e59e02c2e215a2a5297a5aa010f465efb58ea0179bd59126d815c439b7ffc4d7

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 958KB
Sample260910-rxprxsvdnh
SHA256 e59e02c2e215a2a5297a5aa010f465efb58ea0179bd59126d815c439b7ffc4d7
MD5 83147fbb2db15a29d333f6f4f1001469
SHA1 7db347aa8c2a36f9840e732c15dfdea64bc5ff9a
SHA512 3e28c492bbb0a0ec17ed4adbbb4bd9d9badf46084d039e35b1dbe56bc9b55549c578d03f77484c9287a66fa1b9e54e9c913f89f724ecbff8afdd14b4135b814f
SSDEEP 24576:ZM1mtPSIwwcYqUgXe4i7ojhsP5Lgrk1TWb4AN5:ZM1OXw9e30jaNf1TWbdz
TLSH
T10725F119E7A545FAE1BBD23CC4924607E6723C959B70C38F07911A562E337E09E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4484	elevation_service.exe
4924	elevation_service.exe
4540	maintenanceservice.exe
3032	OSE.EXE
548	PerceptionSimulationService.exe
3912	perfhost.exe
4104	ReFsDedupSvc.exe
6040	SensorDataService.exe
1444	ssh-agent.exe
2692	AgentService.exe
5372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87f9d226238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f9db828a3141dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001214f68f3141dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004299358a3141dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000558e85cc3141dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1452	2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	4104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4104	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2692	AgentService.exe
Token: 33	5372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5372	SearchIndexer.exe
Token: SeDebugPrivilege	4484	elevation_service.exe
Token: SeDebugPrivilege	4924	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 2928	5372	SearchIndexer.exe	100
PID 5372 wrote to memory of 2680	5372	SearchIndexer.exe	101
PID 5372 wrote to memory of 3128	5372	SearchIndexer.exe	102
PID 5372 wrote to memory of 2396	5372	SearchIndexer.exe	103
PID 5372 wrote to memory of 3688	5372	SearchIndexer.exe	107
PID 5372 wrote to memory of 5820	5372	SearchIndexer.exe	108
PID 5372 wrote to memory of 3624	5372	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_83147fbb2db15a29d333f6f4f1001469_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1444

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 04f3b100365bebd5f66f58ee8a039acf9e00c1c7dd29502ff812940cc9dfe402
MD5 4c8ae80d731245475a0fa1fd3969baee
SHA1 edf16ee1848f72e272f2dcd54923d2eef056d555
SHA512 63cfc4e207de704c5fd31d3a923c82ebe6c076944262c37066de4a9e1708d5a250c82f6c3d9aaa1358c2e3ccf021aa8f3937f5238e9c00f37c1ec6695977850a
SSDEEP 49152:xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnue30jaNf1TWbdz:33q6sjBHU023W
TLSH
T16AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 5ced569d7e116be7e06e9c93f24a136f8b8362e806ee556ffc8e8959912feecf
MD5 589170ea61079d97997e02d412c286bc
SHA1 6eca29101bdc0fde9b6f6b032d7e2c6928ec7401
SHA512 51d573a790f19c7a191558e9ab1e1ce9c10137acb45020f097cd55e3171673b08fd095407897ce2185ddec6a1acfb1b56a0fb33edc1cc01efe8108bf86e1dc00
SSDEEP 24576:+XYfDtczA0gXe4i7ojhsP5Lgrk1TWb4AN5:dtcEe30jaNf1TWbdz
TLSH
T12F05F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e30033d9a3e9b0a38ed0259c9e12b3416c9678a76d05546c9e13d0b0d1b2e29f
MD5 baf8a6621f75a28a69bf5d53c1fae21a
SHA1 2b63ea450ef03a575a7da1daca2b61c444533c6f
SHA512 5181bceae6eaf7adcc9ab0d83da34c5675d3b65939888e502fff6f5d3f7d0a5449a291b9f43bf65c894a723be85481154631a7c85b809448c299098afac5d9aa
SSDEEP 24576:I0Le5ji0hmxxrM/gXe4i7ojhsP5Lgrk1TWb4AN5:IPji0Ajte30jaNf1TWbdz
TLSH
T17E35AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 268078374add852be072a7dd31a256901f4664c0c3faed6dd13d03c6d43da8f4
MD5 bf8f26a861605117902c7d506d903583
SHA1 bc3bb4605a8266d7732ff84cead2f17640dd8988
SHA512 678435c905946414d92307514946da4a6b22bad1ea01b1401e2c6627b1870a9f4706dc20500e8f8c054bf213b1067a3ea2e6800e65dcf3b75e6a62ab1336729d
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWn6q8wyupgXe4i7ojhsP5Lgrk1TWb4AN5:4/ezSC6vUzPveHjyBe30jaNf1TWbdz
TLSH
T1E8756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b3cab5dec94e0a314b35b1eae47774f0e579b4a83cc3a4674cecb617f394a742
MD5 d54ee6e85c10705cdd6c1793d9e032ae
SHA1 3f93d31d091b5a55c4c1bec4b3d8a288c97718a1
SHA512 21755126a6b89496aa0c72905d5c30a183f2cb5e5f6de8494a06e98acc819f9a9bd4ece709586b8c18ccda353801f819ffacc6067a32aeafffac67e8ef1fea1c
