f8b540964525448b77371033b23450dbfe9eb16bcd342d2007501c737ddb3b65

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
Size 2.0MB
Sample260928-e7w8javdlc
SHA256 f8b540964525448b77371033b23450dbfe9eb16bcd342d2007501c737ddb3b65
MD5 73d8084efac3e1ad384c257253075b76
SHA1 4cd1c6f2ce9e5e90d379f72c10783f077a4590a2
SHA512 406b32fb044734acfd0219d127e8eb4d91604e54e8cdd682be63d2f95f67d64e94bbb905df4b80089d377c26461dba26a4a90b336100cec4ed538f691c260af7
SSDEEP 49152:AOWmBmmXXozsr8zlLwJIhG6H9lSLkb/D+klGzj:KmHwFRKIhFHzikH+cGzj
TLSH
T139A5D0606A0509BCEBF17638DBDA421593B23D51037649CF13D07F9A3A37AD2BE7A211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4892	elevation_service.exe
5160	maintenanceservice.exe
3472	SensorDataService.exe
5580	ssh-agent.exe
4920	AgentService.exe
1200	SearchIndexer.exe
2872	elevation_service.exe
820	OSE.EXE
5480	PerceptionSimulationService.exe
2348	perfhost.exe
1748	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 52 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
	\??\F:\	ssh-agent.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\vds.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f4a41efd7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ssh-agent.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ssh-agent.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093af-324.dat	upx
behavioral2/files/0x0001000000009337-323.dat	upx
behavioral2/files/0x0001000000009952-326.dat	upx
behavioral2/files/0x0001000000009cfe-357.dat	upx
behavioral2/files/0x0001000000009cd6-356.dat	upx
behavioral2/memory/5480-384-0x0000000140000000-0x0000000140189000-memory.dmp	upx
behavioral2/memory/2348-390-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral2/memory/1748-408-0x0000000140000000-0x0000000140387000-memory.dmp	upx
behavioral2/files/0x0001000000009fd4-407.dat	upx
behavioral2/files/0x000100000000df21-389.dat	upx
behavioral2/files/0x000100000000b974-383.dat	upx
behavioral2/files/0x0001000000009b92-431.dat	upx
behavioral2/files/0x0001000000006215-432.dat	upx
behavioral2/files/0x000100000000ba3d-434.dat	upx
behavioral2/files/0x000100000000a0ce-435.dat	upx
behavioral2/files/0x000100000000a1d4-436.dat	upx
behavioral2/files/0x0001000000009371-437.dat	upx
behavioral2/files/0x000100000000a304-439.dat	upx
behavioral2/files/0x0001000000006223-441.dat	upx
behavioral2/files/0x000100000000627a-443.dat	upx
behavioral2/files/0x000100000000bd4d-442.dat	upx
behavioral2/files/0x000100000000a319-440.dat	upx
behavioral2/files/0x000100000000a2c1-438.dat	upx
behavioral2/memory/5480-471-0x0000000140000000-0x0000000140189000-memory.dmp	upx
behavioral2/memory/2348-472-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral2/memory/1748-473-0x0000000140000000-0x0000000140387000-memory.dmp	upx
behavioral2/memory/1748-482-0x0000000140000000-0x0000000140387000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	ssh-agent.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	ssh-agent.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	ssh-agent.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ssh-agent.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PerceptionSimulationService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PerceptionSimulationService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002a33018034fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6f691d8024fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008096c017034fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4076	2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	4920	AgentService.exe
Token: 33	1200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1200	SearchIndexer.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4892	elevation_service.exe
Token: SeDebugPrivilege	2872	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3580	1200	SearchIndexer.exe	95
PID 1200 wrote to memory of 4888	1200	SearchIndexer.exe	101
PID 1200 wrote to memory of 4968	1200	SearchIndexer.exe	102
PID 1200 wrote to memory of 3096	1200	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_73d8084efac3e1ad384c257253075b76_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5160

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2956 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:820

