stealc | d7d5f62065d15685803169c3f3d0b8724349e4304b91d9816e6ef0e5138ff31c

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.5MB
Sample260930-c6e7hs1djf
SHA256 d7d5f62065d15685803169c3f3d0b8724349e4304b91d9816e6ef0e5138ff31c
MD5 3dbb73aa647f955de77e0b95cf8b789b
SHA1 2071c9e69295069d468886ac4ffefec87a77cbe3
SHA512 9f9f5c3d1cf6f6228cf9f93853c20e9b72992e8f52b257f1b4d2bb8409032ad4549df8a9b6a67cddcf2091102f2270e782b819989b35916c118f3e37ada14d1c
SSDEEP 49152:tikTMyYL/XelJpFrm+NEUAzyABqAh2zMlX5boOwcZMzR1dIgdV9fJ1BTvgPe30jz:PI6uiOVMNLFZoU023W
TLSH
T12C266A07E6B901F9D0BBD1398A979617FAB27859973197CB0290465A1F33BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/5868-46-0x0000000140000000-0x000000014047F000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
3336	elevation_service.exe
1528	elevation_service.exe
1272	maintenanceservice.exe
120	OSE.EXE
3532	PerceptionSimulationService.exe
5836	perfhost.exe
5680	ReFsDedupSvc.exe
1232	SensorDataService.exe
3060	ssh-agent.exe
5956	AgentService.exe
2744	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d31852a7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005323cd318550dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cebf53328550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fefb76738550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d83393328550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c6555318550dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5b91b328550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
1528	elevation_service.exe
1528	elevation_service.exe
1528	elevation_service.exe
1528	elevation_service.exe
1528	elevation_service.exe
1528	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5868	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3336	elevation_service.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5956	AgentService.exe
Token: 33	2744	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2744	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2744	SearchIndexer.exe
Token: SeDebugPrivilege	3336	elevation_service.exe
Token: SeDebugPrivilege	1528	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 3408	5868	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2744 wrote to memory of 5688	2744	SearchIndexer.exe	102
PID 2744 wrote to memory of 3524	2744	SearchIndexer.exe	103
PID 2744 wrote to memory of 5096	2744	SearchIndexer.exe	104
PID 2744 wrote to memory of 3500	2744	SearchIndexer.exe	105
PID 2744 wrote to memory of 3528	2744	SearchIndexer.exe	107
PID 2744 wrote to memory of 1276	2744	SearchIndexer.exe	108
PID 2744 wrote to memory of 2380	2744	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3dbb73aa647f955de77e0b95cf8b789b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5868
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5868" "1452" "1328" "1432" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:3408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5836

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 871e4de29230e63544a11c926c84171ef4500fde053189034f9a8ee80c9e3c73
MD5 67908cded2aba14275f219bca3bc3eba
SHA1 ae5d7f74c385fbb0933f593fa9f19cdd77ccbd8e
SHA512 8f3eb9d2e4d060aa9c307f5c5266f33fb95ff9efadf3087585f58edfcb971214411043602360c01f3a053c1e6e1c26017e08c294565500d01b109ba44f65e235
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnUe30jaNf1TWbdz:D3q6HjBBU023W
TLSH
T17AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e37e3fc90c2e04d7f0249f9249b1a3433d399fb6161167fd53dd5b8b4238803d
MD5 57b381f4bf21fa2612a5ac8c4e83d5ff
SHA1 738a225476466ec3e9a0e3490852c2af046e6728
SHA512 38f57f7cfb313cc215ceace1abda5ed4b34befa37b90345783f0d16c0a4bc080c6fc1a86be4021c4810e73315ee47e39c36d1714a49924766f71b1389e6ee3cf
SSDEEP 24576:MXYfDtczAqgXe4i7ojhsP5Lgrk1TWb4AN5:rtcue30jaNf1TWbdz
TLSH
T15265F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6de06a6c1287ec1c5418fe16f6eb44e9a85348851319568d2ebcdb598821e9b9
MD5 5b91312c578177ce6b394a27b43630ca
SHA1 8adca56cc9ecd8d2b8e7a3b86eede999a2417a3e
SHA512 842a8c64e37e78ed00006d939af6e8f5111e708105524bd0baf5417643ea3bd171ef04eee5c3667b0f21afe66dd705562b5f6d5234eda54452cf71a58dce3eb3
SSDEEP 24576:o0Le5ji0hmxirMQgXe4i7ojhsP5Lgrk1TWb4AN5:oPji0Ac8e30jaNf1TWbdz
TLSH