SSDEEP 24576:yVbqPb88hv/l+YwgXe4i7ojhsP5Lgrk1TWb4AN5:yVO88hXl+se30jaNf1TWbdz
TLSH
T14A559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f2140befec8781f52f3957f8f9953aff895c1f9dd6de60a14b9ca5fa669c8de2
MD5 f756b4c4ce72d79f0fc14bbc87b8b3ea
SHA1 c7438e0f04b89b93ce5490f05af7cd127af9c7b6
SHA512 6aec06360437fff91714ac751abaa710843f228f5e2b0766f57b7ba06539290e5a442dab91440903bcf8ad5155982a8f17414cdf6338cf38b4eb79ddd8574787
SSDEEP 12288:kLy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kLrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D6C423929F5409C6F38FC3F4A0F7CBD1E9E11EC061448E6B47E0BA9358BC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 02c9a677981faac1405fe0f3cf1d084f66ad19a275c2157c071d1008a0baaac9
MD5 66c178520dc3cc1f26b584b61b502a1e
SHA1 495bc58dc07f3b96e8461f266f6c071cb6b836d2
SHA512 3139bd2acddcb8b750103d323f782ed4325b57e38f23558a1f7f73dd08fb9f6d5ed684d1af0cea85ed31a92cf8817de8c58a71ddb15ac04cdece0e6feb0f1f82
SSDEEP 12288:oeBNUbTVO86Ur0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oJIUIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13305CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7da9807f49f1c676a64a514cf69f61d589e79646e793a692e8f27721d768f561
MD5 486fb7cfce40b79bb1e61c478a18b6d9
SHA1 e1fb1ca8f83dde54549636da3dbca95adc1ef915
SHA512 19e0d8258af50604196092c81b1011ff51713cea7a55449a75fb6a7fda99cdba981c104222d5035ac57deaac07508ddeba4920dbb37c722112c84ec084f3bbbc
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:TQvGAdlCEL8c/DRNw5CkU023W
TLSH
T104267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2ba748fbcce9b816f804fea471ee14521dc7fe13e8e4af88baa050acb2a98ead
MD5 62939e9d0f3cc075e1438c7235b89658
SHA1 f8aa301b219ade803f0808081848bc21ba19812a
SHA512 32d0a3b18aa6b957d82b53aec3c9844e80973bd55d8d4e1133ed063ff846bf393f4c5b253d952b7c3b1f5c93dc257be3c7cc643d2c5311d39ea17ead386f3f4b
SSDEEP 24576:/0ewsAj6gXe4i7ojhsP5Lgrk1TWb4AN5:clj9e30jaNf1TWbdz
TLSH
T14815E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 35fe3a771c092834f03f68cf17a3f57818f4e2c0c5f0a4cfbab22297da89ea4b
MD5 a57d7288902788d5b18fed513dc3640f
SHA1 896af6ebdbe046cbecea1e0133c7502c9f04ab18
SHA512 bcb9789c836fc5f96fb18b4482c8a535bb20eba11f8bffdeadeff408b0de89d6d77fbb7b26978f22df8edddde2896d8bb1eb12888e5c1e64baf80a3ec06bc224
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVp4W:bUEtQevvqc2W1cpV2tI32H4W
TLSH
T196474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9400e59e23000ac1d94a118df641c9ecf70f069747b6c9b62c9d4bf53daaacb8
MD5 abe2193d00289aff4cf72437a82c84d9
SHA1 674edbe91538d98ff437301db2e1a1166871016e
SHA512 230c5380da9d679ce5c48c70b63cd55ca6e546b4ccca651172b3607bf254d2db8918e25c55655c96f149378d349c0f4b9a1dc40d8f7d84fc4f4cdb0e666515a2
SSDEEP 49152:9CbRquA/m2yL5zTfFiV+XenmE3/zde30jaNf1TWbdz:6oquVjnmIU023W
TLSH
T1D7D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7ce64716e0353f231643b9f0d7314d5d2a46f04a90a19e2de210e97050680aea
MD5 0fc700e52383e0d5553136fe8f28ed7c
SHA1 773a360bbf8556e574e339599e072b56d32560f4
SHA512 33f63f25131f3c27d567b68c38bcd73af29e63e8cd5f0a97b3b6bb2f2a0db41ce57bfee0085d0fc46f2a42d80b0e3d141f5f1f89bbc027723d719446c4383a94
SSDEEP 24576:aAhGL3IFoiwtA5l7S53tgXe4i7ojhsP5Lgrk1TWb4AN5:aAMUFoiq5Ye30jaNf1TWbdz
TLSH
T1D0359E81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 325f6776e4cf01f99ad66fa80e40df0974bb85429d463b2ce339b2546a72bb60
MD5 1c73b1cb4df46ff165e39f1c86760296
SHA1 b5af411a5422cfe0f08ff1b21be2914756f58f0a
SHA512 a5ee3c97293761cd5a37b861d1d2885f72024f2799c96c56cfa606b25b7219022e2f1ed84332864380303795009f7d0f37e734b20dc708e58a506542eb0dbb3c
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+Co0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:5wu4OWugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19405E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c3a6c460d6424e72f2c516ffd127619da235d1e65d826442e3e9cb411bc26b3a
MD5 6410c98fd3589d4065a1fc2debd67d84
SHA1 2bfa5f82f9d0d96b5d46f537ada7edac060489df
SHA512 0fb2df61987af4879904d70f0397ccbd3ed5acda2b73ef2fa40ead09099e08b884bfa608097437e8c20d2650b8995ab1b7f99094ade66b6c5f363a386b2d3249
SSDEEP 12288:DeZ1Iy90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SZu3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T140E4129627D421F9E2978278D4F68741E7B23882233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 18f8ebff3a2900c044ef858e8352f14c5878e267a7831d475e2d1bb37e34fbce
