ee1791fc3b8cff0975e660f99bb098
SHA512 d06dc5c7011ee32d87658264203a652f6871df443c9c3446ae0bdf05bf53c77b8de2fd1fb881ddd33334b1b8d66a4f4650f268453bdf3e3d612403a7ee303b02
SSDEEP 12288:Bas+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Basyxknw4FYnshx8OfVe247
TLSH
T10E6523BCABD9E4E1F65E14331A7172623605FDA0DAB4C11BC778B64EE4B0C54E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7ab08c7095d9c90a9f2581d2827162c7c66f470aac1e98cc8778a0d9e6072aec
MD5 cec8f60774499eb04815913028a34197
SHA1 2036c4013bb2ac78d085ad9f55cd7f4fdff90cfe
SHA512 6ac4b6f3eae3e688c32e8d4c9c4db7cc4bec3d9ec1942ef84ffc5479919434b96397781a5705b00eae7f7f0de863b48b4c678fa1ed6a3bd27a3c5e420f697d2e
SSDEEP 12288:keBNUbTVO86Ut+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kJIUtyxknw4FYnshx8OfVe247
TLSH
T1C575CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ba9dd377978903e332c3f0b90bbda5d5c5ade073ab5d51bdf87055961526b255
MD5 1cf0ff456966cfd4ff0910de44b266c9
SHA1 97683b9d621c551bca776bbb70cc7347d959e543
SHA512 8420c77c31d70288f64ad0e8506c2a961cb651448dcfd0b91ea4f7a04cd0da81798cc9bf606ddc7619d03797abf5068bdfcaf4e863c385a01cacabd9f5230fa0
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH+:0QvGAdlCEL8c/WRNw5CRix8EVy
TLSH
T1A3267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 49ba8311530aecbbfa05a981d107e9e0062e046cc316db0af61c77fee373c1e0
MD5 ebc23925b364f76b64f89f35ea0293d7
SHA1 d880570b79191e72a26f6e375c66f774941f11f3
SHA512 9b383135899ce88ae415102e0ec4aa34cd498bc7f1f8381d3cca70e2822e791e794bf55605dbf9e5b67d4fec11c22e2550949ee7c045c4d5c6152ad10cac2b97
SSDEEP 12288:fAwSfxL/2Dc3zDLLmt0LDQewsAjD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:o+ewsAjDyxknw4FYnshx8OfVe247
TLSH
T17385E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3B89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 84b52b908e487b29c1fc13e8f15728e139fd867c85835e3e87581bbe2dbe990f
MD5 cc39ab7423395670ab53e50f0654b462
SHA1 56606a90bc1854bb7feccaa416172353edc99817
SHA512 5af0421edd7facd164b6f5dd5aff6f4b6434ff3107688f63781ff59fe2418eee0662c2033b0dc1cf16b616114eff7daa5661a8a6fe0ac01e1c740f4399cc973a
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHL:SUEtQevvqc2W1cpV20I32
TLSH
T1A6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ccc9a82c49b67eba0423e61837719d3b45479a43d4f8eba310d670bfb920f07c
MD5 62ffdbc5dbfaa8ca961b2dd9f637c3ea
SHA1 4f056bfdb983c6bf936ddf12e8ba5069f9b75b6d
SHA512 4b73e98e9f850a1ff4bfaf2aac0ae79716528992a475ed99d5d1066b53f5fa3d4812bd35393601b35a6bae261fda17e0295efda53dcb708462382893431e5109
SSDEEP 49152:jCbRquA/m2yL5zLfFiV+XenmE3/zmx4x8EVep:coq2Vjnm9ix8EVy
TLSH
T191D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b39705c939ee0b96e871d398270adfcdb2dd6c122279f89b11f42a12abdec738
MD5 b1d830d21af441396b7ae5d846294e53
SHA1 d8d5644690501b9ae97466a2f1f25eaf79711385
SHA512 76831150f29ed5f297df19185bf695eb1acd697131c6e2328ebd86812de7b6ce6edc6f1b7ed28a1e7f072789280a2369f41e9247d12ad1f458754cb0940a0f93
SSDEEP 24576:nAhGL6IFoiwtA5l7S53iyxknw4FYnshx8OfVe247:nAM5Foiq5Nx4x8EVep
TLSH
T14B35AD80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 986e119798461b20c11093b8de33989e7573a5091d9eb48080790dc83960a8ec
MD5 78b79200f9ae9204196b901f6395c539
SHA1 e375199d027aa0575b8a4d78197711b084e7e5f6
SHA512 9c38fbc1b163bb1526be04a9105e27c9a0e2d387e8296209b7d24415aa6f54a1a0f5c98de37c892c4884ddce1852ed4c509c4d77f8265e54afbd881d0394360c
SSDEEP 12288:Qmw5HEjsChNrBFgl0WDm+Cu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:NwumOWnyxknw4FYnshx8OfVe247
TLSH
T1DC75F14977E81CF9E96741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 b6390bbd217c9c5930e11a4339c2bbf0b798c64221f0e688c4fe7fd0b58226d6
MD5 05d3697d7e78e61268a063475bb0fa70
SHA1 e540f2296f50fba69f64bad307d8136fd058f6d6
