stealc | 57353f04a0db7036246d16a8eb7bc3f56bdbb81e1dd32921b2717f8e753e28b5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 2.7MB
Sample260930-pdfnsstygz
SHA256 57353f04a0db7036246d16a8eb7bc3f56bdbb81e1dd32921b2717f8e753e28b5
MD5 3ca3dd9e2edd9aaa7da20abbd9dcaf9b
SHA1 5bdc57ff1667f74748ac4e2f6e3e4a0b433a5a95
SHA512 ae0cf1696b8b79f8cc26aa06e4dbdecfd68c3b587984d77770ad6652664c9957385cdd33e637d30ae479cbf2384030393d188f2dbb12da12ba521afa2af8c2cd
SSDEEP 49152:Id38ElBPsREFbY8nhxSMmT8oWgBCaX4h55RZnpUOHFbHshxSMmT8oWgBCaX:cLn+M4FHX4h55XpR9M+M4FHX
TLSH
T113D50159A6AC41F9D0B6D178CD525517EBB2BC1A5331D2CF03A0269E3F376E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer upx

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/3152-202-0x0000000140000000-0x00000001402C5000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
5088	elevation_service.exe
3852	elevation_service.exe
2744	maintenanceservice.exe
5884	OSE.EXE
6036	PerceptionSimulationService.exe
1440	perfhost.exe
5268	ReFsDedupSvc.exe
4332	SensorDataService.exe
5700	ssh-agent.exe
1248	AgentService.exe
2116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\52b2f52c3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x0000000140000000-0x00000001402C5000-memory.dmp	upx
behavioral2/files/0x00010000000093de-196.dat	upx
behavioral2/memory/3152-202-0x0000000140000000-0x00000001402C5000-memory.dmp	upx
behavioral2/files/0x0001000000009b92-201.dat	upx
behavioral2/files/0x0001000000009cfe-200.dat	upx
behavioral2/files/0x0001000000009cd6-199.dat	upx
behavioral2/files/0x000100000001b93c-198.dat	upx
behavioral2/files/0x0001000000009952-197.dat	upx
behavioral2/files/0x000100000000934f-195.dat	upx
behavioral2/memory/3152-86-0x0000000140000000-0x00000001402C5000-memory.dmp	upx
behavioral2/files/0x000100000001b93c-382.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090d2480bd550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc5f6407d550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001dedd847d550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090252807d550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000439bd808d550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5088	elevation_service.exe
5088	elevation_service.exe
5088	elevation_service.exe
5088	elevation_service.exe
5088	elevation_service.exe
5088	elevation_service.exe
5088	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3152	2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	1248	AgentService.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: 33	2116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeDebugPrivilege	5088	elevation_service.exe
Token: SeDebugPrivilege	3852	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 5308	2116	SearchIndexer.exe	100
PID 2116 wrote to memory of 3964	2116	SearchIndexer.exe	101
PID 2116 wrote to memory of 912	2116	SearchIndexer.exe	102
PID 2116 wrote to memory of 1872	2116	SearchIndexer.exe	103
PID 2116 wrote to memory of 4368	2116	SearchIndexer.exe	107
PID 2116 wrote to memory of 2660	2116	SearchIndexer.exe	108
PID 2116 wrote to memory of 4632	2116	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1440

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4332

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 19aa7063b1939434f53c6a836488161e21b1e6ea219525cddfbe576aaffbdf1d
MD5 7a7973bea9ac90369c84360f02913645
SHA1 a6b5953fe6742be3d7e9bd79cc1bf1dc64f227e5
SHA512 adc42dc76ac0f8bfec21298414caf64fc7347bfaa1c089657bc657ab4f39cb70d42c84623ef9617dc32d8b5496c5d1166084e53d0a2b172f1087fa684db8e113
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7hxSMmT8oWgBCaX:u3q6HjBy+M4FHX
TLSH
T139D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 0ae27512bda8608027c88628a132c8673864b4bc1dc2aec61829889058d084b2
MD5 a171b5007222b6c22583c9dfd7fddc6d
SHA1 c8aec788d9f4545e6ea0e26d78504abe65894698
SHA512 61e40374ccb871276ef1d985f95ee8e66302f57387e66408f17f00b9a25c714f06827380d15b5bfe8c808968350f4d616c7cf4b593d360d5940e4a24a7e9640b
SSDEEP 49152:QLclhxSMmT8oWgBCaXBh55RZnpUOHFbH:QU+M4FHXBh55XpR9
TLSH
T1E1C5122863E548ECEC67823DDCA28505E6727C454360F74B07B89A695F333D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 f0bf0bb2329334599ccee6005d182564ad868911b01025c8b1a4a8eb7c65c3a9
MD5 234e4a8fd70c742935e61ba7cd53555b
SHA1 5ee028e765cbc53a0a61f2e4d6ff4a6ec8910f1f
SHA512 519536355fa0a3cc47dfec817904341eccdd068348334bf04b932298287b6661e94716d58cfdc1092fb44eb2785c0d769b21183d143051a32b2b8a70c0e9868c