MD5 38a9e105bdd1fa3757cb4484d9432cd7
SHA1 b8abb82f99a16dfaa3a9d38403029155da9f7e2b
SHA512 ad00cadd716d089df8f81ccc268c6eaa5cbd0631fc44ad32ee0c45bdcbc70deda739c640644e29296be2efd52b9af10ddea94fb4351100c0132522e60bf71071
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:kQRQyi36YOcPbLvw2gAf+PN3jU023W
TLSH
T168667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9bd55b530b855100888dca99499c051a72417c0def6081dc1e05235ee6ac861f
MD5 e4b9d8bc626fcd88b3f086b19a95a44e
SHA1 83573424bd637de0444a2500b963abaf5f04a4aa
SHA512 aa57592569d4f5df61dffe94338aa4ea1472d04c6fbac3c049c7fa10f7d76d028e1c602f1f05d07f7428b53678067f4924444b76e9d957259d351739efcc49f5
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:GQRQyi36YOcPbLvw2gAf+PN3jU023W
TLSH
T1DE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 52382b5c1febf8b2aed5427bb979944c516a2240d93531b568604b76d11aa741
MD5 dd70622da9a5387764cbd296fb075e77
SHA1 b0515236454e21cad93fb4939487d35a3d057cc3
SHA512 66c5aac49b569829bd771face83be5cfd46f8ab8ab62fe00584eaf1f8eac5f6ebfc44db29b7ec51d9b86f05d760a67097318f2f56da66103c0ead615cc7b2486
SSDEEP 49152:w68Qg55nhceWu7PNU3/te30jaNf1TWbdz:qthLRc/tU023W
TLSH
T1D0B55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 df877e4c1f8af0621c06b10c90babcca121e85e29d0ccad9ed16f28e7009abaa
MD5 452ac0fa1afeb033fcea5dfdab3ab0cb
SHA1 25c039314046a777de105ca0df7fe1a596ef95b5
SHA512 f476d86f63aeb9ce38d118d1eaa8cae50854c84de3ad76b6768d72563db4ef0be6123d9f849a1260b1369fe6f88638d1da3908d00d233562188ed5ad08da13be
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99v:8y5112gYy5azzVvt69nLKnhZyU023W
TLSH
T16B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 60d10da7f02f4ab6cfc89110efc9770b5f3787af548c1e788c4273561d5bd520
MD5 40e9cb83f2dc7730ddc72563e140f948
SHA1 171e31e2ade0d272a5597933e09726eab2cbcc3d
SHA512 ba075ee7c1b373849d0367ef5c4592016e6a6dfa08490f0d0acd5a083a0246cb6ea9cc1abcb53630b238e8d573e1f143e3f4c35052123b88f05327f97191bbb8
SSDEEP 49152:iB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glre30jaNf1TWbdz:Qu6Jmdxd2drU023W
TLSH
T13CD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a44fc0e568db7104428dc75b5fde29c73f2d0d005457d721192c69e0e2455fc
MD5 5b7691d1a0718747f156d9a9d85720b9
SHA1 3c2e4a5f4ee86517bf94d952de53df78d999d59c
SHA512 8bcd6d9df5bc14ce2007f42857b1554212e5a63fec95291e99ad58f462dfb35c6c1fb53bf1026cfb74440919c746a210a7ceac36369f8b2a5bce1bd96e2c825a
SSDEEP 49152:B1hpsNoJpF1A63U44CwH7R4xfe30jaNf1TWbdz:BmifPWRIU023W
TLSH
T1CBB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7121f4cc060aed96ec23fdbde7af57443815e9722d23f910a0416d685a140c1f
MD5 84c187f97bf3eede50d8c64a26220ac5
SHA1 ddb7afcc41ecf3a58a7814bef52dd79585a83f9a
SHA512 02c5517c7ce04c2016b9b60cbb0e9cd231862b74d3a2db72cb711476b6c09823a13ef5e2c97d32b8a1b7540606acd716daf604e73c7f2568a39df5228920fc73
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHq+e30jaNf1TWbdz:D5dKii61+U023W
TLSH
T181C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2520c7b1a519e84646961d8aab69eb4a97c7fa40007c3e65bc62c9b81d2ae211
MD5 8e31c2f057cb56cdecb3fa13c99d1b89
SHA1 dc0ba2e0911b316274a930eb597c75ecaa27d255
SHA512 f662225d4fa73262a057581008adc1f51461cf6d45ef784ae202482c40330ac1ffe487d9dd609ed331c34b4c19548691d20675349a19651b2004b4b30b452647
SSDEEP 49152:GhtSn8EApI0fig3giDn0AP5w7e30jaNf1TWbdz:HX2imph8U023W
TLSH
T1E695BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0a564b4780003abda4b1f4161d668d90edbc65bc4d06b0b3955c9d3511dcb285
MD5 0fc69443f3bfada36a83bf8583d52ac2
SHA1 df3832d53e0bb7afa7ee290b1ff9a838d1014590
SHA512 ebb43ecc4e2b044102de1438b2dedb38932ee343b8e1fb86485f41bd18de43da02e69bb8cfd1f54c69ba400d27cea2f7c075f7071c4129536f93d64a6743ef6c
SSDEEP 12288:PK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13EC423919E550ACAE34BC3F0D0F787C1E9E01EC672444E6B57E0B9631DBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c341713053df896967a620343b5e7e98fda4fab7315278b7b255499941480f48
MD5 0d096cb0e99be7293c2af1ae6d55836f
SHA1 68607b16ca41ca25e01f23394775e7b7be9ee04e
SHA512 5ae37a0b6d7e53ce52e058ad46c79cf1f2b43df717a63adf62004c797ebe1022d2f58cb9cad7cb01980fba25a477abeb15b4adfbfbc0cb140edf214f6e8fba10