T11385AE26F6748775D073C0B9C5D2A78AED71308217308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 165e537f48943cba41d37948dac7175c0b2edb8cbe77a8ddef3497360107d172
MD5 3738fa6cc24def013575ff59f2873c27
SHA1 c34d8be687c8fdc55890ebe36dbbfa49996b3280
SHA512 2f154b3dffd8d742f7529a517181cd7bec0303e34e9fb5dee4bc404068082bc42c09247ba0ed4906e8ee9e67b15648673f90cacf363896008ebccc573ae52504
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyuegXe4i7ojhsP5Lgrk1TWb4AN5:x/ezSC6vUzPvxHjyIe30jaNf1TWbdz
TLSH
T18B756D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a2f9bfcda3245ddf818e84b8a43c5027e1151853a074b31a0cb72b6fc6fc4ee0
MD5 21f5d0036c4ea36859dfc96cadccf591
SHA1 3d36c77b1b6855038e85642242e83f75adad410c
SHA512 8aa1a9285e6d831834d64cd65a30d1195d22beee2486697c78b17d30c99e704adefab4b4ad2a94e46f9b5196ddb07c4258b1584f16f411b458607a29f0a92582
SSDEEP 24576:JVbqPb88hv/l+6DgXe4i7ojhsP5Lgrk1TWb4AN5:JVO88hXl+De30jaNf1TWbdz
TLSH
T1C8559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a245f5560390e0644fb80bab2323b74d07fc5b8fdd19cd4008614f41a0299ce0
MD5 dc6e5ad004b6817dad36e7a2db0fc583
SHA1 6b12d14a8ce46f19bb5ba41f05a89d1beef2133a
SHA512 f8d89bcbe730b94f8f80eeb04469bbab7bd46f0214ea242e1bcdc16caf15eb1c96e1ef3d2da53a87daa30013a0ffdf3cee9f69afbeff002ff7f84bc4a3a54fd1
SSDEEP 12288:xR30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xRkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1054523919F5409C6F38BC3F4A0F7CB91F5E11EC061448E6B47E0BA9358BC89ADAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5dbfec28bdbd158cebcac864c84af78284578e635dc34e69b6a955ec71d2c806
MD5 ca6f22385c81503e665c7671458d7730
SHA1 3cc37871fecd0f32f46972d8a4a73b4b09e3b461
SHA512 67f23b9e5d86abc5233dc17fae14214cd9880cec6853a904bba2182d208c646588d06257126c4c7f80ae9b4c0032cd3b2143d03cdc7609f58f22c0b4bb112f20
SSDEEP 12288:6eBNUbTVO86Uy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6JIUrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10C65CF3BEE28ECD2C27E8DB85691C740E7B278704B5293CBD164820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2b0c504abb68b4676cf3148a7a128c8f2dcc452e6e221cb64b39dbd140182052
MD5 df41b3d095f0421266dc4d079ca5625a
SHA1 eb6e07dac417f1f0b20dcece7abbb8805dc9d128
SHA512 3eecca635d549616293f4a8432ec9abeb4aaeb01f3bae745605c47b762d440cbddd71e8d53b58eb4867b707433c5eb1249b3d38aaa655ceb4d4840cc6f4938f8
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:mQvGAdlCEL8c/yRNw5ChU023W
TLSH
T15D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 276fc6028007dd62c18a70bb3f9a53a0f18683f46730ba93acbe2aedbe3db9c8
MD5 c61f5614dbafc019b58dd2d01d99cac1
SHA1 efde82cc25c0358f55c25807eec3badd0787b477
SHA512 765ef95611a84502dc0d2260621b6ead7216f156984254d1450dd5efc977340f8aef6c963a8dcaba70b03c05ee3eee425dfb6e751b6b94cf6967adee5975c6bf
SSDEEP 24576:8dewsAjRgXe4i7ojhsP5Lgrk1TWb4AN5:kljse30jaNf1TWbdz
TLSH
T19C75E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9eeebbb9f1acc30a7ae25260ae08a3833de60d1753b97e31c3862407662f7212
MD5 b29726faf3ce5ec8a6ab23ae2cbbccad
SHA1 411bd02e60a2592b86501aad3bb1a52c6da973a0
SHA512 837f393d23f2d2ae7a389fbbd7e09ea946f3c3054b4520840fa48d8a9fc69323d270b6ae5fe206ffc713bca48065f458bb059154e69d3911baa2b60b917736bf
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUp4W:VUEtQevvqc2W1cpV2EI32k4W
TLSH
T1AD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1db6126102bdd07b86e3c1aa92fef13889a411b5abaf50c04f1d3c914831d0a0
MD5 bc1366702b1b02c71edd3568619e99a3
SHA1 81f481bfdb5c254b03ccb7e56e659c63457d4b0d
SHA512 de6ab74d8450632f2176d4b8e458fcae1ad6ca2fbcd1d9ad9110b71fbb986f112fed757612785c9f40fe415e3c9a5af98341724a961872e25a9446de7ae06b56
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zMe30jaNf1TWbdz:xoq2VjnmtU023W
TLSH
T124D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 16b2bb7af3ac4c0bfc00105f15db5e51b6df90ddf5e8b59dc93ff6a9f75ae2f4
MD5 4c3e5a3e268050966b5581d13c47080e
SHA1 3dd263c1903ecd52d36c447572223a942e76f5ba
SHA512 07bf18fa87159a90c9c36a8d2f7a6b375119841704b1ef3c6324d6d059e336ff6937817f267004fe2ccdb024a8abb64a01602752e4babb3363391e3c1ecf64e2
SSDEEP 24576:EAhGLJIFoiwtA5l7S53qgXe4i7ojhsP5Lgrk1TWb4AN5:EAMyFoiq5de30jaNf1TWbdz
TLSH
T1E7359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7df7f44a198cac6634c43248595b163c1e89150c19860b71c300cbd7028954bb
MD5 881ce19b888ce005351647314ab3a2eb
SHA1 c6346972783cc32b4da11c94dc1de8c35eb1caf0