SSDEEP 49152:ALclhxSMmT8oWgBCaXBh55RZnpUOHFbHMhxSMmT8oWgBCaX:AU+M4FHXBh55XpR9s+M4FHX
TLSH
T187E52328679948EDEC27C23CDCA28601E6727C444360FB5B07B85E796F336981E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ecd2647c37d0f034779d4c0d92d0baedcb5455a17b34317eb0cc35efa51fc8f4
MD5 eb7869a14e6fc284a2cee5db39d2d8a9
SHA1 2997a0907c3cab73efe70cff84c05cc32b95fe46
SHA512 f25cad6a4315ecc7513679545784c6187e5737fc9c1769c9c391db5aaef969fd2fb01964535c5a623ad86a25f9c97ca1378a23dc644db545df8a0cf8e5c644a4
SSDEEP 24576:uXYfDtczAXrKhxr+EHNmT8oW4ll1JCrLKXI:ttclhxSMmT8oWgBCaX
TLSH
T11985012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8986682d6606807d796ff45ae4b595411cea0b9797114389801cdb64c583c3e0
MD5 78ed39f0402612ee7821d1094583d668
SHA1 60893e4a87ca47470af315cd917c1a0ef97754e3
SHA512 253a415d721797a5202820e7a5ab66af627ee0495911b24635ad9d83e1969c2b66f7f0e51fe4d26ff61466d46c76c7b8e7ade58cc7b3fbbce6c003cf36de55a7
SSDEEP 24576:r0Le5ji0hmxYrMArKhxr+EHNmT8oW4ll1JCrLKXI:rPji0A2MhxSMmT8oWgBCaX
TLSH
T1FE95AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a23a911d8dbc6c4540fa2d288206dc70ada1723f29bc3706a697b4c0841c9d7e
MD5 6fed2c208b7d6a6da93e64c270f6bb40
SHA1 e4d4c00cc8cf53a47613a01144ea81ef1bf5a9dc
SHA512 5d0efca9ec49ca48f18b4ddef3d32ae5671f10dd5686cebfb9cb3455afa15222b1c79191075c1c7dc3e7f502505bc646f40a41ec6bc63c54c2fc966374444461
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyuCrKhxr+EHNmT8oW4ll1JCrLKXI:A/ezSC6vUzPvxHjywhxSMmT8oWgBCaX
TLSH
T109756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3c5544b3bcfaacc7afd94633d24e173d47d8889626afa968e3e93b0f91b2f652
MD5 c02fa862f91a75a56f74fdec98ad9929
SHA1 d5a6539f6404935609ce1b2b3f7b97c35dc8d281
SHA512 1ebf94f022b458264e684d95be28c512630a7163a7e9b5b8c584d8a234e1755e77c05af62c34cfbefa2b3a48755e14cc19611f61e471914eb1423c930106c2d7
SSDEEP 24576:7VbqPb88hv/l+6zrKhxr+EHNmT8oW4ll1JCrLKXI:7VO88hXl+HhxSMmT8oWgBCaX
TLSH
T1E1559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a2ff9f8b96e7a582a2f3927fcfb6b625e47a920324ee3a7c87d85c4be3b9e5e6
MD5 78cac7a56f85e62ea7c0c257cd73cc06
SHA1 257bbac6c6f5cb27a85135eb267ed3f5ba5f87b5
SHA512 89486806097e86701cffdff2dd4a437f466f13b2cd03a008861d3039ed942cf67f3f64b876acab0136424e97cd286eb173f5843b346b985fa36caccb46eb7ee2
SSDEEP 12288:RHAJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:RHcrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12C6523759F0D64EBEE3B8335F872571299990DDCE1412E3B9F3A3FA83934C5A9052212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f22d5d0b192f0b04d062350eae690c46cd1ad0757c8fde45ac63ee84eca5f74f
MD5 1deaf72b946583f6fb85b11896cf03b1
SHA1 2f9dc57c0a11d2ab33782295936bac5cddcfefb4
SHA512 bdac6fe752d3d6c2aa1ce6d4e423318d86683a19064bc8e146903e328f8e277aa1722b9397371b3cf50c8e785b395c5dfdb860016e53380f40479f76dd7874d7
SSDEEP 12288:UeBNUbTVO86UVJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:UJIULrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C585CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d083e05e03d64541c7ba641329cc7d427d6393a822e299c3674f55bbdd6d6cb9
MD5 78ef35928a4f407c9771601e778e6ebd
SHA1 417d4c2c2753e6d7b10bab3f955efa004903c98d
SHA512 a541cc46c67862ffab9302159e1cdc35a000140771c5f06d748ab1c1f30dac3395e453528294484ec76cb4942e0c4e84d031553becc22265c7a0768dcc1bf269
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:9QvGAdlCEL8c/yRNw5CF+M4FHX
TLSH
T18D266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 692334b6abaa3239d5971ec0f83a327dc4f1c1967e3c05916471fbf9ee494c99
MD5 520e4a862e021e1756c93b65eab4a3a5
SHA1 2db44b9a964b439da18dfd73703f0a2df22142f8
SHA512 1ced04afaf9ddfcc2646b7aa3f03993093d0bcada918cbdd47ca68ac3f579ac23a61d71be075f3677d6c3ea8d8d7ca96d274b0fea1fc1f74ad322bd724d64f09
SSDEEP 24576:a7ewsAj7rKhxr+EHNmT8oW4ll1JCrLKXI:4ljqhxSMmT8oWgBCaX
TLSH
T14685E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2d736ac4bc4ea8e50328233bd2d22e12928fc83c508eb7fda779253f92b65ee7
MD5 f73bad3dd82e15ca1d10a3da0f4b81f4
SHA1 427b8e47d9b38b5a10efce5d7069f6e47eed6e2a
SHA512 1a97fdad441c7488a0e6f96b7479bd68c828321e44cdd2e0aed1b535dac959849c4992432ccfa6a66bf35e62625069eb422496c0725f7a99662dc262528ae733
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS4:UUEtQevvqc2W1cpV2EI32S4
TLSH
T116474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dfdfc9911b855a0e2caf7fd7d0bd26ed19f3a3f85b733859676284ba7451da66
MD5 88dc6986ed4a065d57bae95b635a21a4
SHA1 2b101fda00f51fe7c688132e826bdad235d434a4
SHA512 ce3173abacfd50969ef50173b08ce3e8cbc8c75552c1fc4142943c83e5819fde31c18c8ddc605a883fe582b2b96928ac8fdaf1d95b52e9066c6d89c26974e73b
