4124a5691e84eda1088229f9f55ceb9ed04de53e4712864b7b99581eed16ed61

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample261001-svs71avcma
SHA256 4124a5691e84eda1088229f9f55ceb9ed04de53e4712864b7b99581eed16ed61
MD5 431320219a2a4e16206d2b488654dd90
SHA1 837baed36e9f8ac831f7d6d155001c98d2b57eee
SHA512 8b260bfc4ce7435117708e7c8e972b21a9bec728c009917b430b087c65360f4fd208cc5069bbafe345fa1da8707f1d896fcf2300e58ad078cf5d8b7f8a48ced3
SSDEEP 24576:SEIU58bYMKEz5CYtabDxHjsbkqRV4EgFMp3C9UZ9VCXif:SxQ5XECRvVYkqb4frs+i
TLSH
T18085F14AF7A404F8E5779138C8A64A06E772BC5603B05BCF23A446662F336F15E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5024	elevation_service.exe
4332	elevation_service.exe
3556	maintenanceservice.exe
5276	OSE.EXE
3884	PerceptionSimulationService.exe
2408	perfhost.exe
3436	ReFsDedupSvc.exe
3772	SensorDataService.exe
1516	ssh-agent.exe
6028	AgentService.exe
3148	SearchIndexer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4124	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ce55d41c25f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ed8e1a1b951dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
4332	elevation_service.exe
4332	elevation_service.exe
4332	elevation_service.exe
4332	elevation_service.exe
4332	elevation_service.exe
4332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3336	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4124	takeown.exe
Token: SeLoadDriverPrivilege	3336	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5024	elevation_service.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6028	AgentService.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: 33	3148	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3148	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3148	SearchIndexer.exe
Token: SeDebugPrivilege	5024	elevation_service.exe
Token: SeDebugPrivilege	4332	elevation_service.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4124	3336	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 3336 wrote to memory of 5964	3336	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 3336 wrote to memory of 2368	3336	2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 3148 wrote to memory of 3500	3148	SearchIndexer.exe	107
PID 3148 wrote to memory of 544	3148	SearchIndexer.exe	108
PID 3148 wrote to memory of 5436	3148	SearchIndexer.exe	109
PID 3148 wrote to memory of 1964	3148	SearchIndexer.exe	110
PID 3148 wrote to memory of 5324	3148	SearchIndexer.exe	114
PID 3148 wrote to memory of 2052	3148	SearchIndexer.exe	115
PID 3148 wrote to memory of 5000	3148	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SYSTEM32\takeown.exe
  takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\SYSTEM32\cacls.exe
  cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
  2⤵
  PID:5964
- C:\Windows\SYSTEM32\pnputil.exe
  pnputil -i -a "*.inf"
  2⤵
  PID:2368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3556

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3772

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b9910810fd1c53c47208be9643e6e27fffb0184a3220f8b14665777a8e89adb3
MD5 6e15a2a752acee58715d13e09c50ef62
SHA1 d1fec9fec839fb09d15a29bd77d764352ff00e41
SHA512 c939ec24f9d5a095ea51eb2d1c6f49f021b53bb77fe970d1fbe94c120716aa1765884d22e10e638c04ceb7d24250fe53530ce810480c62a887394668ace39135
SSDEEP 49152:lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn7vVYkqb4frs+i:73q6mjBEvVZqb4frs
TLSH
T169D59D03F2D900E9E06AD578D7469133E9A2BC890B34B6DF0780B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d43c70199260aa086b33ce0169a442e7d8f2a284619d9f2fb7a1a91a099d0080
MD5 717b391bc77b45875a580a0a6cf9d5a6
SHA1 40e6c3caae939322792fdaeaf29097fd2db9ce1d
SHA512 5922b3c1933b4d5f7377e4a95f2f65b1f7585c5a0c1ae93bbd6cf55a188e18ee92645a7ebdfd3f2a5ee251b451897c7e4fbcbba38ebfd5d4dffe6e7a2c957414
SSDEEP 24576:HXYfDtczAAbDxHjsbkqRV4EgFMp3C9UZ9VCXif:StcJvVYkqb4frs+i
TLSH
T12575012877D408F9EC67813CC8B28511E6737C5583A4E79B03E499691F336E85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 38110987f6ac1ea2f7053f7a14a33a519a2ce99aeabf6053e856a4b784fcd8ba
MD5 bee7d832c64cfb00d75c781e02553d47
SHA1 d0f45dcb7ccc2e75ba6b252bc4932a12704eeb10
SHA512 644dc617c872b09e656e1b3216d665c50106075479e361350247a42f81a2182f62c53dc383c88d1aa00a87a282505081f301e35386c5a0ffc743e7713bd463fc
SSDEEP 24576:g0Le5ji0hmxirMAbDxHjsbkqRV4EgFMp3C9UZ9VCXif:gPji0AYJvVYkqb4frs+i
TLSH
T15895AE16F6748331D073C0B9C5D2A69EE972348657308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 293ca984f95caff0219d47a1ce0f23399539b770f83cea9c13a42e6152f1d1ef