SHA512 9afc01dc46e82d7512d8b084c3fe48e0cdc5ec0f0762a5198bce82c2feb063aa09ac306feb1deef28b746acff85c05d7dc71333368331ac5b6cbd734be330f4e
SSDEEP 12288:5vZ1IyT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Zu4yxknw4FYnshx8OfVe247
TLSH
T13E6512AC33E860F1E1AB113A89F15205E762B4A2677183CF4768625EAF71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ddb6066cf1a5577a9c33c25e0f32ed244d2da258f5f594d0285aa4a95bcc364f
MD5 97998d58bc15a43cf432888b26b29ef7
SHA1 99c9f0384d853e75ae87bb9339b9a62bb2484ed6
SHA512 7e78e8ada8cbaeddcfe6fbe48a103f773fdc788296519abe8ba3d15cd85379501bdd0f38a04d1788e71a32025129f8d2d0bee06c131ca874a18a1c90c8410ebd
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:hQRQyi36YOcPDLvw2gAf+PN3kix8EVy
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 da93d3c92959ecaef2d74d510e7324d36e17354b72210989aa0e414503082e3a
MD5 292425b0e0cf05a09dd008c8e1ff45b1
SHA1 d93a88a78cb168058a2ac48350f257f76b07c3fd
SHA512 7d7ec97b39c6c735acaedbf7d77642c5e8d28f41b3c68d8c776d1032ae664f994ccf4487ffe98338364511d68758cfdb8d1c9aa004ed5ffc8becc65d6e0239ba
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:RQRQyi36YOcPDLvw2gAf+PN3kix8EVy
TLSH
T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a2c650e59263b57218555caed538e73043eb21eb9ea8081b2c3164cdd8c12424
MD5 d8687737e9af1250f7016e002a1462f3
SHA1 aece9cd223e51ed502e00e2fbf319df14d8480b3
SHA512 3ae64b9a226901534c3419c2187fdab72763aafe8814e4ce710421736ba3c7f9d95242f5e0690f1c020871310d4081a04da98eb495c35e46fb53e536e19ca565
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0oyxknw4FYnshx8Z:768Qg55nhkeWu7PNU3/2x4x8EVep
TLSH
T1AAB55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 632d18a4ebf82bd3b9371b75adc50cd5e81497921b7639e1ef70fa601afe2ef8
MD5 79190a49c4643c857f01cff73b2c5faa
SHA1 03c1aadcb908b98bb1123f4f2f7c06004327dc7e
SHA512 ebc45f4164d8f4fcd1dd4b9ebfe61bae5e1c5ee09694e2d0356c75b74f60f8e59fab9fe6bf07ac89bd5a368a63d56f49d28318ea9a218e7ebe903c735ab85620
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99M:ty5112gYy5azzVvU69nLKnhZHix8EVy
TLSH
T178167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9578d4f82357a44e687bb2832a237e745ee3955ac22feb82243182d62c8db45d
MD5 9b6bd4d9dd8a3f0fe42855fa31af29a7
SHA1 87fa6b75a107346f7f551d5a15e29224a714be22
SHA512 df88cbbbada1eb76eb839d0ded022f1e273a46b8784a6072fc5e8d3e5d1d3912f20cb7872b369e8f575b3eb583fa67b1d8273f5771c2d7929b197acd7c5410ea
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsx4x8EVep:0u6JmIxd2dsix8EVy
TLSH
T1ABD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e7236f376b7fd00698c5bc50c9c696a3d6f49222f708a02695ef027cf71cfb54
MD5 cee0c25d45842a01831ec172ef9ade04
SHA1 cde634ce4f60ee3d0d1e71a030dd7168345defc7
SHA512 5aa76983be5366af2a97cf88730a3d7e03fa9b81a46d650d4302d9d9b10e2c3df6325cfc0ffc02d1777983ac81f9b02bbfdfbe60bc6253d08b8028fb9ed23f3b
SSDEEP 49152:N1hpsNoJpF1A67U44CwH7R4x4x4x8EVep:NmifPqR9ix8EVy
TLSH
T1FDB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b8b7b64d03191739c0d4ed4a78fb9550a9f06745ed9e2148016e7c7f23f791ce
MD5 0352cf25f78be721fb8eaecf92bbd756
SHA1 6aa026540ca1d855ce355540df5483d40f0aea78
SHA512 7bd81bf7cf9869f115bcaf82ca0dff9d0ec66fa1452e11476987f9c6e2381236ca42693bf94c2a1f5e128495ccd742add0d3e3265c4821f282ee780a71eb4d2a
SSDEEP 49152:sSuZQIY0Be2KkRVtOnks6NMHqbx4x8EVep:O5dKqi61bix8EVy
TLSH
T10BC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a1981d990894d4f4df259aef9eacc40680e4262c4de4a16039721ca617307745
MD5 1a3ce91d3e85bc494440e2c9171ed4ca
SHA1 28bb7c323668f39a46351d42a946272eaa8b2874
SHA512 55051b6ae8e8f9d26f4322cec9e773eb58429321321d0b19574eb704add39970869ca740830ccc6bede5f89a12ee660412c3e5f8e0d65734489c2ccbd7727b0e
SSDEEP 49152:nhtSn8EApI0figjgiDn0AP5w8x4x8EVep:2X2iWphpix8EVy