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/z8hxSMmT8oWgBCaX:woquVjnm5+M4FHX
TLSH
T1A5D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7026135b09bddb7c936ac6081b63dee505cb200e2a41920818008037f518197e
MD5 1f0289302b8b50a616e860710ba69cec
SHA1 50660e6c1e5769e9075296c1f8a761d1d5c90f9d
SHA512 461359782f473ab49c380609502aef02ae34a5dc452b3364a8b321d05c92d9e4f67d39585aa0a040878cc2516f6de42eb67c87ef56f3c28257c3462a37fe0bc6
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53orKhxr+EHNmT8oW4ll1JCrLKXI:ZAMyFoiq5LhxSMmT8oWgBCaX
TLSH
T12C35AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 19d3ed9af0a51ff69d2a9291e8e5c1d0df8214b27322123a59a37035011d4998
MD5 4804b840a82f8b2f0a41fe772ca5ff20
SHA1 cf71385f8e0e1399b54d5f96245b5c603544c58d
SHA512 3829b577e75d4698c0d06cdfb9aed1293353617c564863971f7694d357fb1b3a6f4c404ceaf9ae05a200f3a0f5ac8a327aa67941c355c6f28da20854d3acfb45
SSDEEP 24576:pwuSOWprKhxr+EHNmT8oW4ll1JCrLKXI:pw9ONhxSMmT8oWgBCaX
TLSH
T10485F14677A91CF9E9678239C557C136F7F2BC052621DB2F0770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 71dfa28005ecdcc2d65fd9fb66c60053acfa0d3e58d0f98f08fbb756e0b4fd11
MD5 0c40e1732fa82a19446d499d8b2d041b
SHA1 2725f6fb812c0411bd338aaecc341897035d0f50
SHA512 a49ccdd6c930671b94a939421bacf4cfdc422eade0f622b4b2e51955cf014cd5207f05ae441546b7b55381e85b5f26d9436342cae1592945616c4c5f6e98c136
SSDEEP 12288:QjZ1Iy1JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:MZuKrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14275126A279870FAE967823CDCE14605D7B23899633143DF1A354BA92F33EC65D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6a8937ea98a599825a5ed764116316b6f1bd5934c8f6aeffef18cac566c981f4
MD5 2ab741b246272b8ad2309618f8949c86
SHA1 57645202e805a75d9b3c9a294061cf64e68b38e8
SHA512 1954632b6f43f35464c1c0d8cfeedf0b227c1b9b2060daadcdcb230e1e133b87097df53e53f206f3c88a90f3f9de09a08c3058a4b3493298ec9ac311d38fb120
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:OQRQyi36YOcPQLvw2gAf+PN38+M4FHX
TLSH
T1C5667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ba0dfe8c6bacb89384d64772b52bbedaf3535210fecaf8bdf8d672acb2332027
MD5 31df89bf31d8c19dcfc19a193b73cf33
SHA1 0446f34fe405a40a09e963f7f5626708a9d29897
SHA512 e669a9f04373b9b1d80a0ab5482b22cc675a977d14bda4bacbc7f58330ef3e0cb5993c6b844fd0c795517a9c07e30ccd1ddd65dc971617358437c6b0937d0860
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:2QRQyi36YOcPQLvw2gAf+PN38+M4FHX
TLSH
T167667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ea4fd2f15e63c62b102835e30fb03ccb004311ad321c4743fe1dc0e51e5f393e
MD5 22773b14d580faf4341b08527d385f8f
SHA1 b0b8fe7afa54a7f8ebdc5cb17d93bdf4a6d90a81
SHA512 4d407b5d0ec61e5f713abfff971071dc538783dab8ac03179814a8b4083a73fa7606fd22966189444926f992fb129890b4d941bcd2c036e38eff7d88650caa7a
SSDEEP 49152:+68Qg55nhheWu7PNU3/ahxSMmT8oWgBCaX:MthWRc/a+M4FHX
TLSH
T188B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a7bd4832d067e9fa2cc9c5f28bde53944ccc0f9b026d3d7e35e593383d361aca
MD5 72be0361acf6817b63951faff8fbdb10
SHA1 3e73f9336a3202ee485a5799421f399756fdf151
SHA512 81ec6ead41ba1acde3b07ef19d62d7999ed4301913cebf0db6cc9d2d47b441b2ffb6fc453eb5f9548aa8639aab3e7f79549620b27faebb143d05e1bb65506f1e
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:Cy5112gYy5azzVvL69nLKnhZZ+M4FHX
TLSH
T15B167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a0963da33a5a655c44103595b2fa71fcb34cc026dd57e68045a1db811b2a4ab2
MD5 da89ae0d9ce180852b601276cf6bc460
SHA1 2c9e9df55954174068f4888ac994083cad029305
SHA512 fbdc127a27c3859be30c59b42114ce76feb0f57e2838a66b8e88a734b5fea4ae86b365d66d6181c97387a1c7fa91147f51383c35b803ccd6259f5798097a33bf
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGhxSMmT8oWgBCaX:9u6JmVxd2dG+M4FHX
TLSH
T103D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3c84e070ad31af4b1d7862520e3996c95481fd347ff23bb0cabd36587e45cbef
MD5 3647d56bb84f673243082ebe3290640f
SHA1 8e6bdb49aad9fd571d1a38705d8067d1dc3eabbd
SHA512 19d07ed6be6f01b11323e3d775048335e8e3d472ae061beff4aa5535c4af265717037aabbe27ca1042abc3e41bfff4f4bb8ab4c1c660cb589d6f6f315138b3af
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xghxSMmT8oWgBCaX:qmifPbR7+M4FHX
TLSH
T133B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 971e5929b63445ef793a568396c57c418367c603c9435ac86211f4650731631a
MD5 4b05be1d61a0c66204cf2b80912497f0
SHA1 5d0829f8b8960f8efecb36f3a8c2b4f3a3322e5d
SHA512 eaf76ea87acf3d733c2522f9eed1b714e9abeb6d7abeae301eab2a5ca484575546793001079b293d5c106e1ccf920022723c79a59b0dba287d2a5d95d23a7f33
