68ac00c3fe0e0828153f79ead79408f53fb054dab94057cd8e40ef0bc8bc1598

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 5.2MB
Sample261012-vz8jlayvbv
SHA256 68ac00c3fe0e0828153f79ead79408f53fb054dab94057cd8e40ef0bc8bc1598
MD5 8213c53b669b2a55f9e741d8d8e547d2
SHA1 ba4e3bf48ccb27aaab21d79dbf553ee237d38375
SHA512 9e4c5d1299964a59acf50c3a024303163ab1eb33f07d78650fb0a95d2b4527ac4058966a239bd4aab333762d50279520f177a180ccbe543318a31a20c6e0367b
SSDEEP 49152:ZaoGdsSX7DxKVf81VvjogeedMseAS6NJ3LvcwBpk1ltACqTMCViUe30jaNf1TWbE:fHW3NjK72iUU023W/JTy
TLSH
T1D8468B17E7B941F4D0BAD1398A979617FAB27819973197CB4290864A1F337F09E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
4316	elevation_service.exe
4684	elevation_service.exe
4704	PerceptionSimulationService.exe
4716	perfhost.exe
256	ReFsDedupSvc.exe
4580	SensorDataService.exe
1484	ssh-agent.exe
4660	AgentService.exe
2452	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\587e8f013ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4796-8-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral2/files/0x0001000000009951-70.dat	upx
behavioral2/files/0x00010000000093af-69.dat	upx
behavioral2/files/0x000100000000932b-68.dat	upx
behavioral2/memory/4796-87-0x0000000140000000-0x0000000140E46000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a6304e96e5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdd43e2c6f5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000954fd8e76e5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9867ae86e5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024be0ee86e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003caec5e96e5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072ca392c6f5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4796	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4316	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4660	AgentService.exe
Token: 33	2452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2452	SearchIndexer.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	2452	SearchIndexer.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4316	elevation_service.exe
Token: SeDebugPrivilege	4684	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1552	4796	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2452 wrote to memory of 2476	2452	SearchIndexer.exe	100
PID 2452 wrote to memory of 668	2452	SearchIndexer.exe	101
PID 2452 wrote to memory of 4084	2452	SearchIndexer.exe	102
PID 2452 wrote to memory of 2032	2452	SearchIndexer.exe	103
PID 2452 wrote to memory of 2648	2452	SearchIndexer.exe	107
PID 2452 wrote to memory of 5756	2452	SearchIndexer.exe	108
PID 2452 wrote to memory of 3564	2452	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4796
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4796" "1788" "1696" "1800" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:1552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fe964577cbdf95be523188f92fb93b3ac1bce6fdc1038a7c3c080f22d3c1bfcf
MD5 e5905a4b3cffe1472014709b2039fa43