MD5 be7ee4740817012cf926c6c23c8d8e8b
SHA1 4506f363d9af6ffebcfd1ff90508fb5e35af87ec
SHA512 87b29a12ada539d2f3a87d2573e5c3d09af05c4c1e8ad8f4bbb86a156081ac2a09446097bcda0ab884f3820304eab03a3a9299bf6b1bae7fecd8bb82a3f75c57
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWj6q8wyuabDxHjsbkqRV4EgFMp3C9UZ9VCXif:A/ezSC6vUzPv+Hjy1vVYkqb4frs+i
TLSH
T1B3755C15F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E276E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8ea4ba164773fc98cc287d0b48c01e9f689ae8829a374d11a152a05578d23e06
MD5 6d64e03bd034bac99e9c965fea51500c
SHA1 aaac54106c67cd0ad8ef352b7b5e529de35549f9
SHA512 9db7fcd5ff5f67d57dd5fdd947fae4c77ade3fe7f137995d065170116f73cff3be2874215c962c19e8a024ccd3a3b1dc5a7d5b8067c62968e5cbb87291a63997
SSDEEP 24576:oVbqPb88hv/l+B3bDxHjsbkqRV4EgFMp3C9UZ9VCXif:oVO88hXl+pvVYkqb4frs+i
TLSH
T149559E66F5B48331D073C0B9C4D2AA9AEE32344257318ACB1246D76C2E777E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 fd7d72064c915528620a95570eb4fe9240c243f317319e43c2a5fc0ee6859291
MD5 068517ed2dee6b3520d615c3d1322713
SHA1 065421ed7b94184ff26925108b8ee347d5bf97b8
SHA512 f6c70cebfe65906507c87d1a18c94cf7c4130d4560da621097749f2a0ec8aee54092fb5e569715244ad00efb1a6f79dcf5b4def019aeccfe10b327ceaa671ed2
SSDEEP 12288:savHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:saUbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T163552386BAC864D5FD2B4D3460F66B66C4934D75C1CDA7188C42BA6C04BC4B7D22F2B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3867dc392fd246c57473cac5d4b16df4b7457725acc31e00504d47973bd4328b
MD5 0f42f4312a9b328e39508946c4f0a311
SHA1 a51ed7dc9abd22c26828b6b44ee5e7fcc39f2079
SHA512 e1debcee145c18fa104d5a6c6eebefc40d576300f417e2b223c12c9f4d4acb9cff23baa050e759ed2401260a7b19b9bae1804672f56c1c3ef736e7b0eac19a06
SSDEEP 24576:jJIUvbDxHjsbkqRV4EgFMp3C9UZ9VCXif:jJIUvvVYkqb4frs+i
TLSH
T10075CF7BEE28FCD2C27E8DB856918700D77278708B52A3CBD165830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8d31e1f4d0665c5d9d2def09f59330b585850858ca6b2be67377fca84fc792ba
MD5 44e78ad450b53b9bf6d5e0c3eac0c0ca
SHA1 7d0682b291f88c373273889c7d5b01ecefb2b336
SHA512 6f2f5863c007974d2eea966ae260eea4c4202a4b61cda90fe9848aec0c5cb71b541cfc1fc032f84c61f96516c508824a3d03fb386e3e2573af0ebe94cb0961ba
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THi:JQvGAdlCEL8c/WRNw5CqvVZqb4frs
TLSH
T19C266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 85a1233d23f6977fd7d2c59b19463046172ae3044ffc4cb3177fd836c9aa9f59
MD5 53deede3afc3c5c9114318c77d7f807a
SHA1 87827273c98687cd47dc7e80128f1d57fa69cc7a
SHA512 5751c5214ca296d6cc2e2cd2d983251b5a1b7fb621a9e5f9a9ee19158a660d6a222681e127eb7084c8e4d674abbe906d2eab14e5f4787a2dcc68ddb0111aa924
SSDEEP 24576:p+ewsAjZbDxHjsbkqRV4EgFMp3C9UZ9VCXif:kljZvVYkqb4frs+i
TLSH
T12A85E031FE74E036C67F0DB61B36C716546DBD204B911AC3E3A88E9D19341E2637AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fcc67cf34c6217014a233cb6dcf09e56d9b915ad2ea6183de42e9c437b5484fd
MD5 7f3d5b947dc575b78f0b49b403fbf69b
SHA1 34b22b22b096043a3dfe857c93572a6e420b09ff
SHA512 813fbacf52b7a54164458df05d39f24a703d379e1bdda518b0e1c0926ac5a40506f9bccc64aadd18ac459b2b079c780511c01977a9ed8043657c126244d8fb6a
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHB/qb4:oUEtQevvqc2W1cpV20I32Bg4
TLSH
T122474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2b7ac8e3c133a22d66d99a3cb07b3ff885935d21c0ce8e6645aca67016f4cd52
MD5 4a23f1ccdabb3bb9b181c3d0724daa9a
SHA1 c9dd4f3df2f5d7fff7c31eafced2ae19ea52d937
SHA512 ae254a41719d418c934df900a89443b881e48862fcc27d3f1533dfd2b7369437e94cfcb30d04d81778c9f18f10e526ab41010cc702d234c2b1db4399095f3726
SSDEEP 49152:2CbRquA/m2yL5zLfFiV+XenmE3/z5vVYkqb4frs+i:7oq2VjnmmvVZqb4frs
TLSH
T1A4D58D0976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 729e2589a3d0bce7303283882baa8dfaabdaaad2ca0c0952d1d1d2312cbb05a9
MD5 cfd6cde0d217c5a41dc1cf4f4a4f2abe
SHA1 a0f3df49c8376c33b216a7ae7717e6be135efe83
SHA512 7e286349c8f91903652d53f99e595c9238ed2f9aa4bd8935395053c91f3cdde309068cb707f0e2c7997d71eb33525d93974b4e1f460d60dff20fab24facabfbf
SSDEEP 24576:zAhGL6IFoiwtA5l7S53GbDxHjsbkqRV4EgFMp3C9UZ9VCXif:zAM5Foiq52vVYkqb4frs+i
TLSH
T14F359D81EBF955D4F5B3AAB899B68170EA76BCAA5E31C20F1150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 76d137a27cf0c0690496a53cb435294b7b1c67f47acc85800a13931707a437c9
MD5 5d6eca83eb03b1a07eaea32564808ca9
SHA1 c7a546e79d4c750b1dc16079889c2a5b1609a0b1
SHA512 a82e8528efb5e5a933ef85f999a2fb5c200ecbfc1b6a4340a8e192bf2d8a6b60c2b58181ff33794d2cdb0a44b63f3a5103ed656889f24f6fb5a6b2e8a8f07b40