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqdhxSMmT8oWgBCaXo:L5dKTi61d+M4FHX
TLSH
T190C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6fee49346fbd8d97279835e1f050ad82e28f2e69c6a81dd6ec126ca1b8104067
MD5 c05a880710c3c1529e94c2f185c42b21
SHA1 b281b74f2e92155a52bdd228b2d1a24ac7456a56
SHA512 22d805269f01311cefd37be3206cd2c1cbb34371214df7b4c7014fbbeb037bf8c2a2aebfa4453815cb77eb98fd35bea4b4e06f0eee6d22fdc4de1402d8d93c36
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5w0hxSMmT8oWgBCaX:RX2iyphn+M4FHX
TLSH
T14195BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4b6a4edecb54f31fd86bd6466d450c8c7b6b666f2c12cd2ce3e40aa055bfdeea
MD5 6b89849ea348de4cf24e1a653bbc7a10
SHA1 1afe5726da4a26e6a5c5d6932a8b3e908214dace
SHA512 c2dd0134f1f0162650ae58da1cb577a521e7dcc0391943ef9652d71f1ef9b39fc81932b41bf19e3e5482279423471ba97d6cb14090532db9203bf9d2b436c081
SSDEEP 12288:ueJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:u+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T178652375AF0F94DBED2AC335E8624716D99C0DDDF201263BAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d8d89126d750915d832ab2797002475bf988b9849eece55288baeb53c11ed7ca
MD5 785dc71c757990a80078a85cac43cd8c
SHA1 baaff02b3c5b24f7106ac659b69e36a3a9dc7a88
SHA512 df7b3e31afc4ee240bedc3d2ef67370e28330252da8a02f572bd6d211774ce0f85024d4740b9ece640c798421eb3636497f18db1196b543237975da1a22ec722
SSDEEP 12288:/ZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:/PrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T190652375AF0F54EBED2AC335E8624716D99C0DDDF202263BAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7a388742035806ab65432abca79f5336395f996efdf132fa88788f4a591a8b46
MD5 b9b2b499dc5b13f65b717e5080b59afd
SHA1 17e84a5bcf489185d864d2122de0c37b7c05578a
SHA512 c6a0d7bcb85244417fab8438dbc9b0f098ec322b3bafcb17467fa20d5d123de7c64a9f1f3924ced228b5b72d2786eb9883e1f6d17a42a4d312513bfc49e0efb6
SSDEEP 12288:OfJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:OhrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T163652375AF0F949BED2AC339E9620712D99C0DDDF201263BAF3E2E683A31C5A1552251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6c60b2ca86e47fc7055235f4082734500442b1a9a3ad73eeef93c56db2e73b05
MD5 57d4e6567c8ef8cb70d22abbc4f39cdc
SHA1 3b71240283ec269166e6387462c9379babd0ca38
SHA512 76398a817a1effdcf236cec654b0429fffc7121745068a864ec88524768dd01ce55b969fd1e6551b6918b4c641d87f2f7c864424bc69648eb7479991821552de
SSDEEP 12288:dVcJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:QrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1796523656B0E50DBEC27C338D8724612D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8a0a431ba1a176086857fceb4b22bed976db2f99521dff0cd180dcfb3b5743b7
MD5 fa45adad6c9ae04ea1187745ccec96e2
SHA1 55bd8a6525cc09177bbf81f1e6ca30d7d76ec37b
SHA512 7464d31b40675acd34a1c2120c4938d801598e87d79b2dca5bd28a9d9bfb5b65fa028390bd63b05a2334dd5329c62b9871d8f78e1985a401b474c166853b0957
SSDEEP 12288:wUJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:wgrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T155652375AF0F949BED2AC335E8620716D99C0DDDF202263FAF3E2E683B31C5A1552251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 8c481d60ae0dbbed2c65d7282213a5f9b297b2d9e3fb3d7576af237ffeb6a9cd
MD5 1fceaed7345897b3632e20f513b273fe
SHA1 17ee35f86ff223d531c55cfd3d867b9f1fe1f600
SHA512 a35add088361d2b2dda8eacee159a783eea933126d2e59c1c64c0fd44fb88ea54662452e788ecf921cf1897396cb3d2514412721b00f8ea13d6aa25a2edfb01f
SSDEEP 12288:8tJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:8jrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10E652375AF0F54ABED2AC335E8624716D99C0DDDF201263FAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 31020059dcf2557297830cfb2c807544e2007977c40364ba451778942e7a4a2a
MD5 a486eff83a0716c34776b14ad8b13b73
SHA1 6b20b9461189d2d359f4f50cbbb9be851f6b28ed
SHA512 1cbf62540cba1bc207cb1c659122e3e0a3982985f143113d416448cf3bcefce6024a62437ca55f595c95e325f20ecc38fb1ee858b9afbce751d8663140e3e98e
SSDEEP 12288:bxJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bHrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12F652375AF0F549BED2AC339E9624715C99C0DDDF201263FAF3E2E683B31C1A2052221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7dc8a2849b4cc7600a4de44bbfe6b98df15b40712f903957a12054cb9742e500
MD5 a928fa749059d3c74f08bb28978dd420
SHA1 e01055489c4cfd88ad6c27943a0c882b495e9f24
SHA512 7bad01ecb412665b2022b475599a5ce93b5fae7ff3d2c9a2fa7c3f99e7f8f6a47a32a024dffc1c8ccbd76875a8a442c26aa09447e146ef8fdf8e53abc2f9f882