SHA1 de05a32313fa81766e77a6ef27e8891b8e6b85aa
SHA512 7926a04f02074bb1a6a9ed466250328e20d6b13c32723c7c199f5961bc9a25ec29c9df601e513a4b3a2c38de1b55630dfc2db89a02743d7cb882d30deec11877
SSDEEP 49152:pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnue30jaNf1TWbdz:/3q6sjBzU023W
TLSH
T1DBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b8f77e81c55db0a888b81e0744b00b8c5c44b6518fcd05381ea367c8b09c0fb4
MD5 ce038081e875a88cfc01945696334b36
SHA1 d0a64ee2110bf70661d86fd219439b029bcb8517
SHA512 212271cab1d2bb4dea1a962cea89682c6cbda112280ca0896d0a0b7136fecc222fb05a748e5a200ba5591840924e4361b157185b22a3ebd20f77ef56a86f18db
SSDEEP 24576:yXYfDtczAdgXe4i7ojhsP5Lgrk1TWb4AN5:Ztcje30jaNf1TWbdz
TLSH
T17405F12867D409F9ED67827CC8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7221cac15f3099b6326eeb61e172982483c41ea1ec2e28a77069b9bef5ee85a5
MD5 bfb2506bfdf0ed6706e8ae5b15aa1219
SHA1 e9f60fe92381bd915d1332038aae5c3f799403ba
SHA512 2a885657298971e52817a9945b7cde0671a62a34b3e1b2139f687aeee5d42663af1ed1dbe790dd3888588a56ceabb5392ab5bddc919315b212cd927b78bdf55e
SSDEEP 24576:80Le5ji0hmxxrMogXe4i7ojhsP5Lgrk1TWb4AN5:8Pji0AjIe30jaNf1TWbdz
TLSH
T1CE35AE16F6748735D073C0B9C5D2A69AED72308257308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e8c7e3df8d2580aae4d10c812ddd36c6a2d37a2afbe03d0ab5e820df3b11cb16
MD5 8d15b57b8e024b5dae087d5e2422d83d
SHA1 b75308890ffed29e6f5b733878b86714574e4a4d
SHA512 aa29f92ef5adf609037a37c4a9d6a869e3138cc8aa079a0fc024a5ddc5c76186f2de72338136df80c1e3bd8b7ebc6b0696692b6dda15f515f128a9c457571abc
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWn6q8wyuWgXe4i7ojhsP5Lgrk1TWb4AN5:u/ezSC6vUzPveHjyMe30jaNf1TWbdz
TLSH
T12F756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d43c51ff240da01c9440bda7183e473c450ecdc1d60ae4b19e3ba9ee16cc5942
MD5 f35658df9c8d45a595c59473591822ad
SHA1 4b2d3847a5b815caef39a8d5c24c9bda695cafed
SHA512 c51965458269d8f4e1493d5b154cecc02adb38128097d8e0a9e8db9ba4b4aa202c73bddc5c15b2a5f90e281b261fbbc82a0a75e0d998fa62edb73e260690cc11
SSDEEP 24576:GVbqPb88hv/l+YXgXe4i7ojhsP5Lgrk1TWb4AN5:GVO88hXl+he30jaNf1TWbdz
TLSH
T1BF559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e926ef0c6f62724e53990f77daf6d18218e420ce1cb32132413e028b0a5c6cb1
MD5 38be3071c0a2a04b5287569ff238c960
SHA1 ed8cf04a6801b780d980dcf3d7482e0a8584a57d
SHA512 bcbfa1db499abecf6a3ff478f51744146fea8f331255b6d4bdb3ba39e3ee7953e530ac85debf153460420b6a22621cf3da23bf71158c97d436fd1ef2d3b48fce
SSDEEP 12288:FL30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FLkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EAC423929F5409C6E38BC3F0A0F7CB91E5E11EC171444E6B46E0FE9359BC8A9DAD8069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 507c2e572df35476d48e222d4a53eef17572f6affbb0722736f881cc0bea4771
MD5 12a35512e1c54b40ba1389dbce5b81e0
SHA1 49254c2112cb27747af733967c3c50e565ac2c14
SHA512 bf67ddb7e53593b14935e8ffef5487800149483c2455c1867eb9ed08c743b268f4ac0bd3041979915d72647a96bfb3394d38bdde157ee056ad588f1ccaa02bc0