SHA512 327cd9916a15066fcc76f21e05895bb75a7a470b7681e3a53b883d9d6654949b08f90c74efaa8d109e2a9a201c181406ba21f9f424b9ef0146c5b2bb8caf9d19
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+Cx0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:lwuoOWtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12B65E14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 60da875058b5ac4dfcacedd5afba7791c6a014c7dfbf84ffce4e881e504a4a6a
MD5 a7aa002fcff9079cf7e440de1faf026c
SHA1 3fd3515ff70a5211022a8db23ec09a009307d7eb
SHA512 a180c8b8af22a581f63f306dcfcd981c559b6b0761b584e1237b58716533ec09083d1f5e91df28d84217d96b387fde958c208ccd186e726daf5c98f557a64a72
SSDEEP 12288:VBZ1Iyg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DZuYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17B55129637D420F9E29782B8D4F68741E7B23C82233147CF06A096A61F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1f5e08b94ec0d238696986faef04d833b4cb415262936bf01aeae80badf37d57
MD5 769e0015758247a2e434d339c9da2fac
SHA1 e7abee97711c706742831fc79abaa31d664f499a
SHA512 631cb9dcbbdfc89ee51e8851c7b4d0c1208ca1c5ceabea4dfd15b7454c6ffe7fa7a55869b2ed6073c402ade06ff447b17ed00ef487c7626846d7432a8d1ff30f
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:PQRQyi36YOcPQLvw2gAf+PN3OU023W
TLSH
T114667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 20b974bedc34508a15b3adead5d4f37de295eb6b9da7e17b06d2d70e15d110b9
MD5 eed3ade1943fbcedf37526e71771fe25
SHA1 ef6e65837dbf307aadf3a1c1bcde2a8d1faa0b14
SHA512 c5917571296421d2f617d37615d0602b5244eab8b53a75f887bb6abca230795b19bf66d8f446574a828f80608beeb6bd677d17ea61df230caa086893f6698457
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:iQRQyi36YOcPQLvw2gAf+PN3OU023W
TLSH
T190667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 81755a5ce94c18b84a557b492f4dd26a8fcb6cbe409cc7e78413c769673d71f3
MD5 97d088eadb91a084270717f1bbb0b3ae
SHA1 37d466411647039f55609f245e1dcc26dceb0fdc
SHA512 5434e9e417d139693b7498140a59c6b52270fb93f2028ff0b0f0ee65fe73ff650b9e4b19feaeb255a9a6b22623017c0c83be5d5f7a57774138848d36169dbefd
SSDEEP 49152:D68Qg55nhheWu7PNU3/8e30jaNf1TWbdz:9thWRc/8U023W
TLSH
T104B54933B2F20099C04DE1769F4A872196E27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 60d9cd96c3b1687bca5b107eef374e2cd1c280d972de468a048f86830636d4ae
MD5 4610e8c49ca7bf9be09d0f978308d0b2
SHA1 957d45e38c45516370d7db916c98876e1a53195f
SHA512 f975ab494b568142f3b74cf9a172c08523f2808e7d92cdba1dab933976a0c465f45f4cab15411d21ad7986c996fcd240a33c4d86246c12bf585b77bb7749ab8f
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:my5112gYy5azzVvL69nLKnhZLU023W
TLSH
T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ed2c5f8704f15a975ca3281ca3995df7fb306fe3999c532d4a6733de3623bc9a
MD5 4bbc885b8ee4d14f52976da1b7577d87
SHA1 51d5925c98f85045a0b4aaee554d39583a3eb4c0
SHA512 338ce6930349fc90d7b1ba7bacdf1f549ab224c2072ee562691bc7c0050d53e14220656a2e7a0584b8735ba4909946302f7ea57adaacd479d7538f49d74221b3
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glde30jaNf1TWbdz:Ru6JmVxd2ddU023W
TLSH
T1AED59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dd0fa2b03460f11f1d2ccf91e32ae2ac0477aa8a430a79037375300726b81f6d
MD5 c84ab526f9283fb36d72b793870b9076
SHA1 6418256a5f0915a2f2341c70ccd4fb2cec566230
SHA512 4649ef2981f1ce983ab3e3b5c13e00273eff16835ac1591d5acdb0644045811edbe98395c66bc77cd53299c6f93568c3ab993e1496cd3c9fd267d49ec103cb63
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4xSe30jaNf1TWbdz:+mifPbRtU023W
TLSH
T1E5B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2009a2e7a76bee2c53a652ddb8d05050f660a5bddb639c9a7629dd7c6317b1a1
MD5 166f9da33c3049573b6fc9e6299a64b0
SHA1 010c2222ecb7f095e38dab4e9887df56e0cdc122
SHA512 649094c9d6e2b153b50d5c3df7d89ce92a67501e75f44d7e81f2ab9bc090685e2bbc483f70670136f6e89ccf9394d5f4e8f90f66faf7760f765a2db0cb58f9e3
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqve30jaNf1TWbdz:x5dKTi61vU023W
TLSH
T1ACC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7182395d2430fc5f98a8470f3fc494ced394c0e14646af161807f1a689280ae3
MD5 b04609e23d7cd6be337df3e7599b221e
SHA1 598358a0501ca6c7c8708f99acd5253177b2c486
SHA512 47c7a6a0123d76666711d57c523fde133ea3a5af7b9aac2653c51df0a32716031e4735dd759b0b2ea501cd60af8faaf80a4977672ddd122a24940ba441c5c4f4
