f36a5004a354d8601b6221bf69cff011d127ac53b09416ec7970a2b07a1e6596

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 2.6MB
Sample260929-spz4csvw3j
SHA256 f36a5004a354d8601b6221bf69cff011d127ac53b09416ec7970a2b07a1e6596
MD5 dc623bdcc1a7fb6f04a613a09fc3ebff
SHA1 bcf7e9eb11f05a9756f13cd904ff17ce69b44983
SHA512 9cb6cb0d659c617005fa091048a4e5121dcc3d03a42dd5c7cd317fdc386287a68e72e9722c229cbf515537fd2cef7b835696733daa9b3bdef168602437b9da7a
SSDEEP 49152:aJNXXHVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2oMTA9n/TDbXNKdSs6UW:SnVu0VLGMb5Cx0taAUgLdpq+Xvna9k7e
TLSH
T196C5F146A7AD01EAD167937C8A970806E2733C15F3E04BDF03987A791E336C1AD7B619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4028	elevation_service.exe
2868	elevation_service.exe
1280	maintenanceservice.exe
628	OSE.EXE
2412	PerceptionSimulationService.exe
2408	perfhost.exe
1440	ReFsDedupSvc.exe
4592	SensorDataService.exe
5332	ssh-agent.exe
4800	AgentService.exe
3552	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\96f66d3db68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5956-0-0x0000000140000000-0x0000000140299000-memory.dmp	upx
behavioral2/memory/5956-74-0x0000000140000000-0x0000000140299000-memory.dmp	upx
behavioral2/memory/5956-205-0x0000000140000000-0x0000000140299000-memory.dmp	upx
behavioral2/files/0x00010000000093b2-189.dat	upx
behavioral2/files/0x0001000000009323-188.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9ff6fde2550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000599b4fde2550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb8cc9212650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006b466de2550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b09bd1e02550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a8e5bde2550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c89e2e12550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5956	2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	1440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1440	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4800	AgentService.exe
Token: 33	3552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3552	SearchIndexer.exe
Token: SeDebugPrivilege	4028	elevation_service.exe
Token: SeDebugPrivilege	2868	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 5104	3552	SearchIndexer.exe	99
PID 3552 wrote to memory of 4744	3552	SearchIndexer.exe	100
PID 3552 wrote to memory of 5420	3552	SearchIndexer.exe	101
PID 3552 wrote to memory of 5800	3552	SearchIndexer.exe	102
PID 3552 wrote to memory of 6080	3552	SearchIndexer.exe	104
PID 3552 wrote to memory of 2256	3552	SearchIndexer.exe	105
PID 3552 wrote to memory of 5712	3552	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_dc623bdcc1a7fb6f04a613a09fc3ebff_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 752 2900 2892 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 752 2908 2860 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 752 2900 2892 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 752 2908 2860 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3797f12eb01c92a14c45f67a4f80be86fd41807968ef6803c4ad19675022b789
MD5 2a686c46b62a1908ff426002892745e3
SHA1 05f72ab5d1b1ff743ec08f0e2b519986cc3f2985
SHA512 8847385ef74027f374b3942f9c8f85cbc758f10da71a6f4fffcebb2c0a7112b086da636368cbdaa8ae94763343f5fba45e88e2039cd9a2346ed15f223aea328e
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnNA9n/TDbXNKd:r3q6HjB3fb9s
TLSH
T114D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d3239b81575dd78b7e1ed117b7345194188bf7b7175a7a005380c6b62ba40aab
MD5 bd86b12e2a5ec066db2c09fad7e795e2
SHA1 d797e9848f0b4df3cfeb02855c19581037113598
SHA512 739f15fea9e0d5c43ec9153735a47202cbe5e4ac7183e80c492f4a223c7ba548d79ffe757afdcffa4ff3fd682f8c085f883fd18b2954ae73e289dcc2a87893cf
SSDEEP 24576:BXYfDtczAIUeA9n/TM4NZYeNm+9MhUwd:EtcjA9n/TDbXNKd
TLSH
T1AA85012967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 1df7be2ab4ff95c8344731e5104f40588858d71f570f5d6a1ffd1fe679ea84bd
MD5 ee56eeae2051b306ebff72d1df413ef4
SHA1 8762beb83700fd488653ce310439af9e8adf1e85
SHA512 cf4b36630e0511aa2e699f9d18676298706ab2776517a02881221919d80eec70c3855facf7ba4c7227dc700f73394d4c504a68d1dd51f13e765e09ca877b9ab1
SSDEEP 24576:k0Le5ji0hmxYrMpUeA9n/TM4NZYeNm+9MhUwd:kPji0A20A9n/TDbXNKd
TLSH
T1F5959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 965f9071f56a43a3bbcfaa280d66276fdc3c21fc13be01740125d4f7f9768d40