SSDEEP 12288:meBNUbTVO86UG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mJIUfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17F05CF7BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a2c6fadc5bb463cff9ea368e2d5de99cea17c38031a55b02bb5ef8353d56e4a6
MD5 2f67c749b34d34c37f4ba656a0406cc5
SHA1 0fe83ec67a62659f336078ee068bb1eb71003a3f
SHA512 46207e36231f49521f959aef747737806e9c53c83957385fc4e7fd2ea6be983f394ac806b449fe52fae156a6197073a0b79844694669f83d1fcb15910887e8bb
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:TQvGAdlCEL8c/DRNw5CJU023W
TLSH
T150267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5fc7deaadb68793f9bcc5c913d7f2fd595492aa2bddf7fadc9717647c7bfc750
MD5 f0c9fd760e61718ca00ade841eece4da
SHA1 ac1221bd7868f93326863340d1ed14fc7a9e1467
SHA512 673b613de9a0e9b513d488f84b4a93344e1efeca80c54440c46e05d54c13433562ce6bf9e85f5863684ce8c00bac76bdfa6a5fb186a0435c274360d0a371b7a6
SSDEEP 24576:B0ewsAj9gXe4i7ojhsP5Lgrk1TWb4AN5:6ljYe30jaNf1TWbdz
TLSH
T11E15E031FE74E032C3BB0DB21B76C712586C7A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e15f4055f00af2052397dc8d3485d7608e20394b9bdc16daad1c5766acf3b925
MD5 5515b8b82c7d5919bd864af0be499d18
SHA1 aeaac0ea2daf28129682a8fa7878bf270a31d73d
SHA512 eb6c3baecaac8ea6bb6bd7f4c725c9b0f32bab01967f859522e39dc69e3371d32ca005dbd39b30b490291506271576a80329e2f2be09f0a14cdc2d62efa24b48
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHAp4W:CUEtQevvqc2W1cpV2tI32g4W
TLSH
T1A7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 21db81b7533fff726cadae5882f2699199816333c30eaa7a7156212ecdd37d8a
MD5 12b04d04b7256ab868e9bab00577a162
SHA1 da20dd5d951e417d67ee328927918c9b1a723b46
SHA512 0048259e25ea5856fdb473ac7131cc27c9b5da18db450d47b88db9fc4c0713eacb92cd2f96c244540d03de580cd781697d5ff3938ad22af3f121d8c0cc337a26
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/z4e30jaNf1TWbdz:poqtVjnmNU023W
TLSH
T19ED58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e41793eff7375d69100f098810bf0e07a23c470914aa0cf2b91ddc5380fcf4ca
MD5 829bb8b27c466330eb6cf99d8372f662
SHA1 357ca7e32e05a6e5e0a3d8bfe666a0a79733e39d
SHA512 3cc33e6bd73a09787ff03bc1bea8cab6c614fe65665cdf1e525c8393fc796e47aa2f661aa5c3a820a5111f561fd2728082bd7eb9e50b7a65c0a96929fbcfea26
SSDEEP 24576:OAhGL3IFoiwtA5l7S53KgXe4i7ojhsP5Lgrk1TWb4AN5:OAMUFoiq5de30jaNf1TWbdz
TLSH
T16135AE81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 116f54ca8dae57532a4ba820b1d428f2d8596e1e3819781494154301219738e3
MD5 cb478ebad0484a29c19a9d7484603315
SHA1 5aedcc49c5beaa094caa25c797a5b4399e6913fd
SHA512 cec0f5cde9513d19d9d2f947342cb8e0ae6e96998e256535e91c0f5fc2b5f64453e006ce6f4d5cbd6681ce4b4a5e47d07f076dff02d6ed7e322ec90a1ae645bf
SSDEEP 12288:ReZ1IyM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EZuwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DBE4129637D420F9E2978278D4F68B41E7B23C92233147CF02A096A61F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a3e65dc9dded906b800c87204ec33209847baafabc49a9b5f7f9d7985c623695
MD5 c3c50d65f9c9906221a4ecbf4bf43ada
SHA1 dfc7002c0d5ea6bfbee2b3f66d3ef244e587ee65
SHA512 2cb17ef778fb218bec3cd3544dcc335d9da18f0c4eafff737e8feefe0d6001903c37604b7bf92ca5ca8f78c22f1de940e62e58fcda65c8a4d13dc804d4ec7c93