SSDEEP 49152:xhtSn8EApI0figngiDn0AP5wWe30jaNf1TWbdz:gX2iyphJU023W
TLSH
T1FD95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d19f395d3b90f49b03d9437e5751e82f9fda6c62e2e295dd1509c55776b10dea
MD5 ee7d9b92cbc346d4865d89722d63af25
SHA1 e4e27d451497818bbc8605df22e8996dbe786037
SHA512 85becbe56f30c0fc6290945332a1fbfa4b2ac4a0a954372b409cab0e21230cb003a968186d5c3d0083d78df4deefdae5365152bbead929e874156dcca80cb60a
SSDEEP 12288:Xf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T100452391AE5509C6E34BC3F0D0F787C1F9E01EC272404A6B57E0B5535EBCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0f65b7003ad20a0cfb8d4edf7b67da901a5b6104248ad3232716420afddd3f80
MD5 4e421eabc8ef614557ce9eb478076f29
SHA1 f343582ac9d3ecdf580ad7e67e66c66047b9471d
SHA512 2e83c0075c4e9088aa2c1377c418a1999e0b612a07a47ab9da87933fc4841bb737fe1e656b2ff723a2b64917aa19255bfd3dbb135585989394c6d92fcc1a8828
SSDEEP 12288:IE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T199452391AE5509C6E34BC3F0D0F787D1F9E01FC272404EAB57E0B95359BCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3fc63f7902f1bd3941659cc4d2778a72baec4d2360f2e92e75019be3ee667bf6
MD5 8cfcab1ca4f6d987192081c05a885130
SHA1 f97c39a8b7e96b5d8a92d0516771ae5fbe223e6b
SHA512 bb2f6710deba24631df1f8f8e5b3379d4192f02e4b0ed6d836cab8b17a1c62944cadf9f26fd96223efbf59c107529a4c0be359f7197681ff10f7dd5b0d799cbd
SSDEEP 12288:fa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T115452391AE5509C6E34BC3F0D0F787D1F8E01EC272404EAB57E0B5535DBCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4865f5eb2fe98ed41dff30f97cbdf3967be48183f403cd36a2a2b422b10c8cd0
MD5 c441f653905ff67cceb518c35844ab4a
SHA1 70ea4c26e7e73a865389ed5bc27d369a99ccb6ee
SHA512 b4a4f593057d35e4adf02c3c116a61d59b80d3689b6b388f76ad0bfe5ec604e21bfd908897bec132c669e15414ee506b0b435367526853de66d44687169dd4be
SSDEEP 12288:bVd0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1104522526F5505C6E28BC3F4C0F38791F6F13DC173118AAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8c80882e5a5d8162d6f955a69ffc099acf7066529e11a3a1b611e80b7f78afd3
MD5 44e99c2986546879f5c987d064a3a9e6
SHA1 c9153d6b97a9272015a9ad7d1b403975c046762b
SHA512 55768d29f00179e03dd56bb73b0ae89215f29b6b37865b0a3f65df4956d1268c11405c34ec29cdf8d4e5a8b3179c7517a88c1bb9207f778e2aa04df03916b4a3
SSDEEP 12288:h10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T140452391AE5509C6E34BC3F0D0E787D1F8E01EC272404EAB57E0B5535DBCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 406d2edfe5219667a2789542fca6aaffa4eec9688d238e774fae70e032b79168
MD5 7bb15827239a792145417ca5760fda82
SHA1 9c4d59af40a36ccb14605dc94990905f245219ff
SHA512 8cf6eba3fa5d5892889db1e7907518793ba9e3f1533e80692835b762f2df99bf211fd07cf9b75bfe151cec40c62d4c80eea0dc017b829c5114509ed5217ce89d
SSDEEP 12288:k40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:k5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BB452391AE5509C6E34BC3F0D0F787D1F5E01FC272404AAF57E0B5535ABCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b63c0c1dba074587b7415f1018be4d75632c14d8ed0bee885e0d6bc45b2de8fd
MD5 f0f6d66ad3b10097654086143160fcb0
SHA1 bddaee70e05bb80f53c1ddedb1763e2d5a0e1a2b
SHA512 ba4711726f5f612b61789a72156580aa9fe2b1038b27fecb6e43165d3c8f5a92b7a0174b390ac87fcb2a04e7b0397366ea6296736f1b315cebf850f6929ba1b2
SSDEEP 12288:cc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T111452391AE5509C6E34BC3F0D0E787D1E9E01FC272444E6B57E0F5535ABCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9def3789bbf69cc58df9f1e4f34386eb85a9392b00f6b776f0d6274b89728f76
MD5 bf8e90ed733952e133ccfc6f0d56a9d6
SHA1 f069347d31c5b53c081c2beadaf3d34dc82b3ab9
SHA512 6e1850d35e5b282c97e61c082c8aba1500b42c7697a1ad74ff47a1117e1a455e0f90047d4160097fa9017cea1ae6ea985eaddaf26f6b01a2723e123c57c02cd2
SSDEEP 24576:4ZMSzFVSOlgXe4i7ojhsP5Lgrk1TWb4AN5:4ZMSzf0e30jaNf1TWbdz
TLSH
T1F3650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436675F733A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ae1f27f32eb3674ec86bf9c32c16976f4f964db06434ec5398f6fa018db4e38a
MD5 f98274b3c05eb229f775111bce5533bd
SHA1 6b4ef39087af4442989f7b1484daac9ce10e2431
SHA512 444ae1e799f6c0b40f027c0e6e37c7b1e91767e7d62a6a681d4baba1034b3eb9fc7107236792e594d5b7071042972d4bce9871db090df9e7db6ea94af09efe1b