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5480

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2348

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 05508e0c61cd9eaf5ab81005bf511b54fc39583fc43aecc888e52fcf078f3d74
MD5 33691ec310e30d0282df6f1ebc104dae
SHA1 81b8d53374b64331baddfb446a31577f5c448a92
SHA512 c2fd3b0e32c48a7099c75b4f754136aff6d9b44f536e609b9d8ea49f9460c6409357a6b3a2c94dfeb721196886244a31fe712f8ef8cc442f18743739a4aa3c93
SSDEEP 49152:cb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnHXozsr8zlLwJIh:G3q60jBmwFRKIh
TLSH
T18FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 be6dfc62c33e1c4348e25bbe899f407b2a6b73df3b94f2dcd4e2d8a15e1136b8
MD5 512f6be38a0994760c31e45c3f964b3c
SHA1 e0b24063ee2ab1902216d99d1edfcaae4465064b
SHA512 22945b4e43e3ae6cc4a8d22af79f58990ae26e267140440cb3a4077fb76fe4dff1ed2b84366656ff7e53fe54e85b3d1506e9d72943cf21e9ab37c7cf9749adb0
SSDEEP 12288:A1XLsswWkxy2lRq2czAYksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:WXYfDtczA09Xozsr8zbhN6GwXOGIh4
TLSH
T1A4850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.7MB
SHA256 ed9e91eaee292dd9c141754f936f23833fd7793ab6e709991b7779f4af040b36
MD5 771e5ab4d9fdb8bfa60e970c37adba18
SHA1 061fb0d3a396f3096d56728ac9b80ca001cf590a
SHA512 f6a82eb0f7978c063e85284b32b535f437590b7c190c97062a6fab5cdcb6dc80c9f3a30b563296e436e74121fc465c9e5e6b2bd1dd8de39e4e3574c67f289780
SSDEEP 49152:+G8c0uKAXozsr8zlLwJIhn6H9lSLkb/D+klGzj:N8knwFRKIh6HzikH+cGzj
TLSH
T177D5D026F6748731D073C0B9C5D2A68EE97230865B308ACB0296C77C7F676E69936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 37150fa5c5a934ec57555b5df2af07201a653de687d784202f6c99c2b283c164
MD5 4e7c35c89fa9afdd1828dc91eaa060b7
SHA1 2f96e1cbc0f3a6f12b64f58c4f55e8d2707c21f6
SHA512 036d56c84d894bdac4bb9607a718ad4dc9be00d6ccbe9d7ebe448fc60da5cc9edef634b6c129e018b7971b82469270fa7844555295163160ad5744152ad963b1
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWr6q8wyu39Xozsr8zbhN6GwXOGIh4:5/ezSC6vUzPviHjyUXozsr8zlLwJIh
TLSH
T18E755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9b0990c456f542301d23c0bd4954778ce5e0275db7c23e6d42bb133660136ebd
MD5 efad928cd7a193ab5f1afc45d36be525
SHA1 2b778ca2646faabea33e9391aa2bee05f3057eec
SHA512 68e7b628138eddc0bcbf372b5b13df9cfad8a7ce7213072dccea9cb362cae0cdba5df482e56cd7fa813e81d63ff5f4212365dfad44fee4af0bcd6adac07eafb1
SSDEEP 24576:FVbqPb88hv/l+bA9Xozsr8zbhN6GwXOGIh4:FVO88hXl+2Xozsr8zlLwJIh
TLSH
T1F755AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 9c8d54c0d179885587aab8bdd29dcb4ee9dadf7c357d89258223355ad840c453
MD5 0e975df7d0a5d07d275a25a3b8071260
SHA1 93d3b6e6854ce7b0b97875fa8bd61fb015bbe5cf
SHA512 5f834a9350e7339b050db6b16d509658a07e38fb729795e0e414725f7ed07062f52a021d5696afbecc8df3185e0ed7b7a50923db386d855765af3e06986f9e50
SSDEEP 12288:kRrksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kR59Xozsr8zbhN6GwXOGIh4
TLSH
T1076523B7E691A442EFA71F3139916AC4DEA7FD9E49811B4112382186CC7E476FE31332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 7afca6487b234cf265d6bd149df85906d01253252304382c5bd2ca85b843aa09
MD5 8c8b9217b696f05ef52f93ab6be3e1f4
SHA1 a1470d47bd0bbca45af68e568751f8403baf5b09
SHA512 cb4c2c6594e76980481d71bac147c36cc5e4e2dd4372c5aa8cdc0e673cd34ab65084c8da98b8fb2ecdbd4abef436d4516675e0db3eb22181ac9126693c2ee859
SSDEEP 12288:ReBNUbTVO86UsksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RJIUo9Xozsr8zbhN6GwXOGIh4
TLSH
T1C685DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d6d02a8338a29f4750e5ce6271ba55c56b133a030ddd8ccbe5b23ab1df70dc9d
MD5 926a6aade575c663b0c73ba0b6c6b145
SHA1 744fa903efab0a5edd390e101eae655f77c258a6
SHA512 ab27d3ff5c7797834848ce6e1c5a6056d92fb01474ba78161f61f1b0f05aebfba6f979969b768ccbfeef638127708f0e87fe93d3141bcf8d1a6093e3bf71a7fb
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THl:LQvGAdlCEL8c/RRNw5CBwFRKIh
TLSH
T10B267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 db030d2331aef30f798293289840bee513eee2ff43c3e8e998144f590379dd18
MD5 f4a04d40294dd342ff20e175d93b3b31
SHA1 282d4009350fed72d22dc2748bdb9016d27df6cc
SHA512 7d5d1185c8bd286334a7ef336017e6a4bc0b24454d3248c76b30131911b1d8f23be5c954c0e4c507e9ea6478ba3e3f8dd4fd0535f180d7c3ccdaa9bcd576ca59
SSDEEP 12288:mAwSfxL/2Dc3VDLLmt0LDQewsAjOksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:74ewsAjC9Xozsr8zbhN6GwXOGIh4
TLSH
T1A985E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 def748e3146e552eb8b50e1048fbfede31c9d2371e12f073f1af58d58f841ed0
MD5 97b5abcd7a9f81fcd4ba85cc3401b9a4
SHA1 0b7958eac25d6c4dc22e1b14160889f32dffb64c
SHA512 bb2f0da9efe0f8533e6c10e94399f550a97c70b21d51343e64ebf1c4ec1bc8e86d8a9ee234b5ae516366033c7272e0cc0202552c30351bb045d5f383ecdac357