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:TQRQyi36YOcPbLvw2gAf+PN3aU023W
TLSH
T12A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b81f28da41cc9c030f4c605d02320255c6bf679af9364d9aaa6ecef26ba79777
MD5 742f435bb86c2626cce38fb78b894679
SHA1 1b78cf80387078e689f725b985125e4be3f0d62e
SHA512 537f083b7e08da57cab6bfe06026683d89d59a355d3b4c15d78f3fe494a45c9361e560eca640e331e0397bd098899c43ac2f1c011a912e8bb091a81694ee3c58
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:BQRQyi36YOcPbLvw2gAf+PN3aU023W
TLSH
T140667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 61e0dc5e49763ab1474b7e812ffda5cce9f41b9e85f32c15a5e720bce4971168
MD5 a3109b1c4595e1373569234bf390fc57
SHA1 3a6bf324aed3214a3225d8d193da03425583cd44
SHA512 7998f8bbce4f83d72ad89efe8918b73cfe639ad0ff4702757b4bbdd210bafcc2ddac0bdcf3210f7d60abb39063f2aebbacbc6d13211f07488f097a25df4161e0
SSDEEP 49152:668Qg55nhceWu7PNU3/Ie30jaNf1TWbdz:othLRc/IU023W
TLSH
T17FB54933B2F20099C04DE1769F4A873196E27C758FE0E7DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9a3e9a93044fe8cdc2cf0b943eac1e1a8348ee9cc6e796a909ecad0fa005a558
MD5 2fa41898bc01c696b3ee12d94cdb94b7
SHA1 2e1c2c033f1dd41e3dd92506603f1933faf45ea7
SHA512 11f9811928c5022186c4085dfeae671860ab12f6a80af96e1cbc7ee34b403dd8bc12da348054942401dd61a17a04eccefe5652333350ada5085d8cd4ad427e87
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99U:Sy5112gYy5azzVvt69nLKnhZLU023W
TLSH
T1E5168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 95a7b55cce54bc27bba8eee9deed1b4f775db23cae3be97ab4d4469df5d082cc
MD5 191af01920fe25005639bf0a7eb312d7
SHA1 94a68df606f75ab81d2bb4150a6653c4fabf8e75
SHA512 0298cec1cfa131b7250a1dcc888118280963da1e4afd6ae193dac6cc37dcde3c8d8d2219f69d4be1e316e4885c920eaace9ef1e27f87668bbc5e8008d3586482
SSDEEP 49152:AB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glHe30jaNf1TWbdz:au6Jmdxd2dHU023W
TLSH
T1C8D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 09c0056c6e2009bb4bc8676203a515cd8ad2420a9d5ea4cc02e040c47a86f2cc
MD5 2c420bfa2a98bf1a863b1823754ddb23
SHA1 3ff1bc0436c7561940fd69bdb9a63e6eca4ceeb6
SHA512 b695786fd8cabadd6d2a7c3fed61e0c340c99606d2abbc81f0641fffc284bdf5f017170511efe71bad0287be51f738f9185559f963e5a1f9e53685e9f626803b
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xWe30jaNf1TWbdz:smifPWRNU023W
TLSH
T135B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8a8bcc4e8ecd8e70f8a8a57f186f1872bf88e5567d3c00ff847baf7feb70c577
MD5 ec6c6d808bb881345b209df8f230be61
SHA1 51123dac3ab28b864378b9d81dfdb9ad55216cdd
SHA512 4dc9c696bbd251c8d34621b6e18b04aaf1226aaa43a9d8b1bf5f97d4b3d682f74c527e0dfcda894b9fc5972d4175d58a0cb0ca5943e3df57e24e2663be4ab308
SSDEEP 49152:3SuZQIY0Be2KcRVtOnks6NMHqXe30jaNf1TWbdz:t5dKii61XU023W
TLSH
T17EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 630991af55b8e4ebe82e85712224a6358475879ad9985b3bba027397f7618d2f
MD5 1dd4087c2327cdda538c1b3a97a80e26
SHA1 e817342fcbb493b15eed84606067e0c4a84fbff6
SHA512 c67e102eb3cfc8c591d0faa4ac18b9d0f33f6990414310182b01f47fcedbd43538c6a31be07189dd4e4fd8f94084d3472cfb21245cb0e6e37f885bd4d6967c58