SSDEEP 24576:rwu9OWWbDxHjsbkqRV4EgFMp3C9UZ9VCXif:rw2ORvVYkqb4frs+i
TLSH
T1A475014A77E80CF9E96786388197C136E7F3BC122665D71F0760C65A1F37261AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 deeb7afef0a10b2c0c52f34723354073790ec72c1ded374accf4e1ae4a4eaf00
MD5 6f6c97dcb98ff887b7b81f7f2bbe6f93
SHA1 bc5f64360981abe30b87df345ff53dddbef29a54
SHA512 41173740f0cb4d7a9674e36e2629ffcead0ba58672ce062ca74240d367124a57e36405c59b8cdd74f6c09bb46316fdbcb4cfc8a8beaabc9b6aa6e2c302f76f79
SSDEEP 24576:9Zu4bDxHjsbkqRV4EgFMp3C9UZ9VCXif:jvVYkqb4frs+i
TLSH
T11E65128A33D820F9E567893C94F15605C7B37C6293BA43CF091546681F76AE29E3E332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f3152a3348109bd14812a2929f21e7538e4f41790f16104d5395eae208409f18
MD5 962708b69abf53abad82b6a095b41bbc
SHA1 741f6ef92446d0fa161f44849c34a81130345d82
SHA512 d071d5be9e43363963090f2177c789ba14063f55ea168fb678e879c4da152e9c96da116978ac16c619e328bf8f0c74756de1b677ea3b30df8a2710d4c0c9d91c
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN37vVZqb4frs:oQyiKanX+PNr/qb4
TLSH
T11B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e5b8c0725107c6051d6504b0736c9165fba758520d3d5b6fbee00f29eab74763
MD5 20bb554f116089f15ef46792ba031230
SHA1 2ad02dcd5018f48f1043d1616c798d4612a92642
SHA512 9dd64ff05ee351e8eab49d55738fa499a2dd53356397802b9a116100aced1354c9fa7f09c7c13cf0cd0b1a01494e2676ec3618627fc9ab18178d7d743a4b4d4e
SSDEEP 98304:UQRQyi36YOcPDLvw2gAf+PN37vVZqb4frs:7QyiKanX+PNr/qb4
TLSH
T138667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1a9d9a1b9ea5860b0662122d3215e1f0be8c151ffaa169b358103f360cb022a7
MD5 980a4ca6909d303b0c6b7fb8a21a0922
SHA1 2d597e2d0cfa3713771936d1fdcd02ca77192118
SHA512 185bdf7167405fd39ff9e742fc8086f3ace02cb02619f8176fc82be116037f85a0d264c4e3fe3ac41e3246d5bfe7a486e5b237e9377d8edda4d0db6a39e70d80
SSDEEP 49152:b68Qg55nhkeWu7PNU3/JvVYkqb4frs+i:lthTRc/JvVZqb4frs
TLSH
T17AB54933B2F600A9C44DE1769F4A872196D27C75CFE1E3DB850172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 440b32f61f1daeedd59b46ccd1830967291e28d8f48ca7c1efcdb8a6448af32b
MD5 2c04ddf9c9b7f49d7dee7824494cbfa2
SHA1 1174db00c34de60beb2f258a118aa7e288e27a81
SHA512 7566bed518326558942a62df917a2317919138891aed8f954f7ac3969ad3570244dda8cb7dfb4a9669586558befec421c384e1d6a115acf2f7710ea717f65eb1
SSDEEP 98304:Iy5112gYy5azzVvU69nLKnhZUvVZqb4frs:hLIHRWhu/qb4
TLSH
T1CD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 138cb1f6924d794aae2ade50809e7d8429e0879bff724489bee9834c6d447f21
MD5 ffcd1502c1db3f2ee4ba1f0b621a31b4
SHA1 aab6945af5be02044b9f5c9adbd8080027d4482e
SHA512 f558d1a5e8f489483ba99cfc9961bce6f3ebc43b2b916267fbe9c49c2bda01d4430fec5da0053317bafc311a8f71109f8e845dc196c5dc35f7bb3a80716168ab
SSDEEP 49152:yB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glQvVYkqb4frs+i:Au6JmIxd2dQvVZqb4frs
TLSH
T178D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cf14a4f64d444eb211b703eb512513bbcfa34ad1a7ac5c36da45fd0e462a675b
MD5 bf50ffb0701d9528d74fbaa7eed459e8
SHA1 fc17bd889676b58eb6153c941c560fb9890b2ff7
SHA512 5a9a6ea85e02d4707abc0e85b3a39f13b9e2ea8e0589aa6ece915087c9fc03d663504e1b09e4a830b33aae6007d1902b90e09f7a76aa18e0bbaf40ca9e2cfc3e
SSDEEP 49152:x1hpsNoJpF1A67U44CwH7R4xPvVYkqb4frs+i:xmifPqRmvVZqb4frs
TLSH
T1EAB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 10ff939841d4e008b04d524a94bfb7800a2efaf832b3d022af0ef86d96881e3d
MD5 c34f56516a6123982f70f0a6563a4631
SHA1 5ac7e6672d91b06269670694b2f7558ea9f08f3f
SHA512 f5d627e24f951707ce6ba3239019a33f1892b8f94384eeef9ff276c5375be1853f00cf60f721f67eb1b87c2aa5148f4fa1cc18dd8999887262f97bc12b4d78d1
SSDEEP 49152:ySuZQIY0Be2KkRVtOnks6NMHq4vVYkqb4frs+i:s5dKqi614vVZqb4frs
TLSH
T1D1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b57385d56c2ad6a05fd91c7d1d2650452e1ae921fa307336fa6bfaba084476b2
MD5 2b14faaca64966bb429c731f62c5bdac
SHA1 9d0edc2ce0be78a6175ec6033e2a639194980dd8
SHA512 c91c6980b21b7486e129f1b2577cc765e9bb623eb88b3ed50ec664f0b5d69f22b46943bc6f1140d9a7220f31e9293c4d57551d018f853f3bff7ab9b9fab4557a
SSDEEP 49152:ohtSn8EApI0figjgiDn0AP5wjvVYkqb4frs+i:5X2iWphyvVZqb4frs
TLSH
T1B095BE13F2D900E8D05ED178C7568632E962BC160B39B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 f21479f59b72126b3f074d1f3145380991ac2c18a1da9cf66ec9d8c474f0761d
MD5 1e3897279c784ad3c6e7a6f661aba79a
SHA1 0a2ecf20c317169bc68a74a4df9fa57937ad5833
SHA512 6e469b729ede9bc9179e83f00073b6e97dd335618cd7f4d86c45267669276402e9eac700cdd86338ec7196c3703d65c17174e909261f8560baef8929e44ddf51