SSDEEP 24576:wZMEzFVSOvrKhxr+EHNmT8oW4ll1JCrLKXI:wZMEzfihxSMmT8oWgBCaX
TLSH
T1868502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d818f356ff7f70c86a11843a9af75b13e6fdc37c1b9d6f91413c078cafde3ab5
MD5 89fc8ecef9fa225195b964bb9460b9a0
SHA1 d1405d947aad4103881e06aa4faab1ffe23a2a42
SHA512 8af75041e089d0ca08a975da36478753f78591ba96ed4e825434ed41cd43b0743df04743dddfa4a9c832cc9cff479fbb6e49ca137c24aca505d880664066f20a
SSDEEP 12288:FKJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:F6rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T152652375AF0F54DBED2A8339E9620716C99C0DDDF202263FAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f380249e13a5753c96c340228b9bfdea285afd93dc43d34e03adb38d60a5b91c
MD5 aa96027269a743f42da18af33a3b259e
SHA1 f4ee3bcc5e8703fda4083401607450873bd44925
SHA512 c09878df8ab9663c39284722487fb459d7d0500360d0062b05870db5e17f30f2e497bb2181d6a221317e55456c1007d0fa3f6c1c96f7a298d8ca58e05ee77ebf
SSDEEP 12288:0GJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:0mrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T128652375AF0F54DBED2A8335E9620716C99C0DDDF202263FAF3E2E683B35C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a8ea557dfd0018355847ab41976bdec46fb1a89f4722faaed27847cf46627b0e
MD5 ed9c96dc8c4b23c3f1402351112ea8c9
SHA1 b8faf2ecb79903d867fc4adce03a1c97e3943d31
SHA512 eac45abbf6f5c5a263577162ef943565a819ff02d112b05599b8907f28dd5a05f2d66fc5667a2b337c996872dd004ae2fe6cf6c660cdf53e556e7bc0b2556474
SSDEEP 12288:iyPz5L81JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:/zyrrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T113751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 7cec25d772a77f2c5766ebf21c1a0522029d75e1c13f6b9f998cec10d71d7367
MD5 561030694cc37e6bcd25363f9ed1b2ec
SHA1 b9a60fbc3f680ba3adbaeff9c604da55ef180fd2
SHA512 64378bebd65112787a9bab70e8fd795ee515f1409648e95f827e5719991476103b23f011c4cb338fb2e691e70973e539bacb422b520d3fb3bef01f023492b198
SSDEEP 12288:tKJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:t6rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FA652375AF0F54DBED2A8339E9624716D99C0DDDF202263BAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 06bc3ec36e96cede06a093a351fe04b60869e0089e7fde16dc603ca17c7d168e
MD5 fbd7d71ce258c4359edea57a587940de
SHA1 f7d923eccd2ab60a5ef4cbab57deb2d8df6b2f20
SHA512 692f13b6ede13f34e81c8b872702a4fa71b90d4cfe1e0805b6d20445aac4f5d5afbcfe798f7e2e7996c85c7f51f555a57a7a8dffb04f42e954a2ce51823877ad
SSDEEP 12288:XKJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:X6rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T192652375AF0F54DBED2A8339E9620716D99C0DDDF202263FAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f78679e8e5fccbf03e8ac93708431eb42b9f4696b5016e96a23a3900ae619607
MD5 7eeda518ff70c2e98c59beb552f44a7f
SHA1 538509caa18c38a0f23d1ccf3aab685a8791576a
SHA512 d6c55affb6f144263759482978065b14e85c210b44f0058f6b550ce71d2d491e5ea9846578ae4fe9ab09e0e3e3ba1a1ced8a5e813bfee4a2fb02ad38e72e1ad9
SSDEEP 12288:KyPz5L81JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XzyrrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14D751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 ddc17ddb8ec8d9731a0b743c2aa21caf3b57ccb5ce52871c8574022f9baacdb0
MD5 f94a880c4a54d53305ac4b77a2c6e0bb
SHA1 fe4f4da7f8bc12b20dfabde0465fb41ccd425cca
SHA512 f2fe5ef79c9a16467b843f4b8bd3a193fc99e1acd3f619fa4681c80439a202d765600ff7be0ea9b9e0e0b333cc5e3a891c4c2a410f29817d54227cd1911e3459
SSDEEP 24576:6TdaLl3z0zDxrKhxr+EHNmT8oW4ll1JCrLKXI:6TwLlj/hxSMmT8oWgBCaX
TLSH
T1668502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 261df3f3371ccf71ad89527179acb33f46c43b793398d589c2f6572e56afbf21
MD5 2907b25c95c2ff8c543c8d6a1e258395
SHA1 ce0dc3573834fdd2cf67a3cce64886daccb57c38
SHA512 6f70baf4c38ba873114a08cda4edfd29f0ae375a5691d053c6d4eec8b782aba7a2f9abf5e1f72d04d469239a52bc6b467e85734363672c83c2fde2ac66e5aaf7
SSDEEP 24576:Q35d9CHKy7GZ1rKhxr+EHNmT8oW4ll1JCrLKXI:a5d9CHKyaihxSMmT8oWgBCaX
TLSH
T1DC95CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 19359ce9bf46c56a7826b649f59995a7a5dfdf9cb21d260a96cc9c604dd632fb
MD5 e2968254a0c0c02778d977f88b88b957
SHA1 1d3e92a3a7a0a40ba467161f0ac76719759cc262
SHA512 96caa1593b9061c228489f600bdf030623eddf920fb25051b01adcf843357d40e65c437d76afef0e455f503825ae3b72d5fca8307e7e8cf4b418947f96e224fc