TLSH
T14895BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 755767c6eb452d966bd0b20defc84ffb5e9203e525b3d6bc4b3f582ddc10ef42
MD5 5a9544e7e138215d70f98b7b67671419
SHA1 c145d7e799c5d56c4f690d5db6f6c4bdb155c77b
SHA512 7dfe4e4a480afa81254321ebf91cc9ddf64504ab752db681ad195308f2f3798b59acafa42d620b3f36386596eb8ddcdeb53cd84cb05516cedae261cc5d5b205a
SSDEEP 12288:zU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zUyxknw4FYnshx8OfVe247
TLSH
T18465237CBBDAE5E2F50D11730A7173666609B5A5EAB1811BC77DB00EF0B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 109ab7bb6ca2bf0d033ebfe0695427b6ae5cbe08ae13a5e9bcad3fce7c517bf5
MD5 8421007818812057d7adadf11772a379
SHA1 40e5eecb7d987073b6e1e73385ff05d596a7aef8
SHA512 4da5d4f5f67183367cc4852c57afe55d5cdf8601377f90e22a1665a89a6b4b07f2f0dfea54f3f41d566833027db560412c90a47705e29844745c9203736cbf46
SSDEEP 12288:4f+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4fyxknw4FYnshx8OfVe247
TLSH
T1D065237CBBDEE5E2E50D10730A7172666609B5A5EBB1811BCB7DB00EF1B0C94A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ec385c7530afba4f9ba489655da8036f02a6ca8e2237c31e3250e13342c236e1
MD5 7197f0389b9efd81e86b331c65de4be3
SHA1 dfc00585c3e542dbdb21dcfcbf5ba6964dd61a74
SHA512 25aefef26ce4369029656aca4a6b719e08e461bf0330c37f55e822b0adb7223618b707119d2ca97e3688fee154c8299d578953de4c891f52c4c6e96d2e95ff8b
SSDEEP 12288:d1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:d1yxknw4FYnshx8OfVe247
TLSH
T10B65237CBBDEE4D2E54D10730A7173667609B5A5EAB1811BCB7DB00EF4B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 9947abddef6cd36561f67cd808668214ecf0a677690791c1ff9fe0041797395e
MD5 7273b5eecb105b5fc8b47be362288f83
SHA1 bfb9757e17cd13f756ca526105e38f88c0fcd605
SHA512 dc00c42d71460ff03e0d20920c1b60ce0dd9581ffbc5db1282f1c2635735c3719baa300e87429dd47947cfc4cb0f2b8ddaf1a7ad329dc802eefa24a73e4520c1
SSDEEP 12288:hVC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+yxknw4FYnshx8OfVe247
TLSH
T15F65237C7BDE90D1E45A51738A726222B365B8E4E731C25FCB24750EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2eb554326692e66e53954e323a8fc60fb3331e00baa957a7e09125d3b6fb6c6b
MD5 ff461871bbd0b5c2ed4b058ec3326321
SHA1 23d17025c2984bf265722a4e8cbb69433d7f1983
SHA512 bda86f095fb3a29128a140a9ea11cafa7d704bec0dab259659f8b0a638efc8ec6e0f516ba0ee4a78483de801c7b5ef56ca20a22a8c0c28dff155ef788932f949
SSDEEP 12288:Fa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Fayxknw4FYnshx8OfVe247
TLSH
T18E65237CBBDEE4E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e31fb25af3d687b50b178dd73f995e26423e61833032dee16e65a5c79ebbfcb9
MD5 f4a6a1c1a3a88fe2e06e7352453ff776
SHA1 a8abe2f86aac82a2e54577462397c65bf16c202d
SHA512 75f4b2d63de2f2eb01a660918dadef04d59cfb23c1b0194edd1487c78bdd0790c275ff1ec18df06cc66a7b10f9160e860c332bc7e1febb78a5e2df3a2f25baa3
SSDEEP 12288:4r+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4ryxknw4FYnshx8OfVe247
TLSH
T1F565237CBBDED5E2E50D10730A7173666609B5A5EBB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 883a9045414a1b66ae32c6ff1253975801a70968d8d37200b62a730791d2ddb7
MD5 6d890afcbfc70620e4d2813412ecd7ed
SHA1 0c91cc2fa9b54653a96318eb3d8fc24942dc2845
SHA512 d134c4f17abd7f671e0eba6b2d0e3ea8388471b9945e42c8b896ea43eced4c70685b824a350f072c7630e04aa262099dd0522177b882f3ca1d335e1ce57fc75b
SSDEEP 12288:JX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JXyxknw4FYnshx8OfVe247
TLSH
T1A965237CBBDAE5E2E50D10730B7173666609B5A5EAB1C11BCB7DB00EF1B0C64A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 6c72a12b59f77fa38af46f829bc20048fa2357f40c44565b66d58910808673f9
MD5 65df45e2a5bbac22103dd39beddde3b8
SHA1 ef4ce1a9e4eecaa03968e338a37c8877c44a11b1