SSDEEP 12288:Y3HiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:YsbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T180553386B9CC58DAF8178D7490F61755C4935EBBD2CE63288D4A652808BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 5753bd20ec8b21e613375e2266717c9b00ed98b59ae39bf394d9ccebdcebd5a0
MD5 09edb3b61e2272069f7b6eda41da0196
SHA1 c4c9947939a75bc0f757b0f54b231c0ffecc777c
SHA512 909354bc8ceacf8dfb05bc4f7c455f6f675fb359666ad9c707c26677dee336ad9d5722cd9dd48e9488c4d7e8b35f2fa488fc02a62e8fa243f70ae1f12e63bda3
SSDEEP 12288:u2HiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:u9bDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T10F553386B9CC58DAF81B8D7450F61795C4935EBBD2CE63288D46A52804BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 2824c034f356f9d387d7b6de25d7c82bd19e1644d2fca7f103fc770fad2a8183
MD5 09e6fafc0605774f8d28801b90f8d62a
SHA1 3bccc51e6df9537c105d65362c7c717e37f0be37
SHA512 dc622ac314b96ef8d3b345cc863971bd0a6f04e1ec4bd0e2edcc342a5dfca137cc587eb16d583ce5698cd0b8de4a15805130105d55735355ed616336c9018298
SSDEEP 12288:zwHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:znbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T137553386B9CC58DAF81B8D7450F61795C4935EBBD2CE63288D46652808BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 90b905f3ae6cb1b0920d7b55ec22097e550197946700368464fb8bc51f37ecb6
MD5 a04d2c50f0ceb929752c300576026287
SHA1 8212c9c67153741be1dee05442e851c42275191b
SHA512 2cc2aa4f24daad7d1b2c26b4d38426d1e5108cb4e08690c06e2cf6b25cfc96b4f931965b1cf3630430c0b88c4bea5a0837428a042f18dfc89361f15d5798886f
SSDEEP 12288:uV5HiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:ZbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1C06523863ADC14D5E827CD78C0B25751C1B3BDB6D3AA636F8D0119180DB86B6D63E3B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 a8d5c80710bbebf975d8141613c38e1cf1c9b1fa769f97480ebc29846b6fef15
MD5 664db90d377d4e66bbac41defd2ce2ad
SHA1 2ca8affdf69a9411672c4738f0382b6daffff262
SHA512 7c143a3b5fd25b1f5a927ff0ccf4a0e05cf5e2ac10d8cb580be0305c2653b57187522665d6bccf043419d1cf3a2cc1d2562a2780d732733f295e8bd9938106aa
SSDEEP 12288:WRHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:WObDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T108553386B9CC58DAF81B8D7450F61795C4935EBBD2CE63288C4A652809BC4B7D23F1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 69c0bc2b5ae9a1cb0e494b88e98dc5466ce37883339406bab470ba98cf0b575a
MD5 586f5ebae69657e5fc00fcea55b221ae
SHA1 6ac1c901b2df210027114e2f2c2742236b66ffa9
SHA512 deda6a07b9e6bc28f583bc1fffd457f6c79e035088c54b778eebdff88fedbb4be9559b2a6e9b7e37762cb81598d2ae3a7c96b10e18278d4a38c7339837d9c002
SSDEEP 12288:rqHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:rRbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1D2553386B9CC58DAF81B8D7450F21795C4935EBBD2CE63284D46A52805BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 1649e7a34df257fee4d5f83f170d7843b6e7a10f15385a4b1878d3b6a2651d5b
MD5 1d1fd9dd07d13377be1a51f1b03d1cd2
SHA1 d37dcad1d768ae222c9fb64c0c8d07e6ec47722a
SHA512 0db80368fa0520b5e0781f76066fd91aa0891cec3929c996e71ba1337158011545a8197e27f8c5b752f752444dd0c1c281e4c0440ad5b9a2f67c31e4b25a8820
SSDEEP 12288:puHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:pFbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T116553386B9CC58DAF81B8D7450F117A5C4935EBBD2CE63288D0AA52815BC4B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 9176249c7a4cbb7ba46bcd95d046aa7839edeb9f12f8dd2e8f92156bb48b966f
MD5 91a7f84f11980b727c3eac72ac5828ea
SHA1 7e7bd80d45c4d6c315abc44323007dbc3c11762d
SHA512 1cb8cad4854669e691472cacd51fe01aab24e7cde4c57cb5588189d6f506cbe0ca937b03ba80bbdcdc59a9dc1f3771251cc41aed463c148e9d49d3c5935c0e40
SSDEEP 24576:1ZMLzFVSOdbDxHjsbkqRV4EgFMp3C9UZ9VCXif:1ZMLzfhvVYkqb4frs+i
TLSH
T1AD750295B3901CF8EC67853DC8658906D6B37C6A47A0C71F07A4362A1F333A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 c4b447f766edf11c2327141901da86dd132d766ea4f963ba1d50e574d365984e
MD5 ad72cd8cfbd48970c6a7ff872d93e37a
SHA1 ef983b46f36940819feb5e5fe68656ae77492cfb
SHA512 90d57e0238cd66ebacb96e65b0dd45ffffc110c8981acd0b4b3949b4b7e2fb89940cfab700af50bd42ccc4a3213645d6e59665e7e1827cef97ea13e8ad619b1c
SSDEEP 12288:rzHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:rIbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T12155338679CC58DAF8174D7850F61795C4935EBBD2CE63288C4A652818BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 d690e61c38e08f1db889ba74b1a6f95f9bd97822fa209d4b3744bfdd340305d4
MD5 0066d0d0cb6899b73ced352409ca1c77