SSDEEP 12288:0/JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:0BrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1BF652375AF0F94DBED2A8335E8620716D99C0DDDF201263FAF3E2E683B31C5A1552251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 930511611b238a6bd994ec6e2dfabeaa22fccf62633502aee9f3f48e63431da5
MD5 cfdb365543af64393a5fc5c1d8c8d9fe
SHA1 02feae116410546ec71b81df87b6f42d30a4abc4
SHA512 eb9d72484afbe56f3bd447907844cd7ce7300d8db75c17b1a09507cc89a92d68a61b6f8d931e8e8e1f68f237c158c3674adcb741007a5ca1fd4e9e85e4b9feb8
SSDEEP 24576:3fwv+k9RX6wkyAI8rKhxr+EHNmT8oW4ll1JCrLKXI:nMnYIPhxSMmT8oWgBCaX
TLSH
T1F395DF29EBDC44E5E177923C99B3460AF6B178691B31C6CF026A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 844e5512c6c6c951bd58d51b2af1f920fd877dcd34b2a37793eed0891ef09080
MD5 70c0e2a697606873b99820959ddfcb64
SHA1 f7d1e3eff0a5529b8ec9c73d42c6f317aae491ad
SHA512 1bfdbe2b830cc6f535f0b6032d9f607e0c6b82135c898c0ed5e1a43de8decb9e299a8465e58eff689036d4a68c6f0979ea447bef879999cf4ba115a5636dc9f1
SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02hxSMmT8oWgB3:QySzPO+M4FHX
TLSH
T1D4066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c2809f29ed3721c253016b2452fb180a0e81f1ddec853cccdca5d9a7dda3e388
MD5 ef264dd1a847af3d034edf253d31a121
SHA1 3aa55cea2ac8614bd7fd35b1ab77eebe279cd586
SHA512 ad2f271a203b5ca278acbdab40285c7bc57dc1ed800cae3e00b83d548d067d84d17f765c03d8de1c13ced519ff2ec6cd2e72930a4ff92e7c3dffba0bef8029cd
SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYhrKhxr+EHNmT8oW4ll1JCrLKXI:L47JUQj1irIhCnDHUPfF/GhxSMmT8oWM
TLSH
T18165AE1EA3EC01E5E1BAD23885154A1AEA71782E5B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b3eac8bbc436217e0deab362db2a254ffa7d37c33fca662d1d8aa7436382c62c
MD5 5e46660c1b4937fe795850bcc68c4ba5
SHA1 25639990da9fb4d3d0e279cce83f34fcf92e16a2
SHA512 0a831a9e02b59e0dc590f72b7c9f175982ef28660badacd43009a12674a6c842ac48f68a24722c418538526c85a0a2921f303776db20ae90225c38924a3d429a
SSDEEP 12288:8zsf6JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bKrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17475F11AD24811E9C46E9239CB524A01F7773C6993E193CB5BE0F93D2F36A905DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ca977e47288f927f99ba0759415e19ca19d7fd70fac995f6aff5f0ddd2a56799
MD5 c538367058cd38583b569b374978f5df
SHA1 7e00d8b96a7421b6b491443cdc9685b2e2a1d71e
SHA512 7221c7555e96238e05c41c9c934da94ec30598c42e2f1b3cb9a2abe2b9f240ce24fb0b0a260cd30a14bc27c8b184e2a69afdfeec2135556599510c5ee6bb548c
SSDEEP 12288:zcmfwBqlsoWex3tlhgxaUDJbtT+gu/OEBmFXo1aRMM:zrwu3tlhgxagb5+j/BBmRo1aRMM
TLSH
T1004518107666DB4FC66940321E32D6CCAB707D42FE056F0373C98B3F9576A58BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 ff16ce328b637e02e54312943bda19ee93f5d38d91b0f624ac917a3f2e7710fc
MD5 da8e8af998bec33c1d97479d926b34c0
SHA1 114ddbfd893e2f9a33e7d6c55f74e14917a2a7be
SHA512 cddf0cac28a6119d9f520bee6f192ed380e5261eee2189370c8d0f9c4dcb7b510f827c9ea4a2485b0bfa322a8018a2fb7e4b9955bd06a344f92a12ef407f745c
SSDEEP 49152:83tligxaj3tlpgxakzYR8gxa429S+b1gjh4:D29S+bJ
TLSH
T1F7750A40A536A78FC1B7503203365B8DAB74EC07B7496F26B3C9453AD86AB45B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cb0fb07eb2c55db25f98dedbd5185c5a9976dc59acbcaa5ae6a4d63f600818e7
MD5 1eb583c1a05c73a92d54bc1a713ec8a6
SHA1 97707c3d4621673f9553ad7a05997d1559e261c1
SHA512 6cfec63fdf63d9037694e6c4e468187568d67b4d9d43ff8c0dc99fc6daa948837ba11afbcf8f86db544011422485fce8737bb0e175ce7912b35c544c2349e844
SSDEEP 12288:BO7UJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:kgrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F26523719B0E589BFC3A8334E8664321695D2DACE30055FBEF2E2BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 0ce1659ec1235b276a95f57137d29942b574b6e7e99055f649494068454e550c
MD5 0b641378adb02d12c6a15a48e6108db6
SHA1 5a7c96cec6caa13f27d9b1a1e0747d2d0efc5e7a
SHA512 e6b66015f35bde3f925d038ecb867ce9225c103ce283b8b2073c12fdb44b01ac89f632609a97350e3eb419d91490d26cf4fe898c51e59d53f926f9527ea44c32
SSDEEP 24576:NGntxw3EhT2s5/51/nDNDUJ0H5DbHtk5c:NGph55RZnpUOHFbH
TLSH
T12205232911FAB40CC536C37924EA598A7174381023207BDF8CE469BADFB02E47779DE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 3f609ef46cab177c8758a4f2337690df01d378a29541f1c37c13524e952d01d7
MD5 9520181d7bd22922abb86dc788514e4d
SHA1 e41ba5d2d62f56e2c4e174232d2da937916835d4
SHA512 8d45381269968feccf6fe7c297e9a7b55e819a1210e00706d5f78b0e8e87c7585f139bba6a305f62ec6152b1b08153a9d343d64ce53457306a3c1b65c7ec980b
SSDEEP 24576:FG88u8FpJqH1hzria7/mxrKhxr+EHNmT8oW4ll1JCrLKXI:o7ZFPqVoa7/dhxSMmT8oWgBCaX
TLSH
T16495F16567E101F1D47BD138C9824663F6B2B8251360EBDF0BA88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9b0c1bbf3821599e8db9991be4d7e427c54339aaa4339e841c58fe2d361b4107