MD5 bb536ae0cc408a217563a1c2bffebe30
SHA1 d241cbfc4352b2a7c8c3b6d23070dca7d3d5a5b1
SHA512 522dd15afc7ad544539e35f662f7a49a24e9c5316b9d530404b131abc8b1efcb53860acedbc1416d6dfc62bdd0bf5e56f0c3869f3396d922ae53d9a0a0b8a72b
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyufUeA9n/TM4NZYeNm+9MhUwd:8/ezSC6vUzPvxHjyQA9n/TDbXNKd
TLSH
T1EE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 485317f21d4ea0828fb7583565435cdd0b668545f45e1090ce78c14204c4afd7
MD5 369450bad21b6159038025a26f38afc0
SHA1 a49b00ddee2536eef614bb04c0d1418bda28cbe5
SHA512 d2ec4b3376fe4de21318481f505f86c3624dc67e187ccded710f4f187e5c4bcf145f9fdadc04cd16e9c32786aac9f5cacc650e036dd61d8e91a4266e6257db8b
SSDEEP 24576:GVbqPb88hv/l+68UeA9n/TM4NZYeNm+9MhUwd:GVO88hXl+hA9n/TDbXNKd
TLSH
T1B5559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a0e508034205cdb56490e759501cfc8b526d7c36564a9d5d8d9dd8b92cf1cd17
MD5 3105ff3df63d9ebcbeffe04526b9660a
SHA1 c59cad67de5e478314d4e397d173562a45a13c93
SHA512 233f02166a2729c696a9be9b863976d4fffc8180de9b0cf9e2639cbea9554ff4e616144ebe7d2ee96c05e8d277919f19f898e352b43029c8eb369c5882205f0d
SSDEEP 12288:gHdBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:gHdUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1BC6523824BFC08F1CB8E0A7544AABF0CCDA2FD4DE684879E4715762E5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 4ad52eb861396d35debc35506dc49e20a639943c74c299566ecd962c7ae86231
MD5 8238d21f611a1e6e96130535627f2b80
SHA1 b92fad1a81ae26e188938d8934e1322ad44394ef
SHA512 ec28a33523192924e6fc73bba79c5288e617290668bdac62e270b018a8b2112b5764ec17d2f1df7b1ef602af8c7811d1ea6c49dbd0cde71b39ffcc6a5e17f37b
SSDEEP 12288:TeBNUbTVO86UkBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dI:TJIUkUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D185CF7BAE38ECE2C27E4DB956918700D77278304B5293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b924e28cfa4e4a7176b21434b03b72f64618248ac0a4065c75076ad8046a7759
MD5 008983da23b5b7894e73e586ed390bcd
SHA1 49f9a8d0f1cec0e2ef82804bc02b9f286b07d4dd
SHA512 735232a284704c2938c044dac2e309258e8e647f397c09987ffcad5ad3e8e4ca399f466e85be0d5491104bd25556bedc8f0025423e8e2e3d31e8f65e6ba57618
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:aQvGAdlCEL8c/yRNw5CIfb9s
TLSH
T19C267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2d4c2117c33f1a1f36230960edf21a5dbefcabcc7cbb001cc67be6131a2a885f
MD5 8f19645749664e135e572e81c81fb9fb
SHA1 1f6fcd7d1c0d6bb9105a17a425d892276c56f3a7
SHA512 3a4c67eb19b79f637ab068e1cfe867daa936897e256415b5a61064196968f5ca09723d7130a395bd900a1c715de98c0d5bd23dae9960a0421d2a20d4bbbdcf5f
SSDEEP 12288:JAwSfxL/2Dc3SDLLmt0LDQewsAjqBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9Y:67ewsAjqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15385E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89A9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c21595fc27fde6aabea5fea0a9a0bd38ec8e90c7fbea11866f5c34891887536b
MD5 67974ff87cbbf3ba489c2c7984abad7f
SHA1 ed42855d100282261076ff22dbc8320668816b41
SHA512 66babc552d8bfeeeef49e4119d3345ac12d7f88aa339812622e05a7812eee62449c9d3a7c57e50476d286eee572bce0f1d49abffafb85662145e3ec071e96586
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zEA9n/TDbXNKd:+oquVjnm8fb9s
TLSH
T187D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d3aed9475197fe23ac061cb58a31cd2399021de0f757041f15f51cd86b93c5e
MD5 fe93b0b00151913b69f8077ad676b315
SHA1 d871e4b749486c728edeb9bcf9d64793d9e24796
SHA512 de51a31207c43ebe3dbe624c57538bf37a33237aed566c9795ddec8a56f3e24edde744a6427122c03b3d029c2ebedfc940d71abd48099eb8fad1c9d0c4bdcc7c
SSDEEP 24576:yAhGLJIFoiwtA5l7S53lUeA9n/TM4NZYeNm+9MhUwd:yAMyFoiq5RA9n/TDbXNKd
TLSH
T1FF359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8953a9adc1cde21ccbf667969f9b287ca55fa5f54f174d12324bf6368c010ec0
MD5 6e9fa34995d5c0a8ba0b557c0b563ffe
SHA1 63fdca03c530c66c3d08561b02592d8d92a976cf
SHA512 69437e1ce68e6ef3b9b2438b990b6f1cb75190c4262d72923d437dce33eeed2e50e7307e424d05400fe246bc474b0414fb61fe04e8def520474e2583072511ac
SSDEEP 12288:cmw5HEjsChNzBFgl0WDm+C/BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dQ:ZwuSOWGUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17385F14637E80CF9DA6742398597D635EBF2BC062A25C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 42d11b7b2b6ddbb61c778e30e4d2d76fe5fdc175af16725c67bee3ae16c409ae
MD5 8a4f963ee129f425915331a8f9adc7ee
SHA1 b1f9c481431e63710c15d8e490465b4cbb44c17e