SSDEEP 12288:SL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E3452391AE5509C6E34BC3F4D0E787D1F9E01FC672404EAB47E0B5535DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 66270689299fd939ef6719f23799e3fa03658d09c82a1b4d969d3077578783f1
MD5 daaf6c74c7f9a62b02214e988fe98182
SHA1 e6ff979a8053fe65524ce29cc46d42ce65aea498
SHA512 036951432c9ca8a79321c3d965e69f32cf5c0689c7d31f1a201786fa0d94d576dec2d7b790572895f5eb5502fb6ebc13c81f6d381bd518a4b6d933175c61216a
SSDEEP 12288:Ln0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:L0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DF452391AE5509C6E34BC3F0D0E787D1F9E01FC272404AAB57E0B95359BCD9A6ACC868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5c54c798202ba81dc859998d1c422b1b0a490c0ff1841003ef6c6bcd926ff541
MD5 aee3c1b6024454ff7d574a2e7763e6b3
SHA1 85104b4b5576577f1b6a593d93ae6f4566fd45fc
SHA512 4b5b41cd158d44261600415b1fa2b20138ba4a790c85f13bce370b73bb0d731f3712672906ab3dcfb7212a0650499ae2d534d639aabfc7c39c9de661d438e36f
SSDEEP 12288:FyPz5L8g0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MzyhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10055015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b14819f04c7b66a350338efef50c603a2b236414655be8ae481dcb8510225391
MD5 d79ffaecb0f09d80da2bf54018acf1dc
SHA1 1f3b5610f2d2117292bd30ae133804e2452bcc79
SHA512 240e2282050d8e3573bbfee08c8ba7c8c66045151b2c0cd19e5de2315b5dcbf3d16a150da1dc6a442631aac48dbb66462247f0e2c3ed153dabbcc962c942eafc
SSDEEP 12288:EL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D1452391AD5509C6E34BC3F4D0E787D1F9E01FC272404EAB57E0B5535DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 93efd4a7a0026f80f52c01e6c3c00dc634fa29f0549ddf48e46e9f732dd0ae1e
MD5 41e4613675071dced7fc98405f036de3
SHA1 b452adc9b29ea68389a6a022366cae5c350c7abf
SHA512 7ce7fbfc29f913166d81f9662e4870e1d117aacb0e2d044298779a3a2552228104bd12a513871b576183df231cd62c2f710c97c0b3c0deac1729be708f8efad1
SSDEEP 12288:VL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13F452391AE5509C6E34BC3F4D0E787D1F9E01FC672404EAB57E0B5531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 92781cbb6009df74a904978521277e7dcb726df243fe6d69c6c265289b798ece
MD5 64a15722b6c241d26dcd48be48ef92a8
SHA1 25b7dce2817c429e4449c159762b3a69722c685a
SHA512 6a6d2e1c8d7fe9453e4ee6f496e83506e4b374a8449f011c580e8c74d35dd0174b986d4db05eeefe11732a100721b8bfa11bc5d71f0c9feeede625755698f0a8
SSDEEP 12288:jyPz5L8g0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OzyhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17C55015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 5a58ef3a778f0474d267664130661ffffb942b2799d29b9f71b2d7cdedf2241b
MD5 d4b75063ff23265d53b4968fb2fc969c
SHA1 113b4073cd316d966e8bfca0ad58d861f1c1864c
SHA512 b69afd01a2b0c64aee11f687427d2bbe9ed3cbd7e9f16fcd22c5955acb8c95bae732b81f149e8dc5abdc050e9cbe32ccf08bcf2b969b17e00cf7ecab42b5a5d4
SSDEEP 24576:ZTHaLl3z0zDjgXe4i7ojhsP5Lgrk1TWb4AN5:ZT6Lljxe30jaNf1TWbdz
TLSH
T1F6650295B3500CF8ED67827EC8A68A02D6F27C560760CA1F03E436675F373A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 24485ff0ab57eba05f262b39da1cfa3af5ec999b57d0e6d33744385ba564b3bf
MD5 ebf3f014cc975d9ddce45f836875626d
SHA1 52fdc6b25c95ca92cee5ade2ef2a6da0c69e5641
SHA512 f2e74092fa3537706762ee9d12095611cd0f2390cc1f16ed1b63eb34efb06e1d092bf2680928ee4e7e7f44abc58963a164f14990846db22c8485fef1975b94b7
SSDEEP 24576:V37d9CHKy7GZHgXe4i7ojhsP5Lgrk1TWb4AN5:17d9CHKya0e30jaNf1TWbdz
TLSH
T18C75CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1ddb92d46696e891af9c4f6b8484da65c9959d58a6bb43d64e733f64b1473b7c
MD5 5268e751bff567fa8c9f2582f4d0023c
SHA1 de2c5683d7a753a13fd7cb309634fd7d24a41112
SHA512 5cff5b932fcb7985e4209c9035034cc6f70c3934543db42450c2b9bef56879ec617de83edc140af0d797ea823adf5643be95ab0deb3fb69cc7950674384312f3
SSDEEP 12288:060DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0TgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18E452391AE5509C6E34BC3F0D0E787D1F8E01EC272404EAB57E0B5535DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9f6194f03b01d9be2541ad436298af09c13b0856aa7dc9239dcd0ac6e6385eae
MD5 52411a6fa8ca830da5818571c67c798c
SHA1 805a3b7f15f327b48a765496894e35573521d386
SHA512 2bf7814ad299c6b225502c9b514513bd8a6858d0893e9144f1343bd70f7816addc2766ae13f636e66e3f9b68e508a5ad162185f8f41d6171e669466cca4ef092