MD5 e7f37225405ba94e6c8f4656621c0578
SHA1 b0568771f90f1e0bb99bfad0a0d4513516e7456f
SHA512 18b4562305e92abdcf736338c793ed19dbb7729e709e96cba71b57ffc1787c5400cd4c83f4a2ae34efcc75158346d442f202808a397bb1d9e1026d48d57b3c29
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUhxSMmT8oWgBCaX:VG05lO43bX+M4FHX
TLSH
T17ED5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1822d0dc7198512296b02945d80623f8efbc12d5265199f99ef9c2f33ccb2490
MD5 df33ea550726c8fcf9e2d00aa6c27855
SHA1 124d3f2c27bab14fdb7dfff02cd294749117089d
SHA512 f66256fbc4e28859876b47df346ceacf374671a0415dd923beba79282ab4429ab54a79aa04c0719240bcd72deb9e3427954f59ca67ef54a2d39ae3436b5aaf6a
SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3rKhxr+EHNmT8oW4ll1JCrLKXI:ja5POZ3+Jt2pasx2+mMhxSMmT8oWgBC8
TLSH
T11E65AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b00edbb94c1cfa00d69eef21f12ebb0016a8e063e290d7792dc9c2e530a5d8b2
MD5 9ba4067040ba957e8322ab3ea6fd2924
SHA1 db8caa493a96baf56644486b7839b546f8531470
SHA512 be79b21b54bcaf397ca327cf4584a324fa2398696d4acae8c5664140e63b0bb0d1e27e0da1dfa8d61439c21cdbd827715f70aecadfa77501a086421bd710a524
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkJrKhxr+EHNmT8oW4ll1JCrLKXI:ANc/zEOVHF9hxSMmT8oWgBCaX
TLSH
T162858B2623E900E4F5BBE1BE89779546FA717869533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 1e40f001b4dd1eda04f61ea35bc45bdc23f31f0293da59567a3713dc0f54121b
MD5 0b0f50352b264159d034049d69301c55
SHA1 c2b340f95926a6a40df0266f2d5e491bf38981f3
SHA512 9b3bd471a43fef83cb47785b841a61d348db57694e5b3e37bde142bcc7b6a7a03c723bace31acc8323a1883908ae8e6819f4de02e9ac6f2a39e2f615773817c3
SSDEEP 24576:U6DIZxw3EhT2s5/51/nDNDUJ0H5DbHtk5c:U6DI1h55RZnpUOHFbH
TLSH
T19E25121D23BB10B8D167D03E95C70545D2B1B42193216ACF4AE485BE9FB3EDCBA38E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 f31c76b4a01d500f808f355a30afc1cae124c17f1b7630042a6f6f93250ea8fa
MD5 0c66e820d869e7a73700fc15a9936866
SHA1 99a2380e64cf332ea83e46003b898227daf2db91
SHA512 e85d471e1c6e9c2fcdfdda93ad83ba4f77921bf4433ef3a7beaacba96de3f0f42fae135b7ef1d3746aa246f6bb4efb5bc246048b01464a7c4b12f7c05e462abf
SSDEEP 24576:ntyExw3EhT2s5/51/nDNDUJ0H5DbHtk5c:ntFh55RZnpUOHFbH
TLSH
T1CF15230013F9A44CE675527869A745C49B38BC10272067CF98E0AA7F6F717D8BE70F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 40832c166ab026b025d692bf274fd239a4d2c0448f28368aff90ccec54477dd5
MD5 afb1d233ae9fb79503c37d2b2fbfb4f9
SHA1 4ad39c4fa3f8a87445a1df31fda7caeeff38fa5b
SHA512 c3855c0b306a43ac92bfedac3b928ddaaa47d10a5bf63f486d9fee8762a86971149d90c46e3fcd7e5ed9ac3d4d478a1cd71b891bd6094dc9281f95b233c27e2e
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYCrKhxr+EHNmT8oW4ll1JCrLKXI:fgb4mBIBhGFohxSMmT8oWgBCaX
TLSH
T18C65AE1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 1a3a1e0fb2e3c4ae9447b5bb57bf404996d87b0d96a9e829081d390891c13101
MD5 fb1317b0108119a134578d2d141ebe95
SHA1 ab5fa3793cb720b0005ad53d764226923444ea68
SHA512 71fbf74d16ff9e6af10b565f496fa843d22a253c86cceb51991b2d89882f84c5568ab38f283b2630d21a90a3d7839dcb08b0ffdf7359ed18f03ec19d35326059
SSDEEP 49152:+DMwBtOmqhxSMmT8oWgBCaXfh55RZnpUOHFbH:IFi+M4FHXfh55XpR9
TLSH
T120A5E12EB6F845E4D1FEC674DD238512E6727861133293CB9290C13E1E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 4e6596bb899a0292655f269b10044d8559169a60eb2c982cea339e67346ad28d
MD5 d58b0df524af1be1362f06ddcb99f878
SHA1 02f5dee845624329e68c8f13558d09c072b48093
SHA512 165df3afda54b5da6aab166945ffb0f1ad43d3bc4337c3958aed7c19168d388f61dd6b5cb001019be25b4ff81394c59eb4d988338d7275c06092876caa9226ca
SSDEEP 24576:GPUr+NQdrKhxr+EHNmT8oW4ll1JCrLKXI:GJQkhxSMmT8oWgBCaX
TLSH
T15B85F12F269D18E5E67AE13DC9824719F7717866131292DF02A1817E5F33DE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 21e4e3e8ae1a6f3264d4f26c9f9b5940881f10e96ecf9f41c6a1cf3e6518c325
MD5 b7f0c48f94a830929165af678bcd2c02
SHA1 237c31dcd191c7671fce83f79d941ac7d813fd24
SHA512 6fa06d297003569b6b2f14bc0fdc7859571c928a9f7b0489c3f6bb3ada3268de0da801e3e0df437ef88719e7bbdbec4f2de942517d8d9b1433288afbfae4aca4
SSDEEP 24576:FD3FHshBIYQgAUrKhxr+EHNmT8oW4ll1JCrLKXI:FDVHeBIAAnhxSMmT8oWgBCaX
TLSH
T12595E17DEB5C04E4E57BC17CDA638A06E77138AD032266DB069481B91F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 171936ff83154af92b95e5ec84a2ff31f93fc9ec4785601aa3c77d46f58ef698
MD5 6a0cbf549e12bb5880dc342b2b8f0850
SHA1 3e960a28f3d1c418fd54581e99091c830bf70432
SHA512 5986c4fa48ec2b1538f36589c8903fe889672b1c77a9dda3e545c57f7a02fb1ca2e2863205eaf662b2642856009d0adba232e25873f9d37f333dd62c767bad74