SHA512 d8b29be8db6e899705d8d5c7cebee1bbaf7dbcee9447831668ad9a81fea25917d50d8524e1c7c18e4e305fe16817316d08e7f9b8795d09f5318a8084b6ee8fee
SSDEEP 12288:NjZ1Iy8BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:pZuDUeA9n/TM4NZYeNm+9MhUwd
TLSH
T12175128627F814F5C397527CC8E55B08DBB27C5A637543CF0625626A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d726ed4c1d7fd5f3ca1c4186f63270c6773331d9d579cad61e0e082de3344dfc
MD5 0b9260f9cbaeca2839186ccef36b1ade
SHA1 24a6925fc29c094c6d33ec48a8acd59307232cf8
SHA512 88e00c70ee87986e5fe805da88d691fe29547c6098036e2ad72975a595897a142c921315e5dc0607af2d26c70fd6739bcd8521867a4e5d005a6e231708ff52e6
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:wQRQyi36YOcPQLvw2gAf+PN35fb9s
TLSH
T144666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5a11fe4f55738220071de8833d1517fd043eb3668740415abfd2111831182c2f
MD5 9fa9cee71a163cae33f01da4a9f0e74c
SHA1 d7585ad673ef503ad3c06269058d2c1a279c37d2
SHA512 1cd39d9931f089a1a1d75e3a047002d41e1ffbbfd353cddb9ecc289ebb8692648759cb1ae248478c051f35d67c6faa5a65d8c6d5f82fcf70e2ac87ecd5ba40d7
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:aQRQyi36YOcPQLvw2gAf+PN35fb9s
TLSH
T106667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8017e599f75c885ac0b6c75721bc79e35325e83ff35b2cb77094aec42a31d389
MD5 2449385efc7a8d3b4ed06111c3c202c4
SHA1 2ee859e2e4895041543174272fbf9db75397030c
SHA512 c00c14d1b529353935b53ebe6f99df8da3334558d6fd417a4f9d12f38bd3f92ea3bd5add285e2bf5e4f1bf6031c0cf6ee2e1e0760f1b86ea6c3ee03a0eff0a3e
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0zUeA9n/TM4NZYeq:s68Qg55nhheWu7PNU3/uA9n/TDbXNKd
TLSH
T156B55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f36aec2f26ed2f9a810f4ef119c75645b51101a12893b38cf93a97ed6be819ae
MD5 4fc819bf398a9cecc9dc469235d5d8a1
SHA1 d85cc9988ecfb39d723cddc44117c8b475905c49
SHA512 f214d9573ff757565687e03264130cd07c130924a9e876076598e6ec31d264dbc8c470d54c2aa53fc47445b3a91b1ddae2b42fe2987059c4ade900e9632d729b
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:My5112gYy5azzVvL69nLKnhZYfb9s
TLSH
T11B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e1caed1da33d042c96d7063b6b7d57a6c8a40a165c429a47dcb6bb46f375fb89
MD5 3aec7cc84586625f67f013c12cbc287d
SHA1 28f2517f1a747d948e278e19177bb25e98d76e73
SHA512 78ca6dc719a846eafc10ae8d1eb0731c664c8cac518af533b0933b083460486ae3e99c6e9d6b284eccbc7ba7a933f07c575cbda09edd7c2db1d039e49e736187
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6A9n/TDbXNKd:Ju6JmVxd2drfb9s
TLSH
T11FD59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c2c9e5c5ace7d49c16d589207e48080b160e0665374968ce1ae6ba26869675ea
MD5 794740314205416c73150d3c68c60d6f
SHA1 e8e72a0aca20e48d986742ea2bb80381131c70ef
SHA512 d3fef5522ca529ec1cdb9210c367053fe3f167f2df856ef2d2ea6fa7ee7ff488a45e5468f243630c51c7787e28afeb6a906bea34c447d7043dfd6d5b8c1e6372
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xwA9n/TDbXNKd:nmifPbRqfb9s
TLSH
T146B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 768f5a201990e55a5882351b1043028f5b3e67da48d8d58e0eb4130e239695d3
MD5 0e1830dd6af7efd93ee306476bd8569c
SHA1 bc87d57bd388a96d1bfa4a37a9d2bfdd5890233c
SHA512 86e9de83cbaef01aa9a0cdcfa1277a1a108e88bfd08b1e27eb8d8b7fa18e7e3c70216bdcdde1347a6ace323b3d9ee98f8fdac325df82d655f5dbc9eee482e57c
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqHA9n/TDbXNKd:q5dKTi610fb9s
TLSH
T19FC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5e1ad535f457177bfc8051679a4097bf3b9b6ae0de195e9a67a825634588a005
MD5 ac51c912ad07a18168464ab0c597243e
SHA1 01323af2d6fb2af8c626cbc1d88b0ff4fb51f763
SHA512 872fcd3644676a2ddbc5411e40e89e5c868e12b3a9cc7286e2cd15d26e59f9527259b389335d6410f9511e9268aad0f11c8f04ceb5bffdf334100d6cd1599ca1
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wUA9n/TDbXNKd:YX2iyphOfb9s
TLSH
T1B795BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d057f0d4b3e16957d9bdde814500fe2b22b1d5a4714f7a08a41f7dbf64feade1
MD5 8730cb85c4b781edf336b395bd9940f2
SHA1 3415ed9d5e78b26b262e5a66ef66260bb95c1e86
SHA512 18c8262814a98b12c439dafe90848140ff89319b76f5641eace35f57b292c35e02c6c3430ea4edf521da81ae55e3c520ed6b8610bf1846d578b64fe2e9485f44
SSDEEP 12288:ndBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dJ:n3UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AB6523824FFC09F5C74A0AB580A67B0CCD91BE4EF68543AE471E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 510da9a27bf22f0b8e008d9d79efe9df1d1fc7ac3594230a133f99c19c32f8ea