SSDEEP 12288:PA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F4452391AE5509C6E34BC3F4D0F7CBD1F9E01FC272404E6B57E0B95319BCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f6d77dde7952680c386aab56a741a1630d7d9f6f5d3e6e86ff97cccd628236a6
MD5 674d6c87c47fedf5dbc9820f2f587851
SHA1 7097f678a4757de493d51ebde93ca888dc91e05d
SHA512 ab20b42ec6cfcb551cf10283837ec42ec6d4b4af628af71dacf8dd4daa0061041279a1fed1b47ce2951b8a0ab55c54117cdce834d503b81c78cb9aebf8c92198
SSDEEP 12288:FJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A452391AD5509C6E34BC3F4D0E787D1F8E01FC672404EAB57E0B9531DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cc27e2b867e0191c555a866c4f117907906e515a7f2a679330b84c9057d10f53
MD5 a70283fd8e4552f8d984a69d6fc7189a
SHA1 496622c4d96b57677a9b74ed7d5d92ed9638701d
SHA512 e823d7c4f68a75109ae0763fbb4ed550154f0c66d7c2caadb49bcb9969fcde0fb1a034696dfa3a16e7e90774f47a0350ccaccc0a7e74ed4498c4880dc5ef6119
SSDEEP 12288:CL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T117452391AE5509C6E34BC3F4D0E787D1F9E01FC272404EAB57E0B5531DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fdd5a771419bc78cadfe4ee8fd05d227b8b5892b6b4524f604782c0035ba86ad
MD5 007c3214ac27cc1773dc55a0ba864343
SHA1 3896e921827ec853e5a0f5f5848c6ea5efdc3278
SHA512 781f2450594fbb90c2ff93f31ccd5b99147b9074198236260521dd7a9a589a94f2389a3d4e86eb53b62323023c9dfad285721e26a82cf3d574a803893e8de610
SSDEEP 12288:760DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7TgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T145452391AE5509C6E34BC3F0D0E787D1F9E01FC272404EAB57E0B5535DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 868137dd89b7a71c1d0f222da1f97ca0a4c274fafdd6aaba0d534569e266b6eb
MD5 518aa377b4493d73cba15a9f9ce3d84c
SHA1 fa5e6964fb90558ae9686f803a3e70e162814b50
SHA512 2cb5f043741319aace2321fe5a230d75f9e347bb652432feac7623619e32c7eb564e4d012f8b4f8b7a70f90c5519320030427232f3c7e07737cb5f05543ea9be
SSDEEP 12288:Yj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T127452391AD5509C6E34BC3F0D0E787D1E9E01FC272414EAB57E0B9535EBCC9A5A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-30_024112_5868-5072.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-30_024112_5868-5072.log
Size 1KB
SHA256 5e01611a84e1923cc762a39d85d7e14839da389139db95cd4a1d39d38a2d90d2
MD5 b653d401d37f32038da2d7eb4df89104
SHA1 bb19fa3517a10697402b00e3dfa4de78b5a5d458
SHA512 27dd95d8e8039d354f45381cfa6c4841dac4cba27c0ae487013ff63e5b5940023f27611dfa4f981d624918cb0f1b3e43e2f25b0e162c2534cafa382001da5436
TLSH
T1BD21AF1A7BD80A06FBFA9EC299F614538E3939922C31DA0D10E4534E0931F44EEB0327
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 caf7d2a1597d5d3cc3fdf83cf6e8efe343c319df05c3c6e25894f153cea2cd3c
MD5 062ddc6f942325e06dbc6cc7c18e8f22
SHA1 51d221190ea67cacbea9bdfd71da174263c9304b
SHA512 eb90edeb6c7aff64b34569c3691172abe4f10161fb0511d86c87a79abead11a4982e3b526abd8713ee8a5770730c9f9f06308c85a6852e3aee5bc9476fb186e2
SSDEEP 24576:ufwvok9RX6wkyAIEgXe4i7ojhsP5Lgrk1TWb4AN5:yMnYIre30jaNf1TWbdz
TLSH
T16C85DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ed2562fd11c319f846eae2e4b5004cce89293ce8733db6dbe749fa46788df7db
MD5 a7104f8f2fe43afb3c3160cb98bc1794
SHA1 f3c969800df1388ce9a6bec144d494ce014e2bb1
SHA512 9889bcc57ca1bf1fd6ba269be4a5a12726e491dc24cb330703360f58d25d54fd027a75018ca61a8a764e4d5618f28f61c55ca75acba08cc2eedd0365980cec7a
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02e30jaNf1TWbp:NySzPuU023W
TLSH
T109067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 09be0232f4ad8b04ffcc1431f5c0191f783509702d8f86044caf38df5dfea6cb
MD5 fd04e651802338cfb6963a9eff565423
SHA1 66e4cbd65e48ed038beacf367f06aa7f2a7486a7
SHA512 a15837e2f155041595731405ab01352c9f1991aa09d31f7a4a7425aa77c48d82714e6efe48a836ceb66b35faaf1732ac62ca3d77aeba21516a6e64447ef955f8
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY1gXe4i7ojhsP5Lgrk1TWb4AN5:T47JUQj1irIhCnDHUPfF/me30jaNf1Te
TLSH
T15F65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 eece4c7edd319698bbd75a2ef651672e41d1147b1c93823ea6c3e80b5195e4c8
MD5 6320d299d8f51640160900b1132697bf
SHA1 998368641126e5d48ab95ebbbabc1dc627511c10
SHA512 e44f847e5de6f14ad13c68e66ea6ec46ff7ee931bde01f1cf5358f4322c9d5d2febc8b4a95f0067f882f78ee791f8e93729d5ecd849583527ec10bcabd73fa48