SSDEEP 12288:MJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C8C423A1AE5509C6E34BC3F0D0F787D1E9E01FC672404E6B57E0F96319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 84f40e27ee4a118e5be58028372973d91b4e8f1a2ce942ffe99acea5191fef66
MD5 1484b8a5df7bfbfbf0b1045d9e45c5c2
SHA1 9b80b10dd7f03e8dd3c16e08f7d8be49caeb362b
SHA512 ef5f11575ed6891edf555b6182ff62cfc173ec762895de785fca9e3c02888d2fe563db9879c0d8e8e73073cf266213bef524831ad97df618a34701ae06cfe355
SSDEEP 12288:Rj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C3C423A19E5509CAE34BC3F0D0F787D1E9E01EC672404E6B57E0B9631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 85e8d258cf57e0b654b299b5d973eaa3295bf860d9c2e1f9ec42e2af7bc9cb75
MD5 d3c4de258e63373671505d1240990d4c
SHA1 67439fe2e53f7a05cfc8fb8c26e75881c33291de
SHA512 bd7dd673876c57a5e9d75ffe82943d950c00ed4deffaa9c2d38da71eba29ac34fe4c3c7089506fa6d3c339ce7a0f06e4c1011e326a3da389fdd506fa8066c7c0
SSDEEP 12288:aVs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T177D423926F5905C6E28BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 211c0e5fefcff162c915e89abe93de2c18d532591c3cede3415500aaeb322cf5
MD5 57ed8e7b2af018b4334319a63c13fb40
SHA1 6de61329754fec5b2183bdcc8fd9a44d0edb5f55
SHA512 2bba2415656a4ef5253a8de2b76e939bf07f1b5db4536840c90a40f1c7c7e1c31553d4d2ad07c1a3c56151da3b7105a6742e99f755cdbbcdedbbc5f25299fc52
SSDEEP 12288:pU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:p1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T163C42391AE5509CAE34BC3F0D0F787D1E9E01EC672404E6B57E0B9631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 bd7bcb03d3a46d65eb287116d258bb5d751452b7fe7c9420ed1fa1184800fe9d
MD5 ab93ad5daba606d6b2267e1a80234962
SHA1 3789eb7a147dd8d4c5b36780d032b302a581b565
SHA512 2b07384c800f1b0af9a30aff7424ee914ab69e286f89d1b42d127f8c213a4212c269a38da000e972214de684a0e32e4984de015358a0a6813285f2631ab38bbb
SSDEEP 12288:ZF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D2C423A1AE5509CAE34BC3F0D0F787D1E9E01FC672404E6B57E0F96319BCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7a44a26b034f9d73b4c22917857f30fc994f870821c6adc20d4dec05bff971dd
MD5 007e5c105819d3c28c2a2e6a8156d668
SHA1 2fe49d17b71cbca136809815a596446f2baa8199
SHA512 8e6bee10707c3e2928ef7208a2b17eef445bec6fabca374351fb4518acd4cd06a73d5671670d1942adb5f9dea351de807688221091f0da83b17d3b433a0b0ff7
SSDEEP 12288:ox0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:o+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14FC423A19E5509C6E34BC3F0D0E7C7D1E9E01FC672444E6B57E0F9532ABCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 496ca8fd9913650895f673ffc3f6789bec0fe82df2261c24f45937ffc6f6fb37
MD5 a001b86cb503c0dc7e6e746945ee7397
SHA1 17caacffe6b2eda07e0502c2b25ec034e49ae2fa
SHA512 2003b5f45f26e2985d7360cbd9e15dbececc3cd64cf3afcd6e93d14662d888667733a20584227b76d65e074919dc7161e227ec91bfb1d19273878dbd4e81ce03
SSDEEP 24576:EZMRzFVSO2gXe4i7ojhsP5Lgrk1TWb4AN5:EZMRzf1e30jaNf1TWbdz
TLSH
T1EE050195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a283328cfb9a3a3f84463072ce403a292664d56bbc07b8a302e61f5667eb6132
MD5 89e7085a377a71ca501fe2d4a8c3121d
SHA1 8eb84f01d037d3a73b12436834f036a2c99583e4
SHA512 719e50ddfab9415da1cf3c58e3a10c79eda671c7238730289eb298457dab9f074fd4a4a2d6c94c8b7eaf90f06106bf27df69609efdc3882425b3c9bb1e514d1f
SSDEEP 12288:fO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T115C423A1AE5509CAE34BC3F4D0F787D1E9E01FC672404E6B57E0B9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8516009b0daeba81c3ee103fde4122d1105ec1aa21ddc4f9139ffef865d118c0
MD5 b5299262aa1e566d2e9f723c41d93605
SHA1 aedc0446153b56ad63ddea2db9e86dd1116f5880
SHA512 22ebcb626618aef556520d73d5679eb83cb8dd89b8fb72734aae9a6da41cd59eba8e37b788717cbf28bd0fd27d6b1f30119eb6f4e6d2f202e446c9032b94c2f5
SSDEEP 12288:CC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T196C423A2AE5509C6E34BC3F0D0E7C7D1E9E01FC672414E6B57E0B95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e95bf4f57baf73823d04f30019d172719c8d240c3b5471b566cd2bd2bef9ffeb
MD5 ce1b2e895951b5842ce359d5957d3e8a
SHA1 1642e99a313afedb1deca9d558194514c95b0589
SHA512 e83f0cc74308e7f981820b152823ddae5dcd0a7a081109b0085627149f847bd8c1007cbf920b2884d1677ff88dcfec260b14659573d66beffb8e7be3679d4da7