MD5 7bed2baec909b49e70e79364c436ebee
SHA1 3620ba3c3ce9e8a2eac73a33148dcc6eb8638d10
SHA512 2189b593b2f3bcbd77b2dfcde1f3c6912715c9c25038d6d173ad2e8a3027cd03772b36e754a62ff853e7302a05a03475e91e1a41168f95d11ffeaf35d0dce35e
SSDEEP 12288:84BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dY:8gUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1736523824FFC09F5C74906B581A6BB0CCD91BE4FF68543AE470E722A5B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 34ebedbc38cad59ba834fc3841498bcae330a3887fc58dfc77b5c6bd42c7e43a
MD5 631af7cd3a0b275b0b007d08291a0eaa
SHA1 5ad15e884ad15edded6e4f72969e081be93dd82c
SHA512 d26b94abb7f1bed23064c26ffcf4e97770ee26a2b6b0fbe356e7ba72500fd76d0505a7e7fc07b10f49cd4da066c6fefc8b304fd3816ef75b769353e1d78fb642
SSDEEP 12288:4eBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dF:4eUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AE6523824FFC09F5C7490AB581A6BB0CCDA1BE4FF68543AE470E712A5B385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 bd84cd3be00e0667c326e574f18f9cf6de80cdbccd2c4dd75792e68d51b587c7
MD5 a189d6a5af9e13c463e98824d0798a84
SHA1 20286a89d9bb3f86db9ee388d6eee6ae5fce725e
SHA512 f744584614b26bb3479fd5c559329969ae8eb00774f35d95009d7820b2aa82c44f52944994175f6013aa1712db918740645ef48bf114360066a3abf898b8a75b
SSDEEP 12288:xVTBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d0:5UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DA6523821BFC04F1CB4A5679C5A6A708DAB2BD4EE76183EF4705361A1F302D5CD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 120db06758fcbb528172f99f4667bf3ca4412327aaf042210a490bfbae00c307
MD5 3530e585a2e4d10025d22c2132562017
SHA1 b6be3860fef72f4ca54551c66056c77452f37506
SHA512 950d923e2dbc8febe6f2fe4ea168b334d42bd1ae417dc1554f163180db52a0bf7dcb5bded33e23cba7d20a9a5a6686428dab520e0b04b12e52716b2e52108db6
SSDEEP 12288:n7BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dJ:nNUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B86523824FFC09F5C7490AB581A67B0CCD91BE4FF68543AE470E722A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 75a04d7ab1486d96cec1d9084d65039b6df5fa608d02f6cc9bfa02a5b8df0b60
MD5 b5285fe0a630f662ff3d061cf9be2ec4
SHA1 e7e303b23b33e534ee7cb173a8aa36b3e0738578
SHA512 dbd99db2d7fd8005fafd7ac7981b9cd3d2aef24d50fa89dd38053c8b2608df37fa8fb2204dd7a41c1bbb7795c3340399856a908e665d7ebf66d1777bf19586cb
SSDEEP 12288:eEBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dj:eUUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1536523824FFC09F5C74A06B581A6BB0CCD91BE4FF68543AE470E722A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 466ef575104181fbcf9c24542d0f15f663a00c9a10dc019a668ee60a8eebdc3a
MD5 63f87d36894d7bccd189e9dabea925b4
SHA1 36bfe8c709b1d9504bf8d9d6a1280bc1b192df13
SHA512 9d159f40117308ce2d2e32c853a08853cc0a6f1f10a3991fd2a68963270f34987799c5ac7864ea4f9595433b9ec2f1306cff9c4bd1326c98ed77b8656fa1fcc5
SSDEEP 12288:vgBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2da:voUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1296523824FFC09F5C74A06B581A5BB0CCD91BE4FF68543AE470E722A6B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7f8d4eaacec019a22955d175e1bccb377fd4168305b1d8603c6b5e7d518caf43
MD5 e5e30ee5480f8b7eac9612346515324c
SHA1 b92c8cd68641e5a0c8e69e1afdcbd9e946831ca2
SHA512 768917d43ef5c03593a38e7c384aee87bf5ebe37c3fd0b71a6a6e3a4d3b51b92444a93a26d6712e17436c89d012864579b35ffdf9a3b4d15d509450c6a6746d1
SSDEEP 24576:tZMEzFVSOAUeA9n/TM4NZYeNm+9MhUwd:tZMEzfGA9n/TDbXNKd
TLSH
T157850295B3A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b9e6dec4edbd34d56df01cc592a1e4b72557c49ab3b9093eaa9111f74606f90a
MD5 24d86d9c6b0c6587bafc6cb0e3d455d2
SHA1 5ed8decea98c5db7fdc9a2ce2438dcc8b1beb2d8
SHA512 38129c06fa7556e6224dea05801d69f0fa2e4a805ef721b713db13ca4d1e832485d9f5284dd01bfc1939c94d9cae0d48dbcb9cc39f2d13f37119e50a23be3560
SSDEEP 12288:ThBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dJ:TTUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A46523824FFC09F5C7490AB581A6BB0CCD91BE4FF68543AE470E722A5B385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e245df1eedcdfd46836bef022e35ccf6800a98d908d15b3d150ae1c2f78efcf5
MD5 5633a6e03331b40f29bb29670b57f1e4
SHA1 6a2e0ea208163a7b46fb16ffc957abfeb1ce0830
SHA512 0d104e1aa2ec4366aa2c05c0933d20087e08516d94fc5de7781450ebc9830645e15ca709c8e0703ffff14a9701b4fb71b097817992a239ebda84bd0003fef526