SSDEEP 49152:BhtSn8EApI0fig3giDn0AP5wCe30jaNf1TWbdz:QX2imphxU023W
TLSH
T14895BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b87e8bab140ad9830a47400daa9a31058850d4a9bcb7b5cb3834a69dbe100137
MD5 ef7689ed1860e6c71e88e94c5f0f9a17
SHA1 f26fb2119271dca51a3177561e69a2d854451d23
SHA512 901072b68ecf54ce2e69bcf6cf2f5909333f438107148afac1eacd525f7501cb8140a9f7d61d78ae34dfc638e56d93e208f05f07bcd6b73e0a2c4c88093b1cf5
SSDEEP 12288:7f0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7MgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T165C423919E5509C6E34BC3F0D0F7C7D1E9E12EC272414E6B17E0F9531AFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8cca48f5d843f164325a6889e639e80d92af2e69d6bb7ac253d320f65281eb90
MD5 3abece2e18176e4f5732eef972620b03
SHA1 3370bcc1cbb6806f07e791a5a81eb71cc730cdd3
SHA512 61399d9a4aba0958853be3bdd6fd1523e86f4515085ba394d63a60195d781f7ea01c4967f58e684ef5ad716b06c0e73ae679c4cccd70fee50f5a6fea9d782a23
SSDEEP 12288:4I0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4pgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T122C423A5AE5509C6E34BC3F0D0F7CBD1E9A11FC272414E6B17E0F95319FCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f7d81c81457b70f2a7cf9f7665185b6e4feac7cbe52cd6d16efa76ee20fc9ed5
MD5 e26e520d2069c432fe2c4527c193a9c6
SHA1 c1cac3957ec665d07bfdc613d308805107b0f8a5
SHA512 ebe97a668246fa09e5318076ae8d22bdc2351cae2edfe351ce7e0c9d65152701f1555a93e57edac6a99aec0d5d1f3664960df635201a9609ebdbe4b1d877ef09
SSDEEP 12288:aO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:angXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12FC423A19E5509C6E34BC3F0D0F7CBD1E9E11EC272414E6B57E0F95319FCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 002faf434e7eda77944cf088245b3df9b00c19764236228ce56a3dd735fea6ad
MD5 775f8373cdec6e9242a2cb090e18b6ff
SHA1 73e0ddf9662d00c617674c3bfd1f7d0b2f0b2bd5
SHA512 8a15d5f21c213ef1b5e0936f090fa04dbc78ee672c321f9c252ff70cf7d43bfa93571aa49ecd8bc77109e634590edb9786404686b562bb8ee62700a52a3dd0e7
SSDEEP 12288:eV90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12FD423926B5505C6E28BC3F4D0F3C791E6F13DC173114BAF47D069530EB4AE8AEA8A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5a4576118172f60bc79c080e418b6af78d1638bef46205b686b9fdfb1373e962
MD5 67b28f8ccd6c17280d682a1b7db0e580
SHA1 959009ea1d5c3a756d88bf57fc29ebb5d8b0778d
SHA512 713d49c4eb141fc804b905c305f67d5a7fd82d48c46357da83b392e989922308d15205f6fe8d39f6f0abfec8b24caadffce527b56b659ef6cc5f094e3c341f25
SSDEEP 12288:9V0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9igXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T165C423A1AE5509C6E34BC3F0D0E7C7D1E8E11EC272414E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 446be9362ea4b341ce9143dd34995ddf99fdd7f484c307ea417e5a46e5d06b1c
MD5 c3cd7c62ad32df1c85474f45b59feb30
SHA1 1fdeb80ac06c1e5ed0038ebe8ea0355affa58850
SHA512 e91fbeaebe34916e3103a5b3da35e103104907d75a2dc7dc5d7e68cdb79c5aa92fd616924d7ac0125ca42873f233114add19b0108ffdb203e93938dee3bfb008