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH3DKI:QUEtQevvqc2W1cpV2RI323D
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c006ea2db8c4dbc88308380909d3fae0849fbd68b727abe3ac10623d74603c13
MD5 0cd2bf62f4d27223d38574f18090b450
SHA1 28c0273ee05a8cb39f5f6ea4464dd36a6b8d2fc3
SHA512 4da17e3c2b138e7b52d291a2f2e7921aad31256893703c94c2523247ab1ec9388baa3e0fe8d3b8a2f36b4733c1acf552776311150841d63bb4fbcaa960b90c53
SSDEEP 49152:iCbRquA/m2yL5zifFiV+XenmE3/zwXozsr8zlLwJIh:noqHVjnmVwFRKIh
TLSH
T147D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a8258ab3650a596d8c8d351199ab1acfadb0a79b65c57d67a131a3540368088b
MD5 b867022ce4aabcc129bf58dfc2571296
SHA1 49055d18bd9555387c1e9568afb796795019ce8d
SHA512 48fe8efd8dc89d694148c7d3d03f0d5302faa102f6acb8019263b4e03ed3830350f11a70ff7a4fbaa4002559bd31df1239eb87a4928849dd528f6d8c21076843
SSDEEP 24576:dAhGL2IFoiwtA5l7S53b9Xozsr8zbhN6GwXOGIh4:dAM1Foiq5BXozsr8zlLwJIh
TLSH
T1DD359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 d266de0211ed1aeaa6b0e018e36356be8be04decfca540e894334e99c0c61edf
MD5 4d9fe72c4a5f4286e88d940843daa841
SHA1 ab6d294bcbaf61696a62dc344d66b38ba7dcfdb3
SHA512 36709fc8e4701ccb4a368d422f5af4faa339bcad1e7f8a35df795a47fe9fd853f2ab2d8b42b0d105039e833233c0518f2f74ecd201e33f1decbd34be093d1734
SSDEEP 12288:SZZ1IyeksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0ZuF9Xozsr8zbhN6GwXOGIh4
TLSH
T1BC7512AB73E020F6E6A3473998E15A44D7B3B857577203CF1238025A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 43032343f108f940ec968e5e3d32769d171ec7c9fa63cc24b2c2db73002e8d87
MD5 fd079b849a727d6457fdcc832ce26f55
SHA1 1151b8071a1a5e34070f5f3be68cc80ab7635761
SHA512 3117e5aa819742084b65baa147e2b388d2f5a2e8d2e7496272146fafe71cdc8b37cedd2496b7a6a01dbb223d075c39b83759496cf1f052dd680f686e709a1612
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UB:pQRQyi36YOcPhLvw2gAf+PN3SwFRKIh
TLSH
T168667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7ed3eff908d6a3f3b6df60cbcf995fbb407a246ebf7440e9d604edb5b46b859
MD5 7c5d352a9480d3eb7f83b9f61553a927
SHA1 3a086228f492a7a60dfdf68b458902f5d11c1142
SHA512 ff6137bee69aa8a5bae40b1b320af79f5ff776041178fd0b0f98166c83f6ecf9cd5bc46566724547131cd8061c07c90f658b7cdd1e00740ab51b7a77af898729
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UB:rQRQyi36YOcPhLvw2gAf+PN3SwFRKIh
TLSH
T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c7895826513f8ea262467e629e39f43e43081978503501898070aca175ed0e3d
MD5 a2ed3fe6e41e7cc9c5077687c321cdb0
SHA1 da3e36f2f51cdc6eff55d86222687f0831de5c33
SHA512 7f40d579d6a8254fba3a565041407a5d211a7d84c181d44a5dbdecdd6580639104bc5b3677fcd96a3e1b744a8a78a1e425c888223d7e77e6fd7966244558cd4c
SSDEEP 49152:e68Qg55nhceWu7PNU3/AXozsr8zlLwJIh:sthLRc/gwFRKIh
TLSH
T1ACB55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dd73070198b223828e0b40340bf2850d9e133619b27785d8443b4fee8abd3089
MD5 d855d5546004fd30b78ab778cd6875b2
SHA1 61eb177a683e55aa16ea5f03c25ee2632905b8f0
SHA512 ad8100d3bd4cf377687fdfa81c353182817ba3fe23f59f2b0372fabbf235d756539dbf1cbb832a763e06615d6bb2820c7fef6211953db07db4359394089c9c07
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99v:qy5112gYy5azzVva69nLKnhZrwFRKIh
TLSH
T147167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.5MB
SHA256 a64a4eb5ac9e4db9060c336b2a8889349d8d060d525c35f0e69b25727da722d0
MD5 a3ab5cf08a2975d4384064598119416b
SHA1 e260ec5565e720c402a99acdbdbf3cb6462c6f22
SHA512 e9105e4254a29b77a9c52c87f215a2c3b0740fba4cd3e8d8ee5c41b1ef9f55fc32ab81cb8a9a7290a8b5ff2ea2c610863ae4c712968d1c2289fe48a7feae5cd6
SSDEEP 49152:LB+taZ3usBWOBr4tEGF0bqx0z+n217aau1gli6H9lSLkb/D+klGzDXozsr8zlLwG:du6JmXxd2d5HzikH+cGzjwFRKIh
TLSH
T19906BF13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.5MB
SHA256 a6659f39d565565d0984b151f76274cfb2ce45cd4f9f0adcd7e7725476e02afa
MD5 16fc2467434eb621dd5555b7c30ab96e
SHA1 0ad3a7c0bd001109f7f02c87310fb8f82293a101
SHA512 a1ccb001cae923e535336a13f1a87cf226e5dc59db7b84983f1fefe5e4b467ee94dcace2527294be950bdd46363a935afdffe495d8146272fbbdcb285cfd00d2
SSDEEP 49152:iB+taZ3usBWOBr4tEGF0bqx0z+n217aau1gli6H9lSLkb/D+klGzDXozsr8zlLwG:Qu6JmXxd2d5HzikH+cGzjwFRKIh
TLSH
T11506BF13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bd41e9dc2e6f8a1ca0418e6d6dfee26b1994662209d16eac1b191a04b9ae2535
MD5 2c1fba6fb5dc50b7df1c0a6ab1a524b2
SHA1 d3c5e0a834a6c26ab8df4cb040298323486ef18a
SHA512 a541dbaaa342ffd46eca170c751331df25619a0c309bdf7505febb486cac4ac851e73e525a23d174939067149d8b82343da4731eb915f0f390769b19fd36ed36
SSDEEP 49152:h1hpsNoJpF1A6BU44CwH7R4xyXozsr8zlLwJIh:hmifPkRVwFRKIh
TLSH