SSDEEP 12288:YXqmw3EWtUkc2kB5/931XVB0MDNa/isUVSukJhSH5DbHjpMR5tXVcN:YXxw3EhT2s5/51/nDNDUJ0H5DbHtk5c
TLSH
T1E105234501FAE80CD551A67934CE5988625C680123207BC7EC78299AEFB03ED7BB5DEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 7a716bed2d1b4dd885df45976171a3439fadd4372815000bcebb93b8e4cf4fa1
MD5 36a270bae1986c77942f1a65fa1e4817
SHA1 06effff1c50ffd06a098dcb9de658b132113f1c2
SHA512 131aa31038886b3587b195ea758a51b9327e7348a286d06e4f75f711581752aa77aa2671cae9a765efc0a9496d2f67db57f5a23d9d3f6312dedf1c4e42abe3f1
SSDEEP 24576:x6UqjpCxw3EhT2s5/51/nDNDUJ0H5DbHtk5c:x6URh55RZnpUOHFbH
TLSH
T17325230D12F5648CE035927478AA81598274BC22137076DF78E85A7FCF31BD8AA3EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-146-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1248-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1248-144-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1248-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1248-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1440-87-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1440-355-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2116-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2116-154-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2116-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2116-365-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2744-59-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2744-61-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2744-49-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2744-55-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2744-48-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3152-86-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/3152-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/3152-190-0x0000000003660000-0x00000000036C0000-memory.dmp

Download

memory/3152-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/3152-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/3152-11-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/3152-180-0x0000000003660000-0x00000000036C0000-memory.dmp

Download

memory/3152-174-0x0000000003660000-0x00000000036C0000-memory.dmp

Download

memory/3152-17-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/3152-188-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/3152-193-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/3152-202-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/3152-0-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/3852-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3852-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3852-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3852-153-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4332-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4332-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4332-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4332-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4332-360-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5088-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5088-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5088-32-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5088-24-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5088-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5268-378-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5268-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5268-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5268-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5268-376-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5268-91-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5700-364-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5700-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5700-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5700-126-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5884-63-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5884-64-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5884-70-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5884-319-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/6036-82-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6036-76-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6036-74-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/6036-344-0x0000000140000000-0x00000001401AB000-memory.dmp

Download