SSDEEP 12288:+yPz5L890DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jzyqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T146F4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 76a587b8b1ce090054da4fbf303fd55ccb7f1366ef0cee5b8232473815e5bf1a
MD5 94ced4f74a659adf9fcb6a57121f271d
SHA1 e8afcbf8769fff6515fa98b39aa450ca8eb6da03
SHA512 d0265d337ae772c251cd461468600eaf92ce644c0844688fd720ce768bed6c84315bd08777b0a76ba94a4bbfc497de7df1648440e269bcbc4bbd078c91b501ea
SSDEEP 12288:BO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D5C423A1AE5509C6E34BC3F4D0F787D1E9E01FC672404E6B57E0B9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f44fc56450e295be06613df63dda6211dd5d0bd9cbca5643d0c8bdb1eed0785a
MD5 249f8fd2c7a5e9a149b4396784919461
SHA1 8bddf99a137eb2dd9cf98721df91ca0a050dae2f
SHA512 fb5450d990bf1a8176e1234b352f3577e4c44851033010d36e63ccc6f3756fcc26573751a1503528071e63c438ffabce0032477e501e46291ab6d1efb450dd55
SSDEEP 12288:WO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T101C423A1AE5509C6E34BC3F0D0E787D1E9E01FC672404E6B57E0B9531DBCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e9750de1683d369698da6884f1c1e02d7b950733266b5161fcda2884f861487e
MD5 03c99779c001fdffd7d8da4c4d676c0c
SHA1 8b4d068e39def9455d94adeb30ea0da9abeff89b
SHA512 16d25fdbad3e82a9448133aa75952d93455c9ce4fd9d5e2ffef631457621408d8c3364a513f942206295efbe831dca5e0b1a7dfce5428b5106c4af18499b73b4
SSDEEP 12288:WyPz5L890DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rzyqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10EF4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 187bc7059f24c136bacd9f6d39146596045e5dbf73861614e9321b53feb6ad8c
MD5 32bfa6b96061812b719755a65a325203
SHA1 3dbce4c2352a51d4e50f25c0a8585ffb5a95bd4d
SHA512 98c9612ba561f30f00a08ff3cf0a953116c610d64017d1a04c21cf9e6da8d4c08945c863b77e71960ae7c63ef8171f6f791c538b0fb26ead7d98932038fad3af
SSDEEP 24576:+TDaLl3z0zDQgXe4i7ojhsP5Lgrk1TWb4AN5:+TuLljUe30jaNf1TWbdz
TLSH
T1840502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b737041f1a2dd0af84a4a7aa81b891360cb3c4a6f1645f25dfd7e1141320b813
MD5 ad5d0e3860761b650c3de5de1d7625ec
SHA1 47b698893debde741a84f5c143e0fdeea7576678
SHA512 7b36e0a329758e6605abde2ecb2233bcfa0c8d5dc541947ad21c296d67e295fefb224a72cd0a020cac1da02b96a3ad1dd8e00f52415e914b0e74d12573b8a0ba
SSDEEP 24576:C3vd9CHKy7GZMgXe4i7ojhsP5Lgrk1TWb4AN5:kvd9CHKya1e30jaNf1TWbdz
TLSH
T1FB25CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5a0abc8a0d8ee3683ee4f4686084356019c02ac17caa4afbba33dee5662cfd21
MD5 4fb678178a208d6f72a41101b12c806f
SHA1 16a6b0b40aa64159eece4d6b118706298c613b3f
SHA512 d4590fc441ee5a199b41f4bc59a732cc8e50f69c81d5dac0906067d60a8f00b86bdbf6b7db50b919825ac7ac5596988ec86bdddaf9979e4cfa2e889b4ab230a5
SSDEEP 12288:LD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17AC423A19E5509CAE34BC3F0D0F787D1E9E01EC672404E6B57E0B9631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 9bbbff667de8cc5af446857f3168a7913ceca0607a87a95d0db6700039cd0b96
MD5 f896d2a7df57fe7037d19db2c1183322
SHA1 72d2d28025d249aadccb009e1218a14dd251ec8c
SHA512 388b39a8c6a0b556e7df73c0895c484a592f5ad91763bfdf48eb5391c0423edf230bcadbff44c85b45b475c51334c30d6acd915973529afc83509f90417bf17d
SSDEEP 12288:3d0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3KgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DDC423A19E5509CAE24FC3F0D0F7C7D1E9E01FC672404E6B57E0B96319BCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 afb872898c6431e0a9fd36f2213cfef90a06b7c8448a28718ad2255292510ce3
MD5 cd97c411a444892674978c598f00167a
SHA1 b2b97b14eedd721cf7473e24357ef6994dba6adf
SHA512 dc678adb19138b453f7f19cc4c7cb70700f43512075331ea6f7948ee5fb0daf4a14545a0ab140cd5249342284e3debb05344f68af11c681eb42171f074660cee
SSDEEP 12288:1Q0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1xgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T107C423A1AE5509CAE34BC3F0D0E787D1E9E01FC672404E6B57E0B9531DBCC996AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d82df3e8e4a4ed868ab9c23221b457ebd329c2b0493fcb52def8174757c97104
MD5 08cd5f5aec322e3c2caf594a62a4918e
SHA1 8b425d98800c1184d28d0d226d2080645bff9d78
SHA512 18f2b7ff04dc6cbe7cf10ba1f305d674e0552ef94cf5a536601f9c3d52e0acf68a947120ed1e3c8574b7581b5a123270ba7e8b80cf14f2c13c61b4f425512975