T17AB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a42d31d0b4ba816afcfdf436225b8feca3dbf6b79fc92bdf464ff343da67c078
MD5 315f68e765ce22dae5e5219d3a3a930b
SHA1 7cc52347feaf273bca74a22dfb1f3d4a2a3057a1
SHA512 f25598fcfc2c65fc403f8735777aa13a925a712e27ba6fdcf75ed0babb282e3c7356635b90394a4daac50d13ebb132f55fa5a3afba6de913235e6b4e04854013
SSDEEP 49152:ISuZQIY0Be2KNRVtOnks6NMHqXXozsr8zlLwJIh:S5dKvi61HwFRKIh
TLSH
T1E9C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2f65bf065494df5aaecd49a6de9781fa23e48b1820d859084e918961b10bcd1f
MD5 455073bb42cd4044a19bd423ab61cb84
SHA1 aaa6b048e5eb6849b5926201a5ff317b48600bbf
SHA512 a19cad918b7ad2a7fcbbb14f9a8982a9eb2b83c92012a05eb575146d277155d6fdafbe456c4097a459865b6ba7581435ae11d7cecf8eeb341a22da0ba9b811f0
SSDEEP 49152:thtSn8EApI0figXgiDn0AP5wuXozsr8zlLwJIh:8X2iyphZwFRKIh
TLSH
T19195BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 769bc7672193de488b494ac66ffa33f6ba5a27a63d0daab919edd9878362f4a4
MD5 dc3e84ce6e0042cea02a60e8b199343c
SHA1 cc5c57cf26150a554c58f392da201cdbf7407b75
SHA512 23bd9c1f4f4942a38a2923b20db0fa0c45104edf91be554c7209f4cb5287915ced92f0af08faf2de9e44b9d2d6b2cedbda4700c67589dc0f004602588471bf5b
SSDEEP 12288:kDksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kB9Xozsr8zbhN6GwXOGIh4
TLSH
T1286523B7F992A442FB575B3129811AC4CAA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 07da57a6ae4df7f79c0c58c632939df5a977e66e8299af2dfda5f1d4f5148c08
MD5 d7ff32b70be057813a2642ec8355f127
SHA1 795132b177a69ec9ce4fc6c289aabb0d5fb0652e
SHA512 7c0a9d721098fbfe9885df1500296d4f8fcedd8fa7e2d2de5437d7710ca612767af475accc73f20b447a35393020c3bc925ddfd0830f4aa5a5cd7bbbfbeb0487
SSDEEP 12288:5qksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:5+9Xozsr8zbhN6GwXOGIh4
TLSH
T1256523B7F992A443EB575B3129811AC4CEA7FD9FA9820791333D1042DC7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 dd1e115be96214c970c6872b52e0e6b43661b1e67c79e3f06438c2ed5ac0048e
MD5 f6b246703107ad0d0cf7208bc054a749
SHA1 aded2e58282f3030704bf3b374ae68e770347096
SHA512 d6607eb579e9d65324a495e21ea2ffd2f05cd901897fcfbdcc399bc9c014a322527de943c3452c7fa437c5ea66f0df078a633552974a4ec3007f488fcb39d37e
SSDEEP 12288:IEksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Iw9Xozsr8zbhN6GwXOGIh4
TLSH
T1B36523B7F9A2A442EB575B32298116C4CDA7BD9FA9C20791333D1042DC7A87A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0eb4d91fc19bb0c25865d094db6ec1dda1ceaa3b7cce011caedbed7991fd54aa
MD5 9e8776ac84ec9de492408b67db457a3c
SHA1 51f1c1ba9d53770c790804d110b2f3da0b093f48
SHA512 6102d0a5e82b7fed38c1e45325a7e48fdfe9dd1d021cb21a608f88d01589c28a1e7105c21c26c73e352e954fa030429b4812c61e224f048ecf924979579a1240
SSDEEP 12288:qVNksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:u9Xozsr8zbhN6GwXOGIh4
TLSH
T10A6523A7F7A550C2EE639B3198915684DAF3FC9F9B5207DB233800468D76669BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 0837a13bf39c73b70cba53184643e47577e2497a906387ef37e9491ea8a44772
MD5 a4e22da184b5769dcfa4bdb94b4ebd47
SHA1 5c914315d91a768b4ca4850d958e3002c175197f
SHA512 081c934f686090864f5de8631c7b140eb3611b4ad07bf9395a14548ee5bd918604d9fd88255cbb31a6c81ab09fdf65df106c692d9da538703e1c78317969b991
SSDEEP 12288:x1ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:xT9Xozsr8zbhN6GwXOGIh4
TLSH
T1366523B7F9A2A442EB575B32298116C4CDA7BD9FA9C21791333D1042DC7A83A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 c477276368db5fc9f6e682efc2a38176cb5503f8c781ab53e8207bd87283ce4b
MD5 3f2f1df4a800544b532c2ab26cea3440
SHA1 fcb508b33821507e23dd3dcd96c6683ac027d982
SHA512 9b9cdcbf15ffc1738bb579e5bcb1130182d34a39bc1b04db8c1e4045aa99df31c1c884b7720dd5782a8ed8bbe8766ae6a11ce01a492a9f33e9208934dae5e3f9
SSDEEP 12288:SmksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:SK9Xozsr8zbhN6GwXOGIh4
TLSH
T1586523B7F9A1A443EB575B3129811AC4CAA7FD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 7b2eee80484667afe5e1a0a2e2b709073656b15fce3ddbe17e277213b33c1b95
MD5 a1c4d54c0741a294672a6a2b8ba3f030
SHA1 e60eab22790d837a308f21c2c5563da66d0d9874
SHA512 bde40c871a1016ba14d109f65f9b5f5c5209125c667409bfb83ab4cb6659ae196ff6047fc5ad67abdf4c9fd7b3dd2139c3807b689b6582573f9d2951f0f47b43
SSDEEP 49152:5MnYI7Xozsr8zlLwJIh86H9lSLkb/D+klGzj:i5wFRKIh3HzikH+cGzj
TLSH
T193D50129EBCC04E1E1B7923C98B3464AF6B178695B3187CF1265536E1E37ED46D3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 8b07f0628d7ded7e7cb1f463f5cfccfe2a0fec66d0b12ed6b0dcdf4aca05ae51
MD5 8420248cd93324483ceb57ae06f98fb4
SHA1 87c6ff34b1171cfb2036caaaa89fa03ad79411ab
SHA512 a490c7974fce8eb821120e6a605837e5d4d6756ef4c616183a031da745536f82fd8da759bfe4652bc54c88230e8c975de942a13bbd4c3bb34db68037c2b881e8