SSDEEP 12288:AE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11CC423A1AE5509C6E34BC3F0D0F7C7D1E9A11FC672414E6B17E0F9531AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c5062246913852661c583b4b1253e87688ee0d9e349dd63aa150dd2991e666b4
MD5 44f9b431591a3badd5e4b9b652adf508
SHA1 4fd49551f76274e60424ccf8ecd3bca143dd310b
SHA512 3c3279b2d5320d9823b4aa8c6ce22f3cfafeaa601f674b2c16fcfe0245fc96c206f06c7d526d325daa50df65741ac99d942c6669a8b8e21d9fa696c1eb99ebd2
SSDEEP 12288:bg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:bhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T139C423A19E5509C6E34BC3F0D0E7CBD0E9E11FC672414E6B57E0F9531AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5bf54a7b6d0af3d23903c68a1167aec558b5aca7c64c24a77f0ca54576b8428c
MD5 680c67a552ecc3a8320a9ec2a0335481
SHA1 27a972727b50c209255d17363447cd1b056d8346
SHA512 7e5c990eb7871dafecc9f2d509fb9ab3c48f906c536a234bb1545fd9ff395ae96b6e3c0765c777f52af37f7e7ae2a29b6af1920299f2d87853d7dec1954d166f
SSDEEP 24576:+ZMRzFVSOJgXe4i7ojhsP5Lgrk1TWb4AN5:+ZMRzfge30jaNf1TWbdz
TLSH
T1A9050195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436671F737A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f1717c29e41a5aaa6e3e5f6c25c80303c9f59028f6610787614aad6325282203
MD5 0a3ae417ad5a250e3d60277dd8b7fa6e
SHA1 daec5319138bf06657ed4ba77e6bc23fa3482f73
SHA512 f4099ec810fb730a8365bada24a4f54b9a4a6bc3f8157a077d52cebbdd8d8db7a721f22bbd1e733eb09132532abc498fd074d93e94394bf86bcc5368c5d16dd2
SSDEEP 12288:YD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C6C42392AE5509C6E34BC3F0D0E7CBD1E8E11FC272414E6B57E0F95319FCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5b9c7f7f3867b7d2ce0038a9b35880d92335eaec88d9829a9a8e15ea49324466
MD5 cda87b4e3a73608eccbfd41a4d83fa60
SHA1 780a0700dd9f41355081dbd827cab3392958c261
SHA512 c4ade86c4a38d43af766092ccf60ace34a64dfa4f5d3bf0278207e3622469fc3c492cf30c60f39bcb16f628571c598bc1f8e19a2e1ade6576b1e00e510ae4915
SSDEEP 12288:RH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A4C423A29D5509C6E34BC3F0D0E7CBD1E9E11FC272414E6B57E0F9531AFCCA95A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 fd39b4e53241157a1c74d078ad4964a9c610704cca8972ce5adb28fa1f4f19c1
MD5 32080c8b7cddb4732f58afd67a7e3778
SHA1 5f51038101de55ad599703e31843cb1a64e1f3d6
SHA512 18f107342ca867026404b8c3a1ed75fb282b6fc84f2f6a585e8c8bf577a0873fa70117886dbc30c2ec2b7807af477e60189710d127d90981e7633eff66f0c774
SSDEEP 12288:/yPz5L8M0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yzytgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T188F4025777A120E9D1678278C4E24B41F7B27C7217208EAF13A057732E776E19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8c612dfdea3b95df4f1d77726b66626619f2d0265117ccf07fd17af51d4e9332
MD5 8db7b096a3edd2757dced35b72a233dc
SHA1 07d759db5a1e0d7290c8c1f267ce4109aa9a0d3e
SHA512 6ff4bc1152c96735ad638bededcc9f54eaa2793567e3a71d164ab7dca278edab2c838e1f4a41fda83dcda3109c1e30b5463e7b077b6152a4337289879ca79ed4