SSDEEP 12288:uO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ungXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T106C423A1AE5509CAE34BC3F4D0F787D1E9E01FC672404E6B57E0B9631DBCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d44f1997f956de63fee24f18f33a79e91de63cb8eb7eaced05311cee61a9df81
MD5 e99ca344cb6f4b2a56d94e10aab9e106
SHA1 79c7c0c5d78bf0a617222ce985d098408b6e4156
SHA512 96cbd86beb0d382fafabdd25688028ac04dbbbdd0aa62f24ae549d7a316b91858be1bfd2ec0972c108242d5b108d5abfa1d4cd32174372083fee32c1c70486dc
SSDEEP 12288:QD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:QggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T130C423A1AE5509C6E34BC3F0D0F787D1E9E01EC672404E6B57E0B9631DBCC996AD84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d4a1408d5e6c3a0ec9acb14dcd326d49fcb60cba4ac516960fbf1b9befc59bec
MD5 552a27fd3bfa727bc670a2c835c3953f
SHA1 6c3b7c13524b2a846a59a99221901514c7752ba5
SHA512 fac9d8505f2ce8f1c2851ba5170984e7107e7e5b6c736dfea33bc80cfc0c479dc1df290cabf1cbfd514a62d78961f45390fb623c6fd86aaaf353135dbad4d3fa
SSDEEP 12288:+W0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+PgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A8C423A19E5509CAE34BC3F0D0E787D1E9E01FC572414E6B57E0BA531EBCC9A6AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 68761e0274e6bbadc1732539c72604dea3352d4ad736a88381a73f05bf796a0c
MD5 b42f54727f83560041a59da99f51251b
SHA1 75cc863835ef69d64aeaec17d16b2563a3d74445
SHA512 0d14f67074fb950b751060747d5c59d8738ca19acbbc40340d29c27b4e54be3f8c9b75444d32cd8d5552730a846431b242c1cf4b568149941e37a364631fd53e
SSDEEP 12288:FU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:F1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T111C423A1AE5509C6E34BC3F0D0F787D1E9E01EC672404E6B57E0B9631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 91e96abe3cb38a3ba8220dce7470b22384d5931a45f1ffa7ef78eac2f1f34ade
MD5 331397516e9678817e7d57412c24ede7
SHA1 f41a03c83fb84d44a20261bcd95cb9a5a5791149
SHA512 a5c54ffd91d08731e1a89ba1bf2136559f6ce71ab3d57b93580726935cf535696bd0eb24b002c48144f98fd2b688d42099c6a12576fb5cc7f87ed6f7e9f43ab0
SSDEEP 12288:U70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:U4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T191C423A19E5509CAE34BC3F0D0E787D1E9E01FC572414E6B57E0BA531EBCC9A6AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e98b57976342804cbc2b24063e5b08c21585fc2a9f4a301213946d2aee2d5563
MD5 c65491ed0a2d3d0ef0f87567b75ee0e8
SHA1 82c0e6f09c5ce00aaefc55226b0210adfe98378f
SHA512 7247d4e19ce428999a55cc600fa78d091e6a137a22577fc37931301fa1bf306a4cafa2dac6827c2cb650e09e4c0600181d22f807131fb1120446ad24eef5e052
SSDEEP 24576:IfwvUk9RX6wkyAILgXe4i7ojhsP5Lgrk1TWb4AN5:cMnYISe30jaNf1TWbdz
TLSH
T12935DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5da22f6d2c916bd2ba474c4bf3d39bdf4efec499cd75fe5ae92231677600f751
MD5 e88be0885c7f6c8f27f3f2368f0e76e9
SHA1 af6950f6e0b0cc11b9203deda261eb722f68ea15
SHA512 61899ac70b6356a15cf2ee5807b531b8ef1cad1b3932b700efe19e97e84b458e09d7c709b3160fa7b86baee3cbe8191d08c6517ea5e68ff49b796690e46ac730
SSDEEP 49152:KYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0be30jaNf1TWbp:xySzPDU023W
TLSH
T19C067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1bad04bbd57e994779fdd43cc60886cb4ba5bf223632e67639a92eeb9efd3ce9
MD5 2380924d41d7135d5aa1e4228916deaa
SHA1 262a8d82ae6aaae156de02a8cda7a77299520ae9
SHA512 472574f33d9486e8ae8d1f19e2c28af7085df83e782224c0e6bd4e33a964009ce8bea78748a7b7b6fa66164e5e8c6c3f7ab93051fb75fb89cc543e68002851f7
SSDEEP 24576:X47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmgXe4i7ojhsP5Lgrk1TWb4AN5:X47JUQjTirIhCnDHUPfF/re30jaNf1Te
TLSH
T13165AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ad7cf0b9fc990e514a86d2512b942ef083eec37ccd0a7ee5828b472c5d38b80b
MD5 ececd22d8f78c65bd22b02cd75d4f650
SHA1 cccf942dce6816210adb2241d1947cfc713cd8e1
SHA512 82b4bbe9e81e6040ea534ff148fc648e2667c11a53c5fd83a1cb88def79c96801029198e670fcf673da0573ec9feb7b4a32ec566cd7a10929959a5186260a910
SSDEEP 12288:9bsf+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Y3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14DE4F15AD29802D8C06E92B5C3968A41F3733C5193E1C7CB53D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e3e0aff0f0088fce118b76223273ca46f700019b897c5ff25ac1cfba461c389b
MD5 b5aba3de6e07e00d3b6cab74049410d9