SHA512 57ebdea851cc8b9aa63dd16ef2b2c83c926bff75a754543f226647a6608ae17d25274e0129577d368496918f69410c40be62a773fd6db0c55ad2c8c2530fab09
SSDEEP 12288:EiZwbyzzFEoS2cPvy/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nZMqzFVSO/yxknw4FYnshx8OfVe247
TLSH
T15E7501A8B39018F4EC67413FC9659916D6B27C594B70C21F43B8362B5F736A01C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 904350fdcffae300ad8d57e75c44772fb4f20ddbccd0e798756bbbc9812d6555
MD5 fbfd33aa0b74707d04256fc1886a484c
SHA1 e4396580488a392b65cace710f6d808910e64482
SHA512 09a0571d447d29d8e122ef094e53daf8ad78f191bb2995c13845c69876512560ddeb7e336deb3b940c27e4a6a7589ca53b836e6ffbb7879b48886b28bd33895a
SSDEEP 12288:KI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KIyxknw4FYnshx8OfVe247
TLSH
T1F765237CBBDAE4E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 eb4a6206260cac7584ca62d2f5b61ba1c12647f9d8a651cbdb1e40f238b95d5c
MD5 4373252c8d20b61ed84e12c22248e688
SHA1 5f1ab0fda8ba208371edad4ef27ed361971c1014
SHA512 b30b5def8bf8cd125a440d022c660c9d0a08f941a46c5baed7edda7e4294f2e512578258647adcbb08051305761004291075b183f3e6807aa8967692bfc4fdcd
SSDEEP 12288:K8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K8yxknw4FYnshx8OfVe247
TLSH
T11C65237CBBDAE5E2F50D10730B7173666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 063df6ad9e51a692bd48182c0e2556f0634350fa4cb3a1afa4eeda6b98e337c8
MD5 1b72e74f582ea698ed6a46d9b198ce24
SHA1 9477f0b1a2ff35e85b9340ea5a3ab97926e5aef8
SHA512 e7b5df7cd8b8a0e1619d4e03bcfadaf94c4d1764e8ea9465a03d4f55b959e95c41fb72b484abbdba8f50019ab4db9b8dde85f0253c4fe0b3547ac07743c60868
SSDEEP 12288:DyPz5L8T+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uzyTyxknw4FYnshx8OfVe247
TLSH
T16E75125B77E530F5E13A423689621602F772B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 47c3436df06d43a1c744188d41f0c98ad644b746eddfd6499384a22ee1dd3805
MD5 64a07516e4bd4c84e7d2ce199ef3761e
SHA1 cc2117e0f27d303f5faf71b9b42f46537fcd6c4b
SHA512 b68405d2f0ad05c47c699b49ba1ec7a24224370a5ea14b1cd95650e24e1edd412a6d5641bc0ff5daa960727744dcbdcf838ff62fe99550f616daac55db8bcc26
SSDEEP 12288:sI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sIyxknw4FYnshx8OfVe247
TLSH
T13865237CBBDAE4E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 5c4682d5013af7be6bcda95e6fd6fcddd1960cdce33447e978400e016ea12f3e
MD5 ecb8bc49930c8d8f0c0e4a3b09fcf1ca
SHA1 56cff4077bc121b3d2c47050362f03c5d778012a
SHA512 5f944627a7ad789b4d423d81826f217a18f58d4c5a6e0ece5414cb7b2dcb7535f732abdcd5233a17a0a6460defa5b639164929cdf0d4daa5bd9023d86de5b5c4
SSDEEP 12288:2I+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Iyxknw4FYnshx8OfVe247
TLSH
T18D65237CBBDAE4E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 7ae0545fcf1f029600ac3669bae2e9d3f975d50ca485e4ff8e2034b552403ad7
MD5 ae3d9335a5ec761959d5f2437f990013
SHA1 6698e11eab2462a125f059e8b5663b2fbf177905
SHA512 03934fb9296caf5bd6fb537be39ed79cf22eb362f270ab0539252a546ee1807f0dce9d6e604e7b4f77f368c462c327a4c9b88bc1ff878d67fb38a31ffea81ce9
SSDEEP 12288:LyPz5L8T+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mzyTyxknw4FYnshx8OfVe247
TLSH
T1FF75125B73E530F5E13A423689621612F772B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 dabfff157fca39131a830efb9cb1fe294d9bb77a820325f8f1455ac28b0b40cb
MD5 34eeee325e9395cccea11485c7c29cd9
SHA1 5b5c853baaed629ac6ef79298bc89704a72fa817
SHA512 5eba89711ef15ee5b4ab0015b85b8c2e64d73511d5a4205954aaf0aa2bfe82485c03bf618006b8fc52c780851582679d328d3e109ad03493a2e2c524c5a30675
SSDEEP 24576:eTPaLl3z0zDlyxknw4FYnshx8OfVe247:eTSLljBx4x8EVep
TLSH
T1AB7501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 cb9ee76dd673d3d00240a57f2b5d5bd0b4bfe396d18ad598e7ce2f3af66d547b
MD5 98fe6306408c7cbe6a63febdce0f4407
SHA1 152b63f737d375749b614aabd9fd50cc40af0ecc