SSDEEP 49152:7YXJNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OXozsr8zlLwJp:qySzPywFRKIhLHzikH+cGzj
TLSH
T1C2269E97A16801D5C1B9C1B98B17CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 6fa2ca6a6f20090469d1e1b138aaa3adb43c4a515451be9de9a2dd5389b48ff2
MD5 e86731795e811f9fce3ed4effede0934
SHA1 e49311e686d6523687a6080dd8a279d956a360b4
SHA512 77c4c28bf79a3c7c1c771ec4f34087b3827bf294b0e583c7d7d95c48301ed08d42d3cefd84e10d43387df42f301d73f54c9ab13b44fc28f0ccb1547d9bb0c35d
SSDEEP 49152:eY7JUQjqirIhCnDHUPfF/eXozsr8zlLwJIhu6H9lSLkb/D+klGzj:ZJ0glD0PEwFRKIh9HzikH+cGzj
TLSH
T183B5E01EA3EC01E5E1BA823885154A5AEA71742D5F318BCF1270837D6F63ED45F36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 22de6774e64a857a5e919a49d0f1682541e12474911cf07a07794a2916785a1c
MD5 ee9121ff93ef3d844cb46961cde6f527
SHA1 147c43d87eadd4dc49e23bb2159e8979b8a918c1
SHA512 26d38f97be2786517a1d225bbd31273a842959ebbfa3d2d80910782ea405447d6bb357f615604f63168b5c6d19db5de65a8734eb2b9e42ace05a21738ddbfb12
SSDEEP 12288:EQsfnksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+F9Xozsr8zbhN6GwXOGIh4
TLSH
T11475F15AE29411D5D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f000f45310f306331eeae1415f40e99d4ab271352ee868aa68f005123cb13cb7
MD5 b8a96eb00150def1e10b14317db1a3a2
SHA1 8066f9fce40d0e0d722aa124f8521fc1f24e953c
SHA512 63f73f10a2f1254448b47082b263fe206ab826858f550cd9267b8bf55464a267c92b7a6518da7a9646b7ba5f0304b073740d5b97f28e509246a65f5023048945
SSDEEP 12288:GFFKPXrU3fu1eiZeSlKCMLeRj1LHJeegWdAwBJiLaRBA0Fih1wxiso:GFFObUPQeIeiZMpegWdZYLaR6yiLZd
TLSH
T1004527017226DB4FC6A940325E32C5CCAB707D01EE45AF0773C98B3F9576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 410KB
SHA256 5f10acaecebf8ac7b6c924bad421a0c4acb014a187d0145db25b4b95a43b8c55
MD5 6e6bae5f017bd6a3b6d1388e019dbeab
SHA1 651a632c1065899382728c669630d3c8fb59235b
SHA512 52d9e74578f8fa6a9740bc132f394622f3650e9949b758f9e9ded00040a62ce3bcabe9f118093d7800b100b82df3f411179f2058edc21dee2a5293b7bc292cd0
SSDEEP 3072:cTyjBa1LHP21LHwvOs4V22mlkSiJz7wTO:cTyQ1LHP21LHwvOXDuTO
TLSH
T11594D810B364F31FC5BA803714709ACFAB38B816AF016F063BCC5DB4D87225569B6B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 92baf42982b1ee86f5beb92bdd0916410e40e79f5378f1e3e1a92dc8afa9ac86
MD5 1960fcaf58bf8c962e304976b46208d2
SHA1 03fb961b6dcc689bc2c4a0cf9405c552fc9634f8
SHA512 7a5c67784dee27a1bea6278d2f022e6dbcdd60ee838b9e694909349eae540ab283ee8394ccf1818f6d9cf785e32bf1a1453b5e8ffdc9330be54b25d3f11c78ba
SSDEEP 24576:Nj3KHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3F9Xozsr8zbhN6GwXOGIh4:Ne6H9lSLkb/D+klGzOXozsr8zlLwJIh
TLSH
T11C552363FB4E6D22D596067520A34194A46BF979CE810F772C3580ABBAF95F63C37320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1742e69e38f243bd9c972a22c6b92702f78dda4e6525b6de4110a2b134bc4623
MD5 2723c8b983e8f42a655cb6835ac218bd
SHA1 87c99099cb30aaf28c50856aa374c1fa76073f68
SHA512 7916ca430ed4ec96d46af8224d3373f51f5914058dd700704a573482da9c2fab9685b660a8ebbe655c1cc0f777d720dcffbe0c1c05ca3f37b202e330f0bf6713
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bY39Xozsr8zbhN6GwXOGIh4:Ogb4mBIBhGFMXozsr8zlLwJIh
TLSH
T18E65AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 cfc2be64c686605a7df3846453446780cb48e893734b362dcda9cea420069a0e
MD5 26d58d9eb73c14b896952faead920c98
SHA1 2f69a88e7a2c263b5c2be3d506dc50b0c76b1add
SHA512 ec8e8ab83f99eda8fcde37555e5103f28e1adb0b47d97da41bcc3795bb76cb936dad7f27e59ecd3b8fa3e7d65703f6bc880a107f5d6ba2ffb877d24e133a2fda
SSDEEP 24576:nGhlKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:nGO6H9lSLkb/D+klGzj
TLSH
T13C0512257A9F3AB9C0A902B910B7409674B670709B540EFF0CF1D17ABBD86E0793BB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7fe49638593c533f6a462ad47c10d24990905f817adae64c4871d244e5c59e7d
MD5 4070b55706f0f513b1da27d907b11b22
SHA1 b7d6f587966e57d6ebb0ce613901abda13752265
SHA512 a43bea4379059f73c8b95782e6623d998ee3008c47473420ead50a4670ea6da448ae623fa7d37332a6773b18f35aea9c515a7b3d38ead341acbeed0d7dac3aab
SSDEEP 24576:wG88u8FpJqH1czria7/me9Xozsr8zbhN6GwXOGIh4:j7ZFPqV7a7/1Xozsr8zlLwJIh
TLSH
T1C2A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 55bc7f53baf26ac03264404c34924472897519aeabcfa011cbd6229adf1693e5
MD5 47cec8f2685d3d8b03baa0ca60bb9477
SHA1 ccf5d38ee7fbaa8fecc1ed4e29675462c1e358e8
SHA512 f5431bac10561ec1b40082c9306e937b4ab6de62c945874a6448ac0b5208ab93a2d0dd50f3312407609135e493007f0400f30b547b6072306184bb51dab92c5d
SSDEEP 49152:YJQw6H9lSLkb/D+klGzDXozsr8zlLwJIh:2kHzikH+cGzjwFRKIh
TLSH
T13075122B729D1CE5E676A17D45834209E772B46647028BDF02B0817F5F67AE8BC3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 3.4MB