SSDEEP 12288:FVBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dX:FvUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B66523824FFC09F5C74A06B581A5BB0CCD91BE4FF68543AE470E722A6B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 51e5d2622e1b5f05b8289060d75916bca58ea5fbc2187a764903f44eaedde3d9
MD5 ed21d30a3d901346b3684f9032f81b92
SHA1 9673a97e42ff33e1d80114d11ad64aeab33f5212
SHA512 264a6db89ce2802d47aedbb4dcae33754e54b53bc88334095438a51acd5573e433a56c9932a91cee624be6b81a43c247411377fc32aff45492193ea2d17c8988
SSDEEP 12288:ayPz5L88BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dx:HzyMUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15275024777B520F9C2664238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e99b2d418ff2f8f16f864ad2996d1b02edbd5c785c3702c30576b49c27007617
MD5 367285d3b2e50f39efc6ea1b74b6b5dc
SHA1 efa12744807cec65addcbb13fae68ffc83c762e9
SHA512 0a43edbd825488cedeb7171dc3cbb293bacd448104b06613fe078c98e66a46d7702c773cbf85e57ff310941db8bc8bc1e1acb0e53231efee54dd34abb837b72a
SSDEEP 12288:/hBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dN:/TUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1396523824BFC09F5C74A0AB585A6BB0CCD91BE4FF685439E470E722A5F385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 97f8f5150dd388601fc8bde9c16949c443a6503c8436139cda373ad17f3de074
MD5 fce03a30b264f50cfe9129ebe6a21ac7
SHA1 c1ce34afbcf27714e67274272dc83f28365044d1
SHA512 7ac5b9157032ea38387841fcbc88560e26c11a5d6bd1a13ada9ab7381d0a5138f90834c5ed378e1e73659957c296b7b168ebdf00f80f15270c3795167945f759
SSDEEP 12288:/hBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d6:/TUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DB6523824BFC09F5C7490AB585A6BB0CCD91BE4EF68543AE470E722A5F385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 699c8865571ce4f5bc50b07936b17f91b5844e7771a6190542043b89c91861f0
MD5 ba8971696a754018ea0dfe53f5a68644
SHA1 2fe8b7c86eec066bcee402a65df794c464c19ca9
SHA512 3c02c8f945e443500a9e1bb91df462518aa69ca505f986361a4cfb1f6cb3b01e09eb8082b9984a57cfd9d02f902acfe6825264fb646c35c658a788c048cfc817
SSDEEP 12288:+yPz5L88BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d3:jzyMUeA9n/TM4NZYeNm+9MhUwd
TLSH
T12D75024777B520F9C2664238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 8455d655a65296353a0e5e23cc1ddb16e375bc0ebfcca9ccdfafc03254f217a3
MD5 52ccd918b7d46a9e9bb1b3e1c0a64486
SHA1 3a765690aeb4a885511373a79f154a3b57d8ac6b
SHA512 cab2e774cdb3af557f0fdf78cca72ec0bf3446d7b92b29f8765713ae410ab8b6da0c5fb1d9d68abdd575bc7c389e3743094d61a526ffb0a20e1445f0ac63f84a
SSDEEP 24576:mTdaLl3z0zDOUeA9n/TM4NZYeNm+9MhUwd:mTwLljFA9n/TDbXNKd
TLSH
T101850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 2fe5caac3cee5ee1a3f0031d1d522e646ba4b6f2f34d98689646d2a2982073f0
MD5 4512e97fa78853dfa40da3f14dec94b3
SHA1 4dad737f1109ebbc1aa5bf2ed544909c21a5cc7a
SHA512 95b0d2e7d216aec6bd2063e8c6bd38a64122fd1e20e636467ab7355f6fe0f1647c47d8439bce382a15384287b1d14a951050752767adbf8d185c7755add81ce7
SSDEEP 24576:m35d9CHKy7GZyUeA9n/TM4NZYeNm+9MhUwd:I5d9CHKyaGA9n/TDbXNKd
TLSH
T14B95CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2980a786b096b236dc1efec6ac74cb17eeb6826ff06f5caed2a5ac141f74b3e0
MD5 ee0fa461dedc4f594483d7d8ed4d3f3a
SHA1 7f7381760cdfe2a25c04425ecbd59ec78b54781c
SHA512 cfb9853cb6aa1c00999707933749c47e5d8e457ea4bcab2624c20a879fa784fece3dda1505e88da4a3e3dd6109c72d7ea10e04f79f6ae457c10ab42ef54416d1
SSDEEP 12288:g+BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dC:g+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B86523824FFC09F5C7490AB581A6BB0CCDA1BE4FF68543AE470E712A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 2a2b76d91f8b5b9cdace3d818632fb48e733c07ca6438a0393d922f2d001556b
MD5 e6806caaa408b8407ce8b678d4366e38
SHA1 a611e1b4ec412c072c351e544997fd00cd71856c
SHA512 77dd368b246301ea8a6c0eda6f7bdef5fee6543cdcc53faa3c91e437d6e1f79a25c1fa6dfcea6441073cba3ce3e2c1dd2db45fbbabaa79783cbbaae500f5bfda
SSDEEP 12288:rcBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dx:rsUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16A6523824FFC09F5C74A06B580A6BB0CCE91BE4EF69543AE471E712A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 67467dbc0969db8ce51a94b098daeb1e76320558ffc8e26572a0d59482bae5b9
MD5 3f146b534ffc37f2194ec21282287d1f
SHA1 2e43e1cf89eefe0ef2b16a52ff6f9cb6fae990f3
SHA512 59d49dd698bcb469baa19d770067e618cd591abf7a416a52d9b154b337220554e93bfa822089a672349b99c401b075946994d61276b6dcaaf81da8decc5f7723