SHA512 8a8d7234b82bb9226c411a2a5fdd15ce889a6ae0caad7df5fad722b91f39e878fc10abfd60c074e01b2a59eb539da403fc636e1c084d2fa3951edd8a44e83455
SSDEEP 24576:430d9CHKy7GZByxknw4FYnshx8OfVe247:C0d9CHKyaex4x8EVep
TLSH
T12895DF90F3E410E4F0B79A358D765512DA767C9A5B31CA8F03A8661A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a03546b4fe05a54e4c807fa7adc1af78324f10f4a55aa1e2bddc14baf5458c59
MD5 9aac9e79d28e3443e9ba4d393d6149ab
SHA1 2d75dba0966123c0b15bc03d302be1726d9f655a
SHA512 b2720f222ff6244a9731c1e0f80a3e31b516cb4a4fad016f6b6fc9107df92728ae96a4757991f09de83c04fc93bf79958fafb4d0ffd12522a20333255ec98617
SSDEEP 12288:NV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NVyxknw4FYnshx8OfVe247
TLSH
T14C65237CBBDEE4D2F50D10730A7173666609B5A5EAB1811BCB7DB00EF5B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 63ec908d9da2ca95ea4bda18a0e7101429d515eb2f6af2f9d7f3b1dac4fdb93e
MD5 5cf6412a0a827c75aabd56615b0e0cea
SHA1 deea17ec386e0d8bbced3440a41673c8adec99a0
SHA512 5d4ba77b7f05b6bfdf52fcbacff348c956821d58c88062c33d92acc0b9df2cf9c32f2493c07ac9f09b3d58966ec3d317e2dbbcc088056c1f4799e5d35ce6cdae
SSDEEP 12288:Jz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Jzyxknw4FYnshx8OfVe247
TLSH
T1E565237CBBDAE5E2F50D10730A7173627609B6A5EAB1811BCB7DB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 d9ca8b21c1c1c520901de083ac66452c1084400e08976fbc3023cd2157e318c5
MD5 e9a3352d67b0719e9df4cf2b694db927
SHA1 d12248a758b468696ed918ce8cb935804a62531b
SHA512 3604d5a2a1f1f7bf7875368c7ed11d2b93086e6ed17ad5cc013eeed31c23585fccad1f37f0d34f3b5ea3c2a6e20a5a4dfae1556a4b47fbc82d62569be044d479
SSDEEP 12288:/G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/Gyxknw4FYnshx8OfVe247
TLSH
T19D65237CBBDEE4E2E50D10730B7173666609B5A5EAB1811BCB7DB10EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 7b0cabd30c8181733e453c6ad6e13e98045439ad0f7392fdfa45332f83eec175
MD5 3bad7932be0099ef346be96141d34df8
SHA1 23beb7a41f3683a2fc3b425fce4aeba68dd23f20
SHA512 ac5cd203d2fbc01dbb17d99f515468e70cd03e8aaf51cdb06a045004a02a1c4ddab3d46af09f7b742686fd8a80743d31129d1e5f037bd7e1657d15245184b843
SSDEEP 12288:SI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SIyxknw4FYnshx8OfVe247
TLSH
T1B165237CBBDAE4E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 eda6a22f5437ad429a2997e4897ed2c1210a91a617e91807bd6044360cff2766
MD5 456a839771d1b80e24680989b525236f
SHA1 1da349d8c696fd0cd5ef84bb264e41c305d96e0d
SHA512 125e5969323a0617953585b77a1f08411faa993304f27113791e8978b7208f513abfb8c19eaa78737f4680f9823633a147c034198d04f70c6eac0424fd44698f
SSDEEP 12288:9V+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9Vyxknw4FYnshx8OfVe247
TLSH
T14465237CBBDEE4E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A06E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 313e7fcd0dd04ee396788cd8e5c7dce4ada129262fd8f4683c0319257b474988
MD5 1bf95811d18f4fa502ba49de94501a72
SHA1 91ee79fcc9024c921af80beea95f67e57c66d112
SHA512 f39caeb8887555c2d1d87c20d7131cda961e7b4d6e5e33d5c29eef6cea60368d864d9f8d32c4322050ea6a826684d7e3cfc987d708a61f7a76bfbd9c1ba2e6e7
SSDEEP 12288:aA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aAyxknw4FYnshx8OfVe247
TLSH
T1CD65237CBBDAD5E2E50D10730B7173626609B6A5EAB2C11BCB7DB10EF5B0C54A01E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1efa6b9c3bd3bddd97d806d2b62ff1d79b76ef7d0a72dc01639e5f6dfd0ddbd0
MD5 e1ae84d1ecf58123d3ec65b702ef6863
SHA1 139c400b362e622a9164bcfd58aefb175d93e919
SHA512 4892e716455f189f6bf6c1d7216646dec6612e69b6bf8e02ef7a6fcee471606e4b62c98609783da1c0bb5192f1b18bff4313a15892217deecd7cbbff4ae80d3d
SSDEEP 12288:Wa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wayxknw4FYnshx8OfVe247
TLSH