SHA1 65315d10dfb82a3a75bc6292e01a62e0d7bb6490
SHA512 fdbcd6cb294d92493c9336dd410f597869843baffec7b85fdb725d36519a5f222623ce538bf694f56004fbb087a5351f6422e7cc4875c5ea4e77ff22b7595c64
SSDEEP 12288:pfHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:pkbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1DC553386B9CC58DAF8178D7450F61795C4935EBBD2CE63288C0AA52815BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 9916864b564f29ea0ab847eef8d8bc222fcb817761169f1005e4816f45e17124
MD5 eeb5d7d05877cbc9da208bba3b7c3dbd
SHA1 eb98e3f61004b51913f62828537b5e7a85621327
SHA512 0428e39bb03847a8705f6fd46314ef936009de266af64b06ebb592e943796a5d5e643b3f8398e15defeeb2a3c61c1b5c39cbf38f0699a53c2ce02f9a5df5e05f
SSDEEP 24576:AzypbDxHjsbkqRV4EgFMp3C9UZ9VCXif:AyvVYkqb4frs+i
TLSH
T13365024777A530F9E437863884A21A02E372BC3683649BAF075446791E366E19E3F771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 198f155896c3009a0a65a6fde929e841e21c78dd30446ce0efd9b4ce9218247b
MD5 5ae27b57d85e095452e918ce2c8c7bd2
SHA1 8310c7a7e00310097d91696af9d1a383e023b23c
SHA512 fcd2f969ec4183af2ff294c8496d969e717550fd1f108da93e52ecbf42bec155bd8c17405ae090fe43e23f94a21b16944a20f784a0821d5ac440b974554b8797
SSDEEP 12288:rzHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:rIbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1725533C6B9CC58DAF8178D7450B61795C4935EBBD2CE63188C4A652805BC4B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 442a3c321e6de8d0af3c95e85076e1e7f4fa9b6ca977b9393a0ceeed2ce5f123
MD5 59106916a755c6d6a63c713ad28039b8
SHA1 ef3daed505ae5ba5dfa62b85839f988f2f313b32
SHA512 db34c6affa71f0252d9f188777ee163183ad292625ad955d7d50824e781b5464277fe287127826743697d7ced579ccddd676fdb68de06da2a6725b496f4e9b27
SSDEEP 12288:LzHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:LIbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1105533C6B9CC58DAF81B4D7450F61795C4935EBBD2CE63288C4A652818BC8B7D22F1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 d782c4ed82cf0ba650c83cc9d0032a21bff584f9ba6abe2eb4d587928372bc2e
MD5 3377cd41a6369495bb352f9a9672c75e
SHA1 acf039f8b1daf4d988ad121055bf83db77aa1e93
SHA512 812802f35aa7ded9720b755feb13a49739bd15126509607ea310f06ca002ee2c35ad6881e67750a506f5bccd4f4fc3705f69c40fec1791b8c023822b4b63c8f8
SSDEEP 24576:ezypbDxHjsbkqRV4EgFMp3C9UZ9VCXif:eyvVYkqb4frs+i
TLSH
T1B065024777A530F9E437863884A21A02E373BC3683649BAF079446791E366E19E3F771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4038be00577737fc59977065e05302963a61402b2aad17b392fbcac49b19bf7c
MD5 dc09515115f7604cc01630a4982d906f
SHA1 fd493b9ad656e5a4eba5c54467ae9877e9e6f240
SHA512 ae00dd50842b3c34f5230e04ebb68c6ac3d1dfe9c2e5668cb34909f3041b59904f8fcc628750d7142a5ae4765cd838c9297c78f54a983f581eb22d2e75579af0
SSDEEP 24576:MTAaLl3z0zDXbDxHjsbkqRV4EgFMp3C9UZ9VCXif:MTHLljavVYkqb4frs+i
TLSH
T151750295B3901CF8EC67853DC8658906C2B37C6A47A0C71F07A4366A1F373A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 013ee082f8be75162bbfa44b80fde72f1eee935376b3b490f67361d04a7946d8
MD5 3aec8fea49f5f018a9c228de1c6a0c1d
SHA1 da436c6025028c49cefaf71c4e4a0b633026e010
SHA512 58cc2c326c6a829832e22834b53e7c511ea372fa4d9a650803eeb7ce1c9923f42f8e89fdbeeed97585c9148473becc8c0800b58286f4049029976a1bfb010bbb
SSDEEP 24576:i3Pd9CHKy7GZbbDxHjsbkqRV4EgFMp3C9UZ9VCXif:EPd9CHKyahvVYkqb4frs+i
TLSH
T10F85CF90F3E414E8F0B79A3588765511CAB77C6A5B71DA8F0394261A1F33AE18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 3675ea194e63cca0414d80d0c5f15a52eec85444056e86c31067e704697f66f6
MD5 2464109a2fee386ad154d64b15143d27
SHA1 94560dc9bcb50ffd0d181e0e9c9b703fff713488
SHA512 0b76582623e20e1fa4a0f0631f94251895de89404d3b5df433586c9aee86cc8e50505d9e6933c5d3dbcd7e830284af32ee5163316b835be447e47ad649ab0ad0
SSDEEP 12288:7QHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:7HbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T19A553386B9CC58DAF81B8D7450B61795C4934EBBD2CE63288D4A652805BC8B7D23F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 022c95538c9053cc075840626cc97b6c1b882c1010361292ba18a429f7cc670f
MD5 7af4f040db9bffcec22bee613edcea8a
SHA1 9717c269be0b817bcea31cd29c2e98f6ab8a67f1
SHA512 139496cc96fe848a6c7d0dbd2985ce6e1857344f41284a1c6272d45a4aa17e4f6c466b29328012978d1a0b3797b35ac662daf941d3ac73a7a6de4bfc7ac976d1
SSDEEP 12288:7SHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:7JbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T158553386B9CC58EAF81B8D7450F61755C4935EBBD2CE63288D46642809BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 708d37dc71d4a06518a654187d64d0d2b9039a8fcec3a8b5821bc280df476e06