SSDEEP 12288:qNsfb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18A55F05AD29802D8C16E92B4C3968A41F3733C9193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1f6526d448ca669ca90295b1a4fedb694cdf897e6e828c509dd3a52493593d77
MD5 0046fdc34d53e082505e78d04647ca7b
SHA1 74b2b5acc9479a5fc8830eb1bcc1ffda200c08c7
SHA512 e16a16f09df13506163f8b4ac547bc87db767ce68b60b64981d56d24035997c9f6480ae4a2a1c1dac8e4fac673f3716a747918c539a01a1b6438b6c02083f5ff
SSDEEP 12288:i9tnxzX6U3fOJV1GHZTN0T5LMR7AzWewDJPJ1+TXip8C:i9tnRKUPOJs1aNLMKzWew1xQTXip/
TLSH
T1EE3517417666DB4FC6A940322E32D5CCAB707D41FE04AF0373C9873F9576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d4f3c04a4537e8924d003f3b4b7186ab27b1d0660df8603074a61455a9219d77
MD5 657bd19b3cc33f8c4f7a4cc06b950df3
SHA1 e7ce5392895bca9f6b67d46d511f9122665a8411
SHA512 bc5d33205543b51d7938d40bee448e4baa070d51cb075a872ab1e6848359941ddbd55036db73b9011ac6c8eb23c6743cd8ce46e2432782c87080e01e7e803b66
SSDEEP 24576:wqlkIHYRD3rbLDOdl7U6LvcxMgI0TPBLirb0ltLhpbDmkTxRhwpDiJ:QIArbLy6UY
TLSH
T1D165D9815136E7CFD1BB5032032A5B8C77A4EC07B6096F27B389457AD82AB51B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 74aed45390f1c7dee3ba0513df1aa221da8c23e1866f4f78d289f9253c6c692e
MD5 175125cffdddaabbf6a7ca8e3a52aa1b
SHA1 73155497172651bfbb40bcda8a115440fc40a9f8
SHA512 6d7b68796981f43900a6fa85ef65b837031269bb9de8a67b0d21c1c172461f772b2200531f651ae7a663c8b73f168d25840a0be68875290c026acff0b28812d5
SSDEEP 12288:YF7z0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8wgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10F4523629F580DC6F29BC3F090FBC760F5653EC0270089EB96D0B6931978DC99EB8919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d823e4caaab15b1d63e7f943df043cbf252271367ffb9d2212d54e70237c7b25
MD5 512ae9cd97cc64c9afdda75d97fefa8c
SHA1 86f17e0afe065b30a134efe699168d48ba7cbb95
SHA512 b8330982d6aa6cef482db4a3ceaa86b8827ba1fcd0b79f2fca14a7cba2710d4bfb3f7166e266ef9f60ee53a19e5f11b087fa14d1aaacbd6aca18bb976b8fde36
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYegXe4i7ojhsP5Lgrk1TWb4AN5:rgb4mBIBhGFge30jaNf1TWbdz
TLSH
T14965AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 81dd1ff8c4fc44e6bb66e5c1fb97000107eb6d29396a948a13d7aa2b425978c8
MD5 b9d9675b5216066141ab4261ba4ef8d6
SHA1 bb511de4e75adf153296fca39f1306ff9a596285
SHA512 8bda3061dd9203316fb166cae8de448e5a3b71c52c275927a913a1b882c3182ec7511ec2127e09808d6888f012a87d80afdc661eeb93db4bc085b3601977321c
SSDEEP 24576:5G88u8FpJqH1bzria7/mlgXe4i7ojhsP5Lgrk1TWb4AN5:s7ZFPqVea7/Ze30jaNf1TWbdz
TLSH
T12185F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4713f9e896141e378b7293153fe68ee71a91ad6f7d979c9c48ce5187482c4d62
MD5 2e7ca0c1e566ed7f1d3655776dd2243e
SHA1 74a02698ff673079a29ea2ddc22d0621e74313b1
SHA512 7a070ee0692e3fd5f05d5174c067784d5887e7d3e66569d7a686980619530b50d706d4f5a1bf2bd750894244b79edbe013c3765ff11f035cbc265e67b36ba157
SSDEEP 24576:LPUr+NQJgXe4i7ojhsP5Lgrk1TWb4AN5:LJQ0e30jaNf1TWbdz
TLSH
T13365E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e398c7894d7145120634871971519d834324ea859137f35cb2e948cdbe0dd182
MD5 52ff4bc4b9c682265d277b1dbab872c4
SHA1 b05eb3f7da5dfd1512c40faeac6f8f1a5ba5adc8
SHA512 a88e83e4bc1645c65da5aed62b158933d86476f8883e8eafb18c0ff4a30406fc3d2779e019fbc5a262626ffe1832e3d27c2cb7db81da4d6bfff6278c3c2133ad
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEe30jaNf1TWbdz:8G05lO43bzU023W
TLSH
T1D7D5C06E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 77c05218d3252ed162b9b3a1ab5e04c789c1c28816be1f93aa793e4c5f4ac5e7
MD5 addc2f8c593c4f55000bdc8176e415b3
SHA1 7cab9de681ba263fbf3ad0268d1140dcaa2f5bef
SHA512 d9523b17122caab8126c22452dc452c3e357e15c6e224f437798a2348dea95bbf51be420a0b25ee6d5a37e9b5f4f8709b96553a6b97fa8fe58ce67e0ab37bc45
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnfgXe4i7ojhsP5Lgrk1TWb4AN5:Ra5POZ3+Jt2pasx2+m8e30jaNf1TWbdz
TLSH
T1C065AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e74ca249c667aeebea763b722a86dd8f049a292d8e81217b7add2f7dd420ff7f
MD5 db39afc29835a98bbfe631db6ce8f7a9
SHA1 e5c16ac423ed57e0ebb27f9ea53e9eab0ca75b9c
SHA512 be06e6a47df0581e80950fbecff9f0c5996d40f6c43b081bb049567a6985072021bb5a13d67e00707ecdf434ad50bb19f1e0bf1dd0361997507a9a3cde7b8f54
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkNgXe4i7ojhsP5Lgrk1TWb4AN5:kNc/zEOVHF5e30jaNf1TWbdz
TLSH