T12665237CBBDEE4E2E50D10730A7173667609B5A5EAB1811BCB7DB00EF4B0C54A06E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 a464af40b89a3d4e058cd0c3dc47b46b8d1d8c907ca8a2ac0c41c21dad6a5ee5
MD5 9a73b61bf4e1c32df48de87c6a561964
SHA1 ab1dd114ad1de3763be043e81be1ea7bca8c4c7f
SHA512 41c6f596059f925a19e28c9c58b234e439fb0b4177665fe1092c4d0814e8e37730ae994920468f72d6ec6c9d763fa48109995c54d711de6e81a9c05d697ad205
SSDEEP 12288:+9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+9yxknw4FYnshx8OfVe247
TLSH
T17365237CBBDAE5D2E50D10730B7173626609B5A5EAB2C21BCB7DB10EF5B0C54A01E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 0561a744fd9ffe702fe3717e1dc65fc98d2094708cbeae958d136322c47f4556
MD5 4b0e1307d124e1d5895851d10effbd0b
SHA1 89dbe600b28dee16a7e7499ff2da426fc76a9205
SHA512 4f3fd55d7ccaa5094749badd1ead6c21b5c75a55ef51595502fc141c93d771bd8bbdf0f33d0d0477d7f674604fca0c5a3a3966ba8cf945af4a06843f87912d17
SSDEEP 12288:Ea+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Eayxknw4FYnshx8OfVe247
TLSH
T13965237CBBDEE5E2E50D10730A7173667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 d469200803aba12fc72b9c8a6f83513f935f1409b35b428fd2a207893615c10e
MD5 ebc71fd082cc033fc03d8888c431c023
SHA1 694f0bbcbc869cab60e030af7957fc34568fde65
SHA512 5cbe7330a01159fa76533ea159d00888c0e81fa3903719ff3f58950e62f5ede2f3a9dff8b913c3abb21de02f61164a2954e5db86b6a707df742c35191af834fb
SSDEEP 24576:hfwvgk9RX6wkyAIMyxknw4FYnshx8OfVe247:TMnYInx4x8EVep
TLSH
T19395CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3f6a2d8013088aae1a330d41e0ee9e7ec015d04505e94eca19366a781faaf8bd
MD5 9209a381a59439fd7b3dbecdaf244183
SHA1 686a520474c7630b50fcde7845540238859b6a51
SHA512 178b1ab8d3f72253a859649ee368c2831d39da73594343dcf85281a5464b14908c9afa81b957e0a3bed18d069d1edf7b6168e412a51fc2ab17c5f3d43d54c9e4
SSDEEP 49152:9YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cx4x8EVep:sySzPEix8EVy
TLSH
T1F7066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 64fe088c48999839590e952ca082dc060b91604d5cca8a00f4c8371f947f372f
MD5 87f379c1d3027f23380915075ead5df3
SHA1 cab8ba56b18ba23645030cb296b91d8bd87398ee
SHA512 e72da66a15c74b19043f7558b0b962220cc1bac7775fe4762ef05276b388902ad9983d6b3a82e51b7421955f0b094b244676a9016b3a74c7641c7f0bb6a5bf08
SSDEEP 24576:X47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYPyxknw4FYnshx8OfVe247:X47JUQjqirIhCnDHUPfF/sx4x8EVep
TLSH
T11465AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 5ca2dfbdcb6bddc9d3f0e469fa3fb5dec162c33e1060ede2bc0fca533a2433a7
MD5 85040ab4cdb6225b1064a3547aad03f2
SHA1 0601a141b20d61275e3acec88ded7db33ebdd060
SHA512 9b9ef86ddd5344049d8c2de8347504934804b846d6cc46bb7f6883d25193b19d3b832210c67bbdd16f79bbf20a42a5421788fb537aefdf6e5246faa8af509eb3
SSDEEP 12288:T0sf4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:X4yxknw4FYnshx8OfVe247
TLSH
T144750128E29852E4D06E2176CB625641B3237C6597F1D3CB93E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 20037c5cd95d5bdab14c0ebe132a25e97b073d77eb8dd578244e4f2cb510076f
MD5 a6822d7e2a4badb4da40f5857397224d
SHA1 12587711babb5917200c8fd8126a684ab677fb2c
SHA512 744a15b1a9c0bc25f3c38dff3932c54f7cd9c37fadb28963a897eed37daba278a81bf1366edddd618aa3fd5bfa2a469a71d5331082aeb04c10f04c84db2703f5
SSDEEP 12288:IZgPIU3fUcxbm/aCNNlRGDp0NNspOufQkBn1Fbheo4E/dPc:IZgQUPUj/aGlGt0Ipxfl1FbhecFPc
TLSH
T1944517407667D79FC6A940325E36D6CCA7707C01EE05AF0773C8873F9476669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a085ec9722e5cb79887b329b2f665c280d596391f689ebacc884334994784fc2
MD5 e72bd9fb4b0b5da822fe1631432a695f
SHA1 b66b2d523957ef82f82e7af91703a451792ec7f4
SHA512 3620ed8f8d3856e3a7a38545ab54510bbb43fff77e16dd9991195fc12879445db0defeac1b378376a26ae19a3bb00f61c294b75fef492e4042f67d5f7594b95a
SSDEEP 12288:Z4gcQfqfnkF5qWEJMff+XQvUGya/QQsQuoTrzMhRkZ1mox3/QYbH:Z4gcIacGgsRa/QQsQFLmCPRH