MD5 12ae3d776c8527037d29b417733eb549
SHA1 80757d99ac04f0f9721a0a2e703a26ed571e833b
SHA512 47faa18c5fc0de0851f3281c7e8bfc8dd6fb7c3c6c758584382632ed547cc67986273497ca2db95cbe1e3c9ac95cd925a6d58987f6c03aa00fecd838db718afc
SSDEEP 12288:bFHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:bCbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T181553386B9CC58DAF81B8D7450B61795C4935EBBD2CE63288C47652808BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 9b8b32957926e00cec0e56ed34abbbcb574f5671d4e199df68c861125ff3b6b8
MD5 353cd5cbff3ecea16c3600f4fc6e3c77
SHA1 4f594fdd8528315a8fbd757d8f3ba2c12163ba5b
SHA512 938159fe68ee3e2b726e9782efe5273de7ba6845aa0237a26f9845d17744457396e80be639af32ea0c9f5ab04a9d7f1cbe51a1fc05ca02831ee49c40a39be7d1
SSDEEP 12288:rzHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:rIbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1CC5533C6B9CC58DAF8178D7450B61795C4935EBBD2CE63288C4A652818BC8B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 fa538b62cdb8193780e123985b6cb6c844ca4d635351ed239f7ac547b92454e9
MD5 ec67ffa57abed441e7c36341523c630f
SHA1 9f62aea3a086679d7148d49b7d14ab31514c8d79
SHA512 2fe47fa4a4e1e39c2431892135e1b9ea6b17ddb1d42eb0922f7b3d0e9404c2b5b39ab95b378f2557910385140c5bf9343ae0d2bb7339a6b70f774f52e9d6036c
SSDEEP 12288:0QHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:0HbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1B15533C6B9CC58DAF8178D7450F61795C4935DBBD2CE63288C4A652808BC4B7D22F1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 db841481e31cf46c3cafd2b417d42c4a9cd2b77594336893247a88eef335c1b3
MD5 6b32129b9019026a92c4d6670bcfb074
SHA1 318b8f28d62fe456a23c0e8cb489c47204fe6827
SHA512 76501b11e91ff8d6ad3e8aa16fbeafed81b6d16360be8f01ab15cf783696e837ec6dcade1f33c174fba7f7757a07c6587f9c1745bd605f359e20b982afd58adc
SSDEEP 12288:nrHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:nwbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T1D8553386B9CC58DAF81B8D7450F61761C4935EBBD2CE63288D06A52809BC4B7D22F1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 8dd2ddf4a56c5d44e3a64dcbb33ab64099c1a48b544c5750809c135b4d2b3e49
MD5 072a062ac2b4ce5443acdf723d60a54c
SHA1 4a253f7d31bee12df57609b1f08765fb3ee9327d
SHA512 844e959d881072ad3312b2ceb5100781dc8cea76385841412e21c9bd9d60a7f45eaabf8cd130ab7aefe492c56c25ee17aa9b42d1f36b90f9723c2706f907ede7
SSDEEP 12288:eRHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:eObDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T19A553386B9CC58DAF81B8D7450F61795C4935EBBD2CE63288C4A652809BC4B7D23F1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 58ef534d9ef500cf84a1c65db998d2acf3bd6348580f5d66898414c1e1366ec2
MD5 3b2756b1c95f1c0a036be8e0be04e79a
SHA1 2f9447a996d4aff578a67bc6800275b337f98fb0
SHA512 622df9ad6db056b1cd8f0041f5484ec8348ee20f53828c141b9c5ce3feeaa513b3e053d53ab33d79119f6e90bb1230799fb940e63aa1ab51040a366f5967c017
SSDEEP 24576:Hfwvgk9RX6wkyAIXbDxHjsbkqRV4EgFMp3C9UZ9VCXif:lMnYIXvVYkqb4frs+i
TLSH
T1DF95DF29EBDC44E5E077913C99B3460AF6B278695B31C2CF025A536D0E37EE49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eb75c8ae62dfbf277b9776ef979ef926d7ddd926bd9dc9b11f19b85210aa421e
MD5 8acd4a8605e1251ac678305560e3a4a2
SHA1 8cd79829114ad445c55d8d0d5a9de2495abee430
SHA512 481d78cee0948d08ae611ebc71aa74aed1cbe280d7943f13475b0810a014160f6f30111828073a9472e79762fc4854101254f101460300fb9dd560121fa3a877
SSDEEP 49152:iYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DvVYkqb4frs+i:NySzPbvVZqb4frs
TLSH
T1AD066D96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bc5eb75e09ed99680889b7dcd925d166c1aae26269af4ae7db223fdd4b18b4e0
MD5 29dc793d9138457bff6957e092328796
SHA1 caa4b27a979ad9b7bad2b46a5159863a7aebfc60
SHA512 09ec76b75ac66616a590742c2baedd6829159fa541f1511b9cd7a0dee8f6b4532917bfbf958f7fb9d40bab66759ef6bf8c3dfb288330d7f54a50cc998f4b0dc7
SSDEEP 24576:L47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYtbDxHjsbkqRV4EgFMp3C9UZ9VCXif:L47JUQjqirIhCnDHUPfF/TvVYkqb4frm
TLSH
T16865BF1DA3EC01E5E17AD27885154A1AEA71782E5B31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fff8dbabb8dac355a502d7345f29f8ae3c324cb6b623187fc68e84c622c9b2cc
MD5 64efb094c66c994affbb4cc2c925059b
SHA1 c471b28e349fbcfd8d608af04eeb0c0d64b36e92
SHA512 216956f3b26e5b37657283531e170b1bd3773c7c37c0c7f64526a8c32304edb8d9070f6edb97615eae4e6b31711f95251c9aef9f7e926d0af9aa1c622c3daca7
SSDEEP 12288:qdsfDHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:X4bDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T10665F04AE29802E8D02F6578C3A64A41F3637C6583E1D3CB56C0F53D0F796A19EEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 6357fd449702e014a52ce72b1e41faad3e2ad813056ca3aa19bf57d7cb02d92e