T1AC858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 52e501d1bf5d640226f345476dda7f570e9094c432bffb1ebd69ea2fb72c39f5
MD5 dd651086aac224d379c22e0b628bbd8b
SHA1 e7616b6244ae09cb9f1924ce987445839a0547e7
SHA512 40a7bc3684ece2fc8c06739bdd8c0f198eac810c8115e24c46f08c1381c9feae079396699a9ff9cdc7e32013f22aec91f4a0efb8499ce6ad1b7d2e90804207b1
SSDEEP 24576:d8kNvNnaFeYhJNtmZBmmgXe4i7ojhsP5Lgrk1TWb4AN5:d8MwBtOmpe30jaNf1TWbdz
TLSH
T14955AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c0ffbfc110918bf3b5b291484046104dc6fcdf8514c6a9616745875822bce71a
MD5 a4e89c59d3afc54d98b7744b57421a7c
SHA1 3f7db8b5f4efec3608e5374e9717287e66953c42
SHA512 09ada61119bd3f4b3c8f4253eb34ad3996fdb9bc35451b1f1a718b5dffd23d919352617ae445f63a7f44fae50ac8bb11e4e4f1b3cb0a103bc39b6c50aeed5e54
SSDEEP 24576:9D3FHshBIYQgAsgXe4i7ojhsP5Lgrk1TWb4AN5:9DVHeBIAAje30jaNf1TWbdz
TLSH
T10975E17DEA5C04E4E57BC2BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-71-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/120-265-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/120-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/120-63-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1232-110-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1232-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1232-321-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1232-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1232-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1232-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1272-61-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1272-64-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1272-57-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1272-49-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1272-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1528-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1528-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1528-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1528-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2744-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2744-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2744-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2744-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3060-130-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3060-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3060-320-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3336-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3336-23-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3336-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3336-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3500-335-0x0000017481830000-0x0000017481961000-memory.dmp

Download

memory/3532-315-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3532-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3532-83-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3532-77-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5680-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5680-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5680-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5680-338-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5680-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5680-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5836-317-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5836-93-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/5836-88-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/5836-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5868-41-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5868-0-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/5868-46-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/5868-7-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5868-8-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5868-1-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5956-145-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5956-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5956-137-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5956-143-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5956-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download