SHA256 3592a4570fe48472f0213de0269086eb4a05695c3eecb172262f080423d4de0b
MD5 cacd65544dc73271d08fa8268ecfb3e3
SHA1 75064965ff0755dc280507b4e2d8dc29d62216a8
SHA512 a10660f1056a1d690336965b05f5c55a7b939aa089a63379705dba9605042589016e18963c65a22b7c867f593327d693d620fd1657ab2895317e42b58b98a552
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjz6H9lSLkb/D+klGzR:TG05lO43bFHzikH+cGzqwFRKIh
TLSH
T1C2F5D06A62EC11F9D1BBD17CD9C7460BEBB23825032556CF02A486A91F27FF4693E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a656c996ac5b7b9d10daad2b2ad1c8ed639973ef1c69c4f929eb94edf0683a4
MD5 303d607b37e3adf1c242297ff85a36a6
SHA1 ef783573ca8d50a0f6c075d5ea582c3c4dddf693
SHA512 c8b381daba42c2ce6ce24b3b2a12c560841fd3023ef37b6d190b84aca71c34b4876ff444119c91d2f01b76d0ac6e8a2607eca96a88653535d1c1753de1fae579
SSDEEP 24576:sfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnU9Xozsr8zbhN6GwXOGIh4:0a5POZ39Jt2pasx2+mAXozsr8zlLwJIh
TLSH
T16465BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2a9beac0e149eb661a6bf1890e2fb708ec2362681dc8b94a61e9b7b435b8b37d
MD5 a083579841e5a67a12029fe524f4c471
SHA1 012af5fc85b9155228fe3d53ca4f90ac2d99625c
SHA512 be28661c3e2a331f273ffaa9103e0b114b88e1328f5d17ac85b0fed1079d42a57cdf55c603181b270cd77db7720c9e617ad07dcc3c6a74d93d05fedce9556663
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkG9Xozsr8zbhN6GwXOGIh4:eNc/zEOVHFVXozsr8zlLwJIh
TLSH
T134858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 fac14f556037500edabe658177337951f4f1852e1b52ad69456651952db28235
MD5 5baa02ff7b70acc11ae153c16c99cfd7
SHA1 3370c74356f1a6dd9ae02dc6274ac4da1178da99
SHA512 f476d3216d3c259c5457b60272a5081b177f17218b2e33e8368ee43f1b3a3b903b57d5fcdd474bf949aa4840da7e44a5379f8d83a670b508e607e186c27f4833
SSDEEP 24576:x6DI8bKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:x6DIL6H9lSLkb/D+klGzj
TLSH
T1A425015D736A11B5D0A7907E91930146E1B2B070C7520EEF0AA4C5BE6FE3ED8B93EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 e55399e1e61bce7d8797bd868830aec5bc12ad74461e70586f63169e6cf04663
MD5 74a7ba82620a7ba2341d48963f179d8a
SHA1 25e64ace3198d44f020a7e45bd675f6bbb7248b6
SHA512 357a10521d2662d05e0e03610f03cf4c948a56ea9c1960f03ccf634b44638e43ce5a8e45b6405c00ef9af5b863e371d06a799244722a913ea7333f9b6fe1a1f3
SSDEEP 24576:Styyh5KHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:Stl06H9lSLkb/D+klGzj
TLSH
T166151200778D29A9E1A9027865B34195997AB8309F614FFF29A0E23F3FB57E07C36711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 0fd1befe78359b6fe1059795d1c4315370ba7fcb9f09fcd92ec6b733b8a346be
MD5 620e220fcf0ed71be68e523bd285d12a
SHA1 31d04a2e2aae66c8c41b46c98bbb91f6e8cef9ee
SHA512 1144158e866a0c5b630176b6caff788ff1530d23575446775a05f52ea990e0e1fd05d4bd6d9f96ab3021e476555be590bdf00e0d683d738a78cd7d4209a19c64
SSDEEP 24576:eatKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:ev6H9lSLkb/D+klGzj
TLSH
T1130522617B0F2E79C09416BA20B7019A606AA134DF950EFF6CB1D17EB7D92E1383B750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 b5f6486f311e3f26b174551ee706b23f3d863436c389cc6f3ec7e0873c6bf5e8
MD5 6954ffb7cf3538e77bc3b183ea0a8466
SHA1 4bf5818687505eab6dd308e7714258df4c8debd9
SHA512 6cdf1c26e2941da96edcc756df78ce2b7d7168a419f7d89d04e1b0938c1758cebf5b66f996e26e4d49598d1ecbd6b24494be43300aa895c04c6267e3990171f7
SSDEEP 24576:5ygILoTfaidZnKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:wgHTrZK6H9lSLkb/D+klGzj
TLSH
T10065AD1D63EA09DAE2B2D279D8731493D633B4305772C6DF2448C03A4DAAED8AE75F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 f2f1b3d1fcbf74c02c8ae68818585b0b5dea72b28e2986685fc08d9f7541e7d9
MD5 66dba952ba9ec21ee397c918ccce42f4
SHA1 f535321a21b7e3cbe4ee39244cdc2641db7c3913
SHA512 bf65087f19b746928fad2cfb96bb673e2c5687d05dbf71114d58b9aa44d9d3830a8bfa420ea8fe4fd0723cae763cb3f2b4db7833ce656813c58fb1948ff79984
SSDEEP 49152:Ngb4mBIBhGFMXozsr8zlLwJIhK6H9lSLkb/D+klGzj:NtZwFRKIhxHzikH+cGzj
TLSH
T1DDA5D01E32EC02F5E0FAD2B89DA64407D6B278164732D6DF1151422D2F3BEE89D3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 23674f09ed5d8473f592dcd8b6515c7d51ee411aff5d961896fdfe8fbf6bccdc
MD5 7c7a92711f594e68a3d0b96841fa2d43
SHA1 acf7bdd09f94696c855665a4a0c3c3eb0e9ccd6f
SHA512 dcaefc07f9eb96149c29f7635c845f3161a5fd90cbe358210d564e990890a947192d7365055b45e1ba815d011173ea7d5cf03097c5f5804ccafd8a1c0e7d9282
SSDEEP 24576:GTkNvNnaFeYhJNtmZBm9LeKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:GTMwBtOmx6H9lSLkb/D+klGzj
TLSH
T1C675BF2EBBA806E4D1FEC6B59D238512E6727461073293CF5290C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 e29b29c844f0b8723ee64727f48e8528f8f3fc918e41c51adabc9570472cdc9b