SSDEEP 12288:xnBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:xBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1756523824BFC09F5C7490AB581A6BB0CCDA1BE4FF68543AE470E72295F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ca1f96e349538561e692fad3e827d3d287d7bec29f6650c7902587db9fd87290
MD5 f3b4da90f199296f8240c977eaf1bd76
SHA1 980164ca731dd05ab0b863c7cae79d6ec244a7b5
SHA512 52bd47123f06e537d3f6872e16d3bd4d00cc105cc7b9b999304db18411fa6b457af0a45bbfa18ab8b6c3554f23e94028f02cecf5abc9e158b5b42e113e62b484
SSDEEP 12288:3hBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d5:3TUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C26523824BFC09F5C7490AB581A6BB0CCD91BE4FF685439E870E72295F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 16439689f6601a9cd64552c9322d3b14cec661d5772ee83baa7cdf4c6b405962
MD5 6ef86b2c73e2117ed73b196fb4badcce
SHA1 6cfa15e3706757b9275084d24c894a5b9f81ad03
SHA512 e4dd8e8058546c4a6c8b8a422d36e5abf65364b656c76fef0c6246f1098adcfdc3915ee79af4ca6da5c31fbe24ddc8699ea4ee4017ce922ba70c742a6a027f19
SSDEEP 12288:V+BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dX:V+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T12F6523824BFC09F5C7490AB580A6BB0CCDA1BE4FF68543AE470E712A5F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 777fd8e07667980a3ba8c604b813d0eb397277758161800425f5be303aedb39e
MD5 b97a98ca2d751a30e915fc2e4bc59426
SHA1 02ca3ef1f74c76701a7057c12caf2f828a6509a3
SHA512 9bb821019d196c970ac0a6d77a1a85da5066b4780237c38ee784c1b96294450a1c716aed829c2f7e4dac8edf477ddcb9f401b8fb756c881a7471a516972c7481
SSDEEP 12288:vpBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:v7UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A96523824FFC09F5C7490AB585A6BB0CCD91BE4EF68643EE470E721A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 f8a4ca928d10485c0b0aad4eee3ada406521f831791d20676cf37437c2e3e439
MD5 3d636ba5d235c22b81f1ca6b360ba3ba
SHA1 ffddb753545bcd3a700668777e5cf310f1c0e3f5
SHA512 d95ea79d403504242c66c665c28bbfc4d4459e77820631bf516cf937205c9c3018c1d95f203aa88bcef5596f8d55846b8e69075c24ec67fc8c37408529fc9661
SSDEEP 12288:i7BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dT:iNUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CB6523824FFC09F5C7490AB581A67B0CCDA1BE4FF68543AE470E712A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f68cdc3ad1d15eeccce126c94df06d6c6994225382763ac3ed96102860cab8c6
MD5 22fc3a47e19bfcde0865cfe39d11dfad
SHA1 904d9bf36be27b22b9712eed6f1f0d42544e0706
SHA512 e0022f0e8cba3f87a7dde97c4ad5dc3754a7843392f3c072b0a8fb8ed0d3ffc0911d85f75b4756d4e68bee11c499ffb9e16539aebe75aff242759d3c7f91810d
SSDEEP 24576:1fwv+k9RX6wkyAI9UeA9n/TM4NZYeNm+9MhUwd:NMnYI5A9n/TDbXNKd
TLSH
T10795CF29EBDC08E5E1B7923C89B7460AF6B178591B31C2CF025A536D0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 362b0c79a365396259047fb429f576bf106f93676e467b3c081214ac34301d68
MD5 68745600dca224fe270d8c9586188743
SHA1 cdd48a75ede7c83cd16ce8721fa51808cec22035
SHA512 b2d6d368201e66f9befd34985129633b0a6b0dde249707e0b589af295594b38e418a58488a52b92738fa91f37947e708f893b87185ce406f2fdeb458e24b7f57
SSDEEP 49152:yYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KA9n/TDbXNKd:sySzPzfb9s
TLSH
T1EC066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3026e3ca4682de6b3b90f711e3260a9bcaa10c70a26799d798a1acb06d79ad34
MD5 f432d58259ca1ed4be6f8ff9abc818d0
SHA1 848a2632900c345e10d4ac201cdaae8afd189946
SHA512 8453f51d5e18ded55273c02429a2f97fc2084aaffa1462c6ca173826e167e8cc2ee555896465071235936adad3897c793563b1fe60d87a4cdd6f1c7639bce20d
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOUeA9n/TM4NZYeNm+9MhUwd:447JUQj1irIhCnDHUPfF/6A9n/TDbXNs
TLSH
T16A65AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 488496ba0518c6b16eb24ea5628e7aa56e9d0412dfa650af4080c3f8ec73da8b
MD5 23809228c29516928e05e512026791f1
SHA1 934c2f57e9fc765153c627af53f873e2cdc62507
SHA512 2bc2cb720eb09f23ad1655949e5ccc3e8a6cb2fd3c8130fa21cdfa98b534bf6ba7020314f17fa74e2481f2deaa85df0e01575e5a9bb79753b7d161d78513c294
SSDEEP 12288:azsfxBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:lDUeA9n/TM4NZYeNm+9MhUwd
TLSH
T12575F04AD2A802E8C16E6279C7565A04F7637C2993E1D3CB43C0F53E1F366D09DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 608d3e44f3230fe4d76f38c6b97583cef56bd1fc67ed75f7583e775a7c3a9339
MD5 5c1b7702778b7b89c81cccbcb173d249
SHA1 6c2338822be165903b8aca4534312c62f1c40a89
SHA512 a6d17f7274d2df6d03958b8667b486c8a8d51ab0653e0af98be0ed30fe5eb593c90b6d7308ff123f5649cc27db9aa3e8d271ef392190c930115364b6b49a4337