SHA1 585780970e345d37d50b671bbb894be3514fb36b
SHA512 5f2eb13144fa062595b66ee9b6c0e8e1f5fcb4b709f06a1f9280a7c6836dbfbd0d1eef0b6331e2d42b83e800f28f0c29a21f5b04ac0faffaaf00a8d709fa4b98
SSDEEP 6144:jtsBC2na2rKL4rERifKDexHX4Ty50wCQJ/vUkOdImj64G4K3TyBrY0flsiurI08Z:jajmCsy50qJ/oR64D8QY0tsiurqUm08
TLSH
T149452851762BC75FC6A940326E36D1CCAB707D05EE456B0372C88B3FC576668BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5b9d09560157bd61752f1cdd68b8d55a9b317554a341f93792220b97f88ae9a8
MD5 8ea8da564335c9f6403d08fbd0aa5173
SHA1 4c9691f958cb8cd0d171623582f8b0fd7e08b937
SHA512 34616701e03a23c19fb837429a5c0f7635586c492fb61da4e093a5b67467e054986608307018fa722993251017a818b86e74b3037decbe3e09f5f1d141640104
SSDEEP 12288:hRy4f5QffxjXX7Fi07P/mu0/K+PbOio+nRs5BVB3kx/QlZvRbBE9:gxjjZBBy
TLSH
T1D765D7416537E38FD1F76032072AAB4DA774ED03B7096F267388053AD86A765A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2a2861cf54fb112673d19298654041b8238c6c34d3cc2d05f532e471d7338990
MD5 07c24ce62473633d967cd5b4eac9e977
SHA1 2b2365e6997bf20da5ab7025ad4ba1f06e1b010f
SHA512 7751ab6f58cae39e583212f6f21cfe052ede3ba4790d8348309f3792d4bc7d369d2eab856950777d4f36eb9ccda617c326020e575c553aa8292f2752ca3b936c
SSDEEP 12288:A07G0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12FD423629B580DC6F29FC3F090EBC760F5A53EC0670089EB96D0B69319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dba6fae2a040c0d9d54f1c909954b83efa8dc026b38c1dc38ae76395ee8dafb5
MD5 1c0bc9b1e2444205ef9e1115b76f54c4
SHA1 78ec9ca3317129b2552f63d5bd85a4763c441c1c
SHA512 983b6f052413acaae89bbbe8057cb39605fd2590d83a81f40935de65079862faa9d6f923e0d82259b58f8fffe52eb08e0f6aff57f6583c00674d4e279b409ba8
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYpgXe4i7ojhsP5Lgrk1TWb4AN5:Tgb4mBIBhGFpe30jaNf1TWbdz
TLSH
T18065AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 832038a45b7c7e4d338ee454bedbc7e56d86af8733e029254ff1aaa0d5a927ab
MD5 34b782248fa647a3d392810d05f1e80c
SHA1 7e239374cd712019c34a7fb56e07c2dc3bb1e5e1
SHA512 4009cafa1cc76c63d39712b8a0f32823762b787e59706d8b5c15c04e2a8385e7bc19b595d4cc1ce431b8c4330cca53151986e35a868f0f0c6e631e3b191b27d2
SSDEEP 24576:DG88u8FpJqH1bzria7/m2gXe4i7ojhsP5Lgrk1TWb4AN5:y7ZFPqVea7/se30jaNf1TWbdz
TLSH
T14F35F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a8a05d518ef2dc8f86ce5f5c58391c291dcef21b130694649ac838edbd2b5857
MD5 f830cfa84b74bb0683d10700c7ccfa16
SHA1 52cb6c278c042e1ac3dd034c176fc5558b234f04
SHA512 568bf975628ca6dd7f469e02fa06b2ceb92d9a37a0ef2e69e1b456d62bfaa254515569043ab78b2071287ff9351e8e01b17c404d752187b087d19a7dfc40342d
SSDEEP 24576:sPUr+NQigXe4i7ojhsP5Lgrk1TWb4AN5:sJQ1e30jaNf1TWbdz
TLSH
T15605E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a6b441f3c0c698cb11181999abeeb10c328a7998cc7d0d71dbb413361952e025
MD5 ec5b43ef21678d8a190ca0436e6191d4
SHA1 b1cb4a66f51d51dfdce521d75f3f40403b697b11
SHA512 cd1b499f9a1e5d5e82d9b9c14d34eaac1fc2834721a609b7d7e8c899516a38d8ec41fd363e35d12c42b2054549ecb22afb2f18b99ba17fe39d7d6f216e9a642a
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjle30jaNf1TWbdz:YG05lO43bKU023W
TLSH
T1AED5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5d853954bdac4f8fbb9efb8d29bb91cb9dc5b218e2b1c045de42a5cded1c0a40
MD5 1ab952f98ec628a65d068c48a0bc59cd
SHA1 a0c8441ea968aa8fa8409d0eec1bcec020151ef6
SHA512 f40bfd5c05fd5420b6dc350ec3e242ab8b4f6e222c4e8793ba6ebcf33aca3087b58844fc5d4c600e7f5d9bb21e5de87b3ccedf9d62c628fad37f123041959270
SSDEEP 24576:0fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnUgXe4i7ojhsP5Lgrk1TWb4AN5:sa5POZ3BJt2pasx2+mte30jaNf1TWbdz
TLSH
T17165AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 93bc49f18cbe9b0a88a42cd5118df2c792a3eef0ed26fb1944f99dd23b95132f
MD5 4ca5aeb3ad8fbc1bc17d4f1e72700ee4
SHA1 8a9cf2f17f7526f54b3485bd2a76fb7b23eb226a
SHA512 0453ca145cc908429539032711d8ac0dffdb0cc3b1ada2d24a52b72ebddcf55025ed5975eecc5eafbfeb9291ea77518c9e2aa60e52a62ce8a2b1a09398838971
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkOgXe4i7ojhsP5Lgrk1TWb4AN5:qNc/zEOVHFMe30jaNf1TWbdz
TLSH
T19E858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 30206bee7993748321e21a9ece44cf399847a6efae5ea5f246e65ba79f9b5b77
MD5 f830d665ab021b1c292a8837993d72d8
SHA1 4dab9b65f4d616a0fc6cd1dff73bb40d99c94dca
SHA512 746897a04c78b825f93aa3a8accb725a593fe35d0a29602579f6258c0428dc45343a5ed2bba594b246eb8372e922cf4687b12cf1a4381da5f6b9af1d392dcad8