MD5 b29f12a72fac5fa27f380b835920a9df
SHA1 9675fea56cf96cc49c9be9e89aa4b0886aefa21d
SHA512 b716c72310954f58a563d4b91978eab62e43f94933d740553fb41ce5e42a21285734c9111409b6b471d880af6584d7c349689f3b516b55459b5bd91309a02f83
SSDEEP 49152:bDVHeBIAATXozsr8zlLwJIh76H9lSLkb/D+klGzj:ZwFRKIhWHzikH+cGzj
TLSH
T14AC5123EFB5D04E4D57BC27C95A34506E67238AD07221ADB05A0C1BA5F6BEE43D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 41dab286cb4049bcc91682da47515958063a617e0aebf0a938f93818c8b08e0a
MD5 c999e51a695ece88addb897c79b0ee58
SHA1 9a0a36f14dd50a34977b79b23fead8ff20b9455a
SHA512 c64ca3169957d075715c1239dbadd48df48ebb44f9003f96d04e5e7b1545559dd99438cf379af31d3e0cdf34ccfcbeb239ec0f69b42681f76f941739b4e52bf9
SSDEEP 24576:KJnJPbzB4StOKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:KJnJv6Sp6H9lSLkb/D+klGzj
TLSH
T1CE35E03DD29810E8D4B7C2B4815A169AFE71347C2F216DDB19B4D4353F52EE0A93AF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4a41efd7465cd71.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\f4a41efd7465cd71.bin
Size 12KB
SHA256 6183d99f3d0de3351e04911bc953c99f46dee334b03e4581c5325072a1083324
MD5 9f59a2aff76aaf25aa824eb4b8cfeae3
SHA1 51655406cc5442dcc72e3ba910214b6f27bd951b
SHA512 c6b6229c30b061bb39c5818a4f5b1570fd0bb6e075449b5a5455f010382bd1a79a69455ccaf054b64c65be2f5f04056b65758a0d7ea5ec2244c409ef9b229dcc
SSDEEP 192:oNeVLTs4mAjXuEiNDAeX0xYnvkLeIY9B+nF9+mHb3syKM/A5D537umsV1L9OrT63:2oX/jriNOyKe9GF913scY5D53yX
TLSH
T15842BF6F807FA357C4D0F1AB3D647523DD3A285BE87CF32825AA11416EA3DA391640E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 a429d786e01a6339e58dd460b8e26dc2d5b6f3ad72912900523faa9815f9bd3e
MD5 47f4f0bfa7cc0a6dbe19623986489d5f
SHA1 046ebec5e9ae8438ad21710df0dfecd00d93ffcc
SHA512 55eef16050cf62a505dd3739411cd6f4268b6b094e67473f0b38edcf25733cc03a99fe7b4b082e10f9d33006667bf79e3968b2330617b53076d5e38fbc5e458a
SSDEEP 24576:gvTKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:gu6H9lSLkb/D+klGzj
TLSH
T16C052261BA0F6E7AD0C411BA20B3409A646A9134DF950FFB6CB1917F77C92E6383B354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 9d07a8d4f6c6a69e31a47cce58fd2b8e5a4b2a6161f3ea1a27632711be673fec
MD5 d387b740b41b61c96728543520cb5af9
SHA1 bd515784b663ba2db4ff6c37af383f4268e81b54
SHA512 d89bd5cb2a2820f4b5a0d0993fb5c12df0cf84a2f6929d175f7ac09b8b3445a5158f9bb8b951add5ed4eab38a154b22aa02782a17b36da0d407c99b172832b85
SSDEEP 24576:m6UqjpEaKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:m6Uv6H9lSLkb/D+klGzj
TLSH
T137152219778D29F9D0B90174A0B3416A40B5B8315BA54EFF39E0D27FAB75AD0A83FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 b668ac0da3d126d9c1c7306ff5e67e8e5918ddcdf94c1d9de08a26fc3147b5a4
MD5 2342d877d9e8cc3d11bffa47f3dfaa06
SHA1 0a448829ab9a32d56703bc9777966fbc3bfe468c
SHA512 49390566435f13497f911c49907374b4b3a877bc5383f973ac38263f6a97a0fa5e93924c6b259c52cb10cde2fecddf2bf6dc200de454837e73fb152ce65b82d5
SSDEEP 49152:6CLHGeeV5ijCmlDWDkp6H9lSLkb/D+klGzj:h2HzikH+cGzj
TLSH
T1A7A57C05B7EB5184E8F3CAF5C92294169A327C549B34F7EF4E80C96A2E32BD0D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 fcb0a0bfd8ad0451637bd08ad9718434e31173aebeee42b3ee41d8a383ddb082
MD5 3ff5675c59eb054de2a9cfcb338e5559
SHA1 6c5b9c881db56b7c72ffeacc75fcf05ad4c268fc
SHA512 7ecde2cbe1c92ae0557af8e500740da89279cc6bc64b2cfc49749d02d53807af6f45fb1664045c1f32c0df31fc269abc5cf6f2f6e65d8fb0f253bd792947acfe
SSDEEP 24576:ErcmRcQKHFUH9l+XLHzrU1Rb/D+kDQMGzA2Q3g:+cmRcR6H9lSLkb/D+klGzj
TLSH
T1E925011AB76F00B6D0B7817C88924146F6B3B03097525BEF05A1C37E6B976E97D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 151843cf92a770adcabab049bb4ddd01c65cef89caeae951af0c55ba7868d2f2
MD5 c0f587d4b623807fc43a1d281fe999e6
SHA1 b758b5f546b4acf41d16006be738a70e697865a9
SHA512 0824eac0bdde98e2d8e129947a36db441a7e41733b08cf6de81491c819729acf5bf49ad21d6abc99bf18a70b5c426207d46f09965a10acdec8c3139e996a5c44
SSDEEP 49152:mDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3ci6H9lSLkb/D+klGzj:n3Upow8sBV5HzikH+cGzj
TLSH
T1C4B59D3DA2E810A8C9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d62258a8f115501760e1297096e0da41c4f55d7602fd064a4dc75ab6c3bce119
MD5 130cfb901e1ece584bb211f995218f00
SHA1 31200066dd0bd0280772ba4946d7735ad9cb664e
SHA512 fd79b9b1ee23c50e8328f517d5aa8224329dc4f89ca8fd64a4d0edacf5a41a340bbc40dab57b014bf1f52f1ed2448f54596a605626dc943b90e438416c4fe5ac
SSDEEP 49152:/wNOg6H9lSLkb/D+klGzDXozsr8zlLwJIh:NjHzikH+cGzjwFRKIh
TLSH
T12875124277991CF9E9A7023981938136E7F3B8152A618F2F1770C25BAF772617D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-370-0x0000000001520000-0x0000000001580000-memory.dmp