SSDEEP 12288:wYB52MoLXgmK9eVBCXB6odqCU4RUn+tdWMsb:wyGLQIL+BJqERU+TWTb
TLSH
T1ED3506117666CB4FC66940321E36C1CCAB707D11EE45AB1373C98B3FC576A59BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 224276ed46787c6b98bef2b4c3a8bb37b45c58fd0d3066751d745204167c21b4
MD5 5d5a555f87a44b884976d603d385f26f
SHA1 4bb01610126b670b0af882fcca7701bb85594d09
SHA512 58b5f2fcde5328cc8facc54bce8447b5e21996dd8799607db097554f2e86c61c178ab5b2b6980bcc55fd2de5b8b55558cb3ef7a5a215e15b03dbdedfd30b5a48
SSDEEP 12288:IUvEo+M73sn1Vly+9rlj9mUlSMiltVl9GlL3lIOl12lWl6ltlHlqlqlhlshlAlIk:fEe73snsukp+acjf/KFZtj
TLSH
T1C9651A816137A6CFD1B76031072A9B8C7B68EC07B7059F26B7C9453AD82A711A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 16472f7a72cd6489053e9c943349e2e23f94a229d90a526bbff314ce4fa89d8d
MD5 e54409d45368b93494dc6f7e6c665671
SHA1 59d4c99763d8c79c63bb34346d419a48bb990360
SHA512 4a3cdda83d62056692344c6d80a65b1421e84c555f499f42bd36f48f8099eeeecd162211953996b166d8bd583c1851dfdcb3f7d47d261e5e0cdcc52a9f223aeb
SSDEEP 12288:4O7JBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:jJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CC6523824BFC0CF1CB5E1A7440AAB7089E56BE4DEB4483DF8609722A5E349C6CD7654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 81d7afef0c7c695d52a638c0bf4626ba80b87c017c1a85f1a1a7b2d1eb977b8c
MD5 1bbb97f7dca8fd70bcf32dfb081a7d3f
SHA1 ef9f0719a22d71895181d7fa1846532f76e9d536
SHA512 2f0ae73b0ba0fe5fbca31eb0e21f99dcf4c48b2211e96f9bfc983cafef8c8781229e47656c5c8f4f13f80e00c5d70fadefa6e701296e0303671b424b663323c5
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYfUeA9n/TM4NZYeNm+9MhUwd:Pgb4mBIBhGF4A9n/TDbXNKd
TLSH
T18F65AE1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 a292556b6180134051dec50a63843d87cf361394a00a3cddbe5f49b252960575
MD5 6a63d4185fed146a085202082c3660f0
SHA1 f2acebfe5996431d8f1cf6f3c777a1bfbb7f1897
SHA512 8acf1e97ef6432164302be34c056210dccdb322a62aa35c2434b11c6edf049d7c6ab7de31283344bf32bb006e2e379ff8d80ff19fea859e3c2a6a4fdd70b9b32
SSDEEP 24576:2G88u8FpJqH1hzria7/meUeA9n/TM4NZYeNm+9MhUwd:d7ZFPqVoa7/rA9n/TDbXNKd
TLSH
T1AF95016567E401F0C47BD13889824667F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 ec7db1a40ccd59acfb6d466c43b39f452b3c9ff37f9368ee0255ed1c6e7f946a
MD5 e842a98eb44966ca5859907ccc19fe25
SHA1 e83918025d0f393b2669bfa263ce660f9363347e
SHA512 cd71873ad79648cafaf0acf47bf1ca1541a79b1a52b8096e0e8ab53bf45b88d950660c4e099faacbb74a36e87f624a1ba0df6e94a2e87b7ab4319ae51fd812f1
SSDEEP 12288:DHvUrBFrEjwaQiBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dq:DPUr+NQiUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14E85E11F26EC0CE5E67AA17D8582870DE772B856131292CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 290c7ee342b1700d3f2819a4f67c16e2a1366d500f1ec2aafec6ecce7531ec6f
MD5 5f319763a8a80cea68f8770d3d3c819c
SHA1 18c7e20c260561cf0079132c69ba22acd3868ba5
SHA512 b3f6bee39a3f153cb51424d956184b2ec817e593ec2294e2a672fc1f297c2399f129ab1fd8ba6a16f101c688c771552a2783dc1e1ab45d56f84cbabcfd0cbcb3
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsA9n/TDbXNKd:uG05lO43b6fb9s
TLSH
T10DD5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12a44b3aef9a15089403410623672294a7b9ddf869ce6a5c1b19be321681e72d
MD5 5ad3c23867811a341d4ab0bfc50b2800
SHA1 0803ee01b5b73ab70106afec3ce0cc15b54b3493
SHA512 d85bfa06d5cd6a7db67e9819612caaf4a86bba0c2839fcd03e52f56c9c549c1df7213fc22831393750b44c5272c65c6bbc78344ff6b8b47d5038ef5104987405
SSDEEP 24576:Dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnoUeA9n/TM4NZYeNm+9MhUwd:7a5POZ3+Jt2pasx2+m0A9n/TDbXNKd
TLSH
T16F65AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9d8fa8e3ece311a40f97bb34e81f86eedfd9e4b806650296e199c56a60b5ba8c
MD5 43962afea4ae6c7a768c847d2678cf5c
SHA1 8a052dd3cda50b8a52d168a9928d5febcb6e76c9
SHA512 3fe33ce9004956d9bb5ee36df39cc8b7137f4e68cef9f9cb7ebfae0031c7c1ffedc89b1f3854e463dd91e6ba843b703eba0250299df0d0dee02a9dc8a50420f9
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkmUeA9n/TM4NZYeNm+9MhUwd:eNc/zEOVHFLA9n/TDbXNKd
TLSH
T134858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 fb0e3d8ce735f93ecb07f52aeb03a5c9169defe0e80672e471b7aed5bc6b21b0
MD5 cbb85b4d1b7f6a789f56fc7e44450c90
SHA1 d09dc26e13f913a3ecb6b59a1f08f6c325b8841a
SHA512 09df127ca460259152ebcc7e888a7b81fe10feb27e26ad4f5a6667b76a8e8422543a3b6e46ae21f7f51e19c1c29c9c6f0c3b3c727c97ac428463da421bd80dc7