TLSH
T1A955394165B7E35FC9EE90374232868DAB746C06BB463F0173448A3C986797EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 68acd939bb43952a3d1e0d7c64c1607536f97a4af56c6648af7808ed6a4b5d6d
MD5 178c6f08c710a268ae98303829d2a059
SHA1 38ae9f36b4ab70b41bfd2c76f8f22d6c31ebf910
SHA512 2b18390907788f0143c6604e6f4d5b83f58db5494f17f877c0e06a484410f5b34249e4e4f44e56c31b602ea286bd711a45dc141c18f70324b72b6034e9ca8cb6
SSDEEP 12288:sR7w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cwyxknw4FYnshx8OfVe247
TLSH
T1DA652378A7DEE8D2F46D11730676A231360AB5B49B70C1DBD728B24EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 23805592adcb183c1652c4c5b4de0bb652553d2820288520fc1655bfaf1b948d
MD5 5eb1f0209dd4c065a701a369267e39ba
SHA1 fc9bffb5d6850c12d8ba342b9e75c70253bef3f3
SHA512 d925ed8bb6a803a64a5ea02a376f45fb5b93d39036c1c8c7fbd1ae7891d35ecde091ada27e1276ce6f5cbced3023e3618dc7d2e79798183e767f4c16d29d9532
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYOyxknw4FYnshx8OfVe247:Tgb4mBIBhGF6x4x8EVep
TLSH
T1E865AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 535ba9f045eb1e56d4d269b1c27a1dd5e824b37539002f6c82583859ac835331
MD5 711a74c3ccf15f6a7be7abff1490c831
SHA1 60713e94aa1fc03fec628a83d7fe23f28a311753
SHA512 72c70b7aa333745cb0747e36e7588f680109fcfefc8b7caadf9c38a47906364d8cbfca2963f69ed76d1d7aed5a1d0ba80cc7bd0ae6d030281b49901bf8fee948
SSDEEP 24576:LG88u8FpJqH1Izria7/m/yxknw4FYnshx8OfVe247:K7ZFPqV3a7/Zx4x8EVep
TLSH
T12195F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fc0ef80d75ad602a5b6c1ff918212bb9b2083a2d1042b867b06d0d63795c583f
MD5 384789fb9b332d10dbf9f5b5d2111e33
SHA1 84126aa85f9f1116b33d830c557e6662497abedc
SHA512 c172a0062b42939e22547b45410ec3d8782d288133e6b0bcfe1621c80fdd7befceab6bd0801facef04ae300f07b634a82172d4b2455f188b32fb4866a3954fb7
SSDEEP 12288:CHvUrBFrEjwaQ7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CPUr+NQ7yxknw4FYnshx8OfVe247
TLSH
T1C775F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4d2f274eb7696a188f02ab8def687cd74b6d6107881f22a6ea28b0e68d930059
MD5 4fa618c816d951575b16a40b32e983d1
SHA1 40c1f5036aba969afa7462c7e8d1d3d8994bbf30
SHA512 132b626d6550e98716a9e33095274ddfbeb14b79ca3a03712ed46add424a21f55927a3c01c9449ec09e8efab110fbf4f11396449a2b4ea5f50ded62c7a1a3a49
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOx4x8EVep:8G05lO43b/ix8EVy
TLSH
T1ADD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2f6be2e3da3919696126d052cfc9f929385368239953753aa7b3f1f3830e794e
MD5 b0f88bca89a55ba281afb6f275673a5c
SHA1 a38e22f6c4027ed92362d6a8f59e8f36de2e7a9a
SHA512 a7d1efadafe21864ae305d2d8d865c829af6e56f87c275cd22379c5ef19535553b8f6e4305515add2a0976f3e7b1c5c9c924ce3b3ed30f3d9f9b57bba500abb0
SSDEEP 24576:tfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnZyxknw4FYnshx8OfVe247:da5POZ3lJt2pasx2+m2x4x8EVep
TLSH
T17765AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ad2c26504f2f23f7942139c27874ee8b236524a15906360d425ed10494e44b36
MD5 ea75d10e0e0e52da62f78cf696fbdf82
SHA1 851ea524e3891fc4afbb33762cc7f89e1820ab57
SHA512 951801791df52138602d560a5bc6ba23bd6d28ac83fc8393ab2e2757d3d7e35937d13d4e239e495bacec9d83015ff4eb2b0d075cf8e4c3728b3f9a1eed8fb27b
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkHyxknw4FYnshx8OfVe247:pNc/zEOVHF5x4x8EVep
TLSH
T1BC857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8c7a415726f5ba06541158b0fb59f9252a773b20b1d04b00ff8a3ae775e3245f
MD5 0b6ac328ace61a6c18fa091656e574ee
SHA1 2dc192aed4e5e947b6c077c762dac608f305ea0a
SHA512 3556640c86ceca6bc121a16e1b73feab591bae3d2dc71385f3cebd076a7752815a047ee5e9cabd1c694baa1888c9f79ff25d511e80e7b737cb6adeb379210a4b
SSDEEP 24576:qzkNvNnaFeYhJNtmZBm9yxknw4FYnshx8OfVe247:qzMwBtOmox4x8EVep
TLSH