SSDEEP 24576:sTkNvNnaFeYhJNtmZBm4gXe4i7ojhsP5Lgrk1TWb4AN5:sTMwBtOmPe30jaNf1TWbdz
TLSH
T19C55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0bdc53704250f4ed07a8412a404ba0d2139a8a9a07550d086146a20b344f0e10
MD5 fb085c3db54a5237227225947a860430
SHA1 459509033eb7fcf3ef049547ca40ca9eb714ceae
SHA512 7a0180f620745900e52060d211101761d66adf2ce497be7e0692f4974202632c72f45062599a4b6e2413d6bf33eb91a059a57f228f8139fd2bc863f8628d9ce6
SSDEEP 24576:pD3FHshBIYQgAjgXe4i7ojhsP5Lgrk1TWb4AN5:pDVHeBIAAae30jaNf1TWbdz
TLSH
T1E325E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-73-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/548-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/548-298-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/548-67-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1444-114-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/1444-306-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1444-108-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/1444-106-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1452-314-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/1452-311-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1452-7-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1452-9-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1452-1-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1452-80-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/1452-0-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2692-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2692-120-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2692-126-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2692-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2692-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3032-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3032-273-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3032-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3032-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3128-365-0x000002378B460000-0x000002378B6EB000-memory.dmp

Download

memory/3128-366-0x000002378BA20000-0x000002378C0A0000-memory.dmp

Download

memory/3128-405-0x000002378B460000-0x000002378B6EB000-memory.dmp

Download

memory/3128-406-0x000002378BA20000-0x000002378C0A0000-memory.dmp

Download

memory/3912-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3912-303-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4104-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4104-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4104-82-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4104-375-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4104-89-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4104-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4484-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4484-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4484-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4484-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4540-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4540-47-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4540-40-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4540-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4540-50-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4924-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4924-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4924-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4924-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4924-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5372-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5372-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5372-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5372-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6040-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6040-101-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6040-95-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6040-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6040-307-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6040-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download