SSDEEP 12288:tnHQkqj5ZI7xFR7Rpd21eRUOSdR9ylmFXP1szQdQCtvZ/astVzSqMTTRTT8X2akL:LqDI3R7RpdqeRUjRP1sgiSVXwTRAml
TLSH
T1A825025E337610F9D06BD03D86830542E5B2B8309351AADF06E8C6BD5FA3EC9B579E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 7a011890a6e63890d1bf4bcfef34c7a81731cf0c5278d70d05fdec0e4e397199
MD5 44522d2ea29704c579b5993db26b6e61
SHA1 855d144df3f788b2459071d6df34b2da62106916
SHA512 c4df825bcc7107a917df2d68dc7eac810cf1adc5d92080c69538e840a70ed607e45fb665f7284b3a99e3dae765bb0d55b760bd37c3da119fae0a2e7233737d35
SSDEEP 49152:+DMwBtOm2A9n/TDbXNKdfs6UjRNTn5wT+c:IFHfb9sE6UtNlwT
TLSH
T1CAA5D16EBAF846E4D1FEC6748D238516FA727861173293CB4290C13E0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1218e59306571eddc5f6bf14965db5b9f0abba34bab453e62e62cda4cd214542
MD5 fa4eeeb0cadaf90721d48982d893f6de
SHA1 781b1ce7c913a69794572276ff43dcb9b1dd8513
SHA512 ca70ee06b9af348cc6cc4dc32d8c10cb1ef704b0a6dadfd8396ff74e0a5822ce93ea4f88f1dcdfd8ed0651c53ecaef090030e1f4356a95f80d92fcf2e7cf9e02
SSDEEP 24576:yD3FHshBIYQgAFUeA9n/TM4NZYeNm+9MhUwd:yDVHeBIAABA9n/TDbXNKd
TLSH
T13995E17EE7AC04E4D57BD1BCC6638A06E77138AD032156DB029491BA1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-64-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/628-70-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/628-63-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/628-319-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1280-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1280-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1280-61-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1280-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1280-48-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1440-369-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1440-367-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1440-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1440-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1440-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1440-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2408-348-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2408-87-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2412-83-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2412-77-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2412-75-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2412-334-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2868-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3552-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3552-355-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3552-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3552-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4028-30-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4028-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-24-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4028-32-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4592-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4592-350-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-352-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4592-354-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4800-139-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4800-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4800-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4800-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4800-147-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5332-123-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5332-116-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5332-122-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5332-351-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5956-10-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/5956-74-0x0000000140000000-0x0000000140299000-memory.dmp

Download

memory/5956-18-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/5956-205-0x0000000140000000-0x0000000140299000-memory.dmp

Download

memory/5956-8-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5956-0-0x0000000140000000-0x0000000140299000-memory.dmp

Download

memory/5956-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5956-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5956-179-0x00000000037B0000-0x0000000003810000-memory.dmp

Download

memory/5956-171-0x00000000037B0000-0x0000000003810000-memory.dmp

Download