T17C55AF6EBAF846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 658c24c6dc9b1d7b5c6b2c8de402eb073d8ea6aed3194402089bc42c738f54c5
MD5 b63abeec2b654df4cae73ec603ed39f1
SHA1 39f72290eb99ce393133bbd67cfc9960e77b1999
SHA512 361dc0acdad5ee5a7f0d778d6ee24364a1cff70579b985a10569c8bdd6f15a96d9ec6526e938e664aa435822b64526c833e5ad540af4b6f058fb3417a3c0d79b
SSDEEP 24576:lD3FHshBIYQgA0yxknw4FYnshx8OfVe247:lDVHeBIAAPx4x8EVep
TLSH
T19285E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-105-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/716-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/716-364-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/716-121-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/716-99-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1104-117-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1104-111-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1104-363-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1104-120-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1944-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1944-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1944-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1944-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2152-77-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2152-83-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/2152-78-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/2152-308-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2576-312-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/2576-0-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/2576-76-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/2576-1-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/2576-8-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/3260-380-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3260-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3260-378-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3260-119-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3260-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3260-88-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4124-51-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4124-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4124-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4124-37-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4124-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4184-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4184-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4184-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4184-22-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4240-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-138-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4240-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4240-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4240-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4548-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4548-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4548-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4548-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4564-64-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4564-66-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4564-72-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4564-306-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4988-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4988-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4988-53-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4988-304-0x0000000140000000-0x000000014019C000-memory.dmp

Download