Download

memory/820-470-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/820-361-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/820-369-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/820-362-0x0000000000960000-0x0000000000A77000-memory.dmp

Download

memory/820-363-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/820-376-0x0000000001520000-0x0000000001580000-memory.dmp

Download

memory/1200-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1200-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1200-131-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1200-130-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1748-408-0x0000000140000000-0x0000000140387000-memory.dmp

Download

memory/1748-478-0x00000000013C0000-0x0000000001443000-memory.dmp

Download

memory/1748-480-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1748-423-0x00000000013C0000-0x0000000001443000-memory.dmp

Download

memory/1748-417-0x00000000013C0000-0x0000000001443000-memory.dmp

Download

memory/1748-415-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1748-409-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1748-473-0x0000000140000000-0x0000000140387000-memory.dmp

Download

memory/1748-482-0x0000000140000000-0x0000000140387000-memory.dmp

Download

memory/2348-398-0x0000000001590000-0x0000000001615000-memory.dmp

Download

memory/2348-403-0x0000000001590000-0x0000000001615000-memory.dmp

Download

memory/2348-396-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/2348-390-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2348-391-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/2348-472-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2872-343-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/2872-336-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/2872-342-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/2872-469-0x0000000140000000-0x00000001403A7000-memory.dmp

Download

memory/2872-334-0x0000000140000000-0x00000001403A7000-memory.dmp

Download

memory/2872-335-0x0000000000C70000-0x0000000000D87000-memory.dmp

Download

memory/2872-349-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3096-475-0x000002244AAC0000-0x000002244AC8A000-memory.dmp

Download

memory/3472-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3472-329-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3472-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3472-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4076-325-0x0000000140000000-0x000000014084F000-memory.dmp

Download

memory/4076-2-0x0000000002320000-0x00000000023A3000-memory.dmp

Download

memory/4076-23-0x0000000002D90000-0x0000000002DF0000-memory.dmp

Download

memory/4076-0-0x0000000002050000-0x00000000021AC000-memory.dmp

Download

memory/4076-7-0x0000000140000000-0x000000014084F000-memory.dmp

Download

memory/4076-9-0x0000000002320000-0x00000000023A3000-memory.dmp

Download

memory/4076-95-0x0000000140000000-0x000000014084F000-memory.dmp

Download

memory/4076-15-0x0000000002D90000-0x0000000002DF0000-memory.dmp

Download

memory/4076-318-0x0000000002320000-0x00000000023A3000-memory.dmp

Download

memory/4076-319-0x0000000002D90000-0x0000000002DF0000-memory.dmp

Download

memory/4892-211-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4892-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4892-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4892-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4920-114-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-121-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4920-115-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4920-123-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4920-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5160-58-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/5160-49-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5160-56-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/5160-83-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5160-81-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/5160-50-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/5480-384-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5480-471-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5480-387-0x0000000001350000-0x00000000013D3000-memory.dmp

Download

memory/5480-385-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5580-321-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5580-101-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5580-103-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5580-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download