MD5 2f3352195c727c773b713a892b36cd52
SHA1 a46b8f4ea3288e3af95756a12f108a0b5ba87ad4
SHA512 3af8683dd4fd1748abc2020d776149bbd13fa15330a065a061eb606e8f5b2b54bdbf5e6e2eb05e1f3ede57e2ae484fefd21429e540c0b26523fc3a26d92eec4f
SSDEEP 12288:dRGMU3fFForUVhweHW9ptBgTZ11Xr4tgndSqTUaj:dRzUPFFjVRWfcTZbXr4YdhUaj
TLSH
T182352810766ADB4FC66944322E37D2CCA7707D11EE04AF0773C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 af6b399a45e2f0cb86f968784749e58c7c74f1a50e34f5f11c093ef14d41276b
MD5 cdc28b2539a3fcce35be880b90920f52
SHA1 16e1b110e7038641845a2c675d966a0c3b35174b
SHA512 01f78265e81bc09c754aa34e9a8c3bd03beab55a9cb87e44b09c697f377a103cad3d1cd30b2bf7215ca4f11bdb1f9555dd9660fe2f60df3f1e784b01f32b3e8f
SSDEEP 24576:3WFWocWUEWWgSpJpvOdzv4/Y1hj/JqLmI:m4oLUjWgaJpvOdzv4/Y1hj/Ah
TLSH
T1F265F841A137A68FD1BA2171032A9B4C77A4EC43B7495F27B3C9453AD82BB51B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 4bc476289cbd62611278b1005251f1afc94d5b1b30fe4954fa6c652603912622
MD5 ab86c205dab12ef6aacab6024c8aef6a
SHA1 6900836ffd99810f75ec49fd9dbd7e4cf662b0b8
SHA512 0eba7574fd3bc3d428b448e8e78cf5c3ac70a3c03972934fc05a2bad1078822ac4ba7039751b43337b71f37999b91b76bcde2cd41c81d25c3a37b1ea6c2060b4
SSDEEP 12288:BR7MHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:zTbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T132552382B6CC5896FC3B5D7410BA5331C457AE79C3C893DB9C05666818788F6DA3F2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 27e381b231bf8bc75cf8d11505af2b188dbb761890aab1a6265012b17c4c297b
MD5 08a8400bc7b50fcc7ec5c4d311013f2e
SHA1 178db6aed0b72f31212a5bc4a6805eabbe390bf6
SHA512 0304924c43bb49a57e984901368627f679332681058de360872358d55f70012293b6b3b3142d6cb55ec0534aeca59c425f83ccb35153974a8604c946182364c6
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYabDxHjsbkqRV4EgFMp3C9UZ9VCXif:Fgb4mBIBhGFtvVYkqb4frs+i
TLSH
T14C659E1E22EC02F5E0FAD2B89DAA4417D6B378164331D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 15bf985418016cfc09de1fcfa17a55eb433319f5c06615a5cae26f8e7acd800a
MD5 d6f9ce354cb87606d42b16d3d615bc4f
SHA1 adc18d585a0b40e8f71f6e663d7738138e10c9ae
SHA512 a022d5c7cb97f49362757b536f0ed25879d5761d7c54308de39cb150a8f8f2b73ad77c8fea595d26981364469740697bf84f8cf0b4aa4404edffc52cb638d1c8
SSDEEP 24576:TG88u8FpJqH1Dzria7/mebDxHjsbkqRV4EgFMp3C9UZ9VCXif:i7ZFPqVWa7/BvVYkqb4frs+i
TLSH
T19095016577E001F0D47BD13889964663F6B2B8250364EBDF0AA88B551F33AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6d488a2d5b9fe68060f317b06df768a98507e24f649a715fd5bb324fa73c2f42
MD5 330f66e7f9c73baf13b483d85bee7059
SHA1 89c801f030fe698f9cb899a7d9b1b0f1e427e59f
SHA512 4d18053f73fbaf11c0ad76adfae991e2dce7ad7473f1fc62c72d6fa0a0811e86ed5f0d083b9edf24222630c9f5f314e0828773b367c7ee039ed7e8f96b7b6ba4
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCvVYkqb4frs+i:hG05lO43b/vVZqb4frs
TLSH
T152D5CF6E62EC11F9D0BBD17CD9C6460BEBB23825032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fa433521716a982e15b72a8cfdab93d2f2f2ee030068348833a3817dafa3a7ff
MD5 28581d79f030cee0f0537815a74fc76e
SHA1 222b9e7b2e0c24b23549986a539c802e7cb00d06
SHA512 01454eb8d6da7317c58462bfe7273a7864c93c8d404349f8835c46da1da19748c40f0b8d20ee24b65a2168b72773a86280d273be2b991275b763916e0224ad7f
SSDEEP 24576:0fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnDbDxHjsbkqRV4EgFMp3C9UZ9VCX8:sa5POZ3lJt2pasx2+mJvVYkqb4frs+i
TLSH
T1B765AF5EA6FC01D5D57AD17CC583461AE5B2382653319BCB012182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5ac7560d2ac73721d393d9d93edf267f4d991490d800e617bf410706e5c8c499
MD5 38cc1297e7e38dcf5172b882462f0bad
SHA1 0fa494329ccbc3a621348685e4cc4c3356d59b1f
SHA512 e76ff6c708bbc6ae563a420a705bdec70cebae636b50b73d6072568b660eb5dcda32f605af111a026b7f71246846f90c692bdcbef81677b91644aec4ef7f1129
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fk2bDxHjsbkqRV4EgFMp3C9UZ9VCXif:yNc/zEOVHFhvVYkqb4frs+i
TLSH
T1A3858B1623E901E4F5BBE1BE89779646FAB17865533086CF0291811E1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 28a233b370da25bd279e69cf5da27f2aa4f51f103f3024d2125a0f9ea81a5a9d
MD5 d60893906f78ff4d313229a6b74a60bc
SHA1 ba7de9a4a3ed43c071baca7bd2b6f6365d4d7683
SHA512 55742cfa5c9cdc3e4076647692349b49bf9777cf368ba7ee7733e4578380bb65c398b9d67b16cf700db1774100066f4fcbc45cbf1f4566ff487e6a9b4b5f4fd0
SSDEEP 24576:QzkNvNnaFeYhJNtmZBm8bDxHjsbkqRV4EgFMp3C9UZ9VCXif:QzMwBtOm8vVYkqb4frs+i
TLSH
T12455AF6EBAF845E4D1FEC6B4CD238512E6727861073293CB5290C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 66c145f3afd5ebf541a455137f97e2b224f36fdeaab1ceec0e030099d16d6e92
MD5 8119d7dbb89e6f95eb8baa1938a72e6d
SHA1 4bfd4e4f73b45de121f71f11d9c1c8e71d6b3103
SHA512 1979e56cfad658fc994b17cf512736bd48d3eaae3a7b7ecb1733279a6aa9835ac0a596f2ea26b96202f43bae5fc219833c407809337f9cf559d536e662e05530
SSDEEP 24576:DPUr+NQybDxHjsbkqRV4EgFMp3C9UZ9VCXif:DJQyvVYkqb4frs+i
TLSH
T18075E11F26EC18E5E677E17C85924719E772B862035292CF0291817D0E77DE8BD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 5b1b43e99d7b351ea07870ab71fba144992b4bdd775479aaaa3f67ffd1441ff1
MD5 0814d74a23174f12fd9b33c3f7554e15
SHA1 83ca9f0bf468861cd1508f1fdd0d1eb80d5dffbc
SHA512 558169095844019ce60b67e45a311c8e41633c7f3f2456dff4d48216fa16287328842faef10b597f3c7b47c907ed114da2a5f59d790e10786d72c437a5444d70
SSDEEP 24576:mD3FHshBIYQgAvbDxHjsbkqRV4EgFMp3C9UZ9VCXif:mDVHeBIAAvvVYkqb4frs+i
TLSH
T15885E17DE69C04E4E47BC1BCD5638A06E6723CA9032266CB059481B91F7BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-112-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1516-120-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1516-119-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1516-319-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2408-76-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/2408-77-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/2408-82-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/2408-300-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/3148-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3148-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3148-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3148-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3336-122-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3336-86-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3336-1-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3336-0-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3336-8-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3336-126-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3336-7-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3436-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3436-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3436-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3436-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3436-332-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3436-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3556-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3556-38-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3556-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3556-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3556-51-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3772-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3772-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3772-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3772-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3772-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3772-106-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3884-64-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/3884-66-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3884-72-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3884-284-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/4332-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4332-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4332-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4332-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4332-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5024-15-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5024-21-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5024-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5024-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5276-234-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/5276-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5276-53-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/5276-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6028-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6028-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6028-139-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6028-141-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6028-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download