SSDEEP 12288:RD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D0C42396AE5509C6E34BC3F0D0E7CBD1E8E11FC272414E6B57E0F95319FCCA95A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 39669290545976d6effa83652d592c7b0b8e008b1dd57f0a9bd2f14210c78667
MD5 43a53f0a0fadb5121a1645e88a1f14ae
SHA1 2f177f0893d2bc7733beb546c371204a1f9fac80
SHA512 8c9cd40767c0a7fd07e05ba7969eb64dcda5a0d8226033e74240291c7c5b2cecaa8b1efdf6e768b246e6c4461d2bf2dd98eb084c4fe99b504e93cea0fe697f7f
SSDEEP 12288:4D0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4ggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A0C423A6AE5509C6E34BC3F0D0E7CBD1E8E11FC272414E6B57E0F95319FCCA95A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b49e75ae36ee352d33458bca3da4787f3450f0eb7ff74b41422cee35559fe311
MD5 7073d5f69e01f4d84ac4c0a631f29b3b
SHA1 d585b7041e8b6a8f61508d362183cc347e625cb5
SHA512 45a62c10bac1015fdc8287c95e583f86f3e5a38c5c35ff7a198d993550a0e8bd015f559a9eb68705cd4a08b0478f9b34a0a4ef60bdc98b96606493c1551d9853
SSDEEP 12288:7yPz5L8M0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2zytgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T127F4025777A120E9D1678278C4E24B41F7B27C7217208EAF13A057732E776E19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d1792afcac3aedd6db6c22da9c8e434085c4a796a035ca0a972c25a64981ba13
MD5 bcdd31e6dc8fb2cd85f73746b6e2f802
SHA1 6a2f16036ce1285d4ae4b51b90ca8c981d4ef93e
SHA512 4dcac60ee266bbeba060c0b33947bc69314df60e67690dcc8cec300b1d24887e3689ec05669b3dc0633c6c7d58a343a1bdb3eb3f60904d2f25d6d7ff5fd20b26
SSDEEP 24576:RTDaLl3z0zD3gXe4i7ojhsP5Lgrk1TWb4AN5:RTuLlj5e30jaNf1TWbdz
TLSH
T14E0502A5B3500CF8ED67827EC8A68A02D6F27C561760CA1F03E436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0294c4e15c1f53db5d58162e0a4942909a9baa4aa390abf741af349862b4d1ce
MD5 f76fe7dc7faa6e915d99b7c476779a9d
SHA1 e4a7ff106d8418e561430ffbd8dc08f5c70dd72d
SHA512 e5a74348bbd2f2843e7857db85cba18e1d4a3bb6cac416b6cc86e5faf5591af84836d7368eab8644bfad1b563cb678839ec163c30d3d2f651b70e975a795573f
SSDEEP 24576:t3vd9CHKy7GZDgXe4i7ojhsP5Lgrk1TWb4AN5:Nvd9CHKyage30jaNf1TWbdz
TLSH
T16425CF90F3E414E8F1B7CA75C9764511DAB67C9A1B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1b7a75cf3c38414f09e3c9c3f664ef33d6fc5c1dc71fb877c7ac9b7956397865
MD5 341727efac233c9e59391c7d0233a25f
SHA1 8e30170fe31ffe3a674490add5cf98b67b1160af
SHA512 f314475dfab6fc2424522b28497c3fdd26253b71f288d117fa0519683d3277713f2ff25a7f4854b1ace1fafc860128e7d01ae01a65c98755e98d6a2e49dee380
SSDEEP 12288:Nu0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NHgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F6C423A19E5509C6E34BC3F0D0F7C7D1E8E11EC272414E6B57E0F9531AFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e60b270212f4b62f2b719f12087d3275d501830fe2992fcff8bf45df37c7b712
MD5 0b80837dea4cf8c117103434c6b6c28c
SHA1 f6b348f074688d0ab0248ea7629cd76a895499bb
SHA512 80be5bde68c831cbeb36dff6a0ed71ac581c2fe5341d05d57e6f0be485cc881732abd24527ddd60ed9b1a500fe5775b11cb236db4387302a8dfaafc7af3d3a9b
SSDEEP 12288:ys0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T164C423A19E5509C6E34BC3F0D0F7CBD1E9E12FC272414E6B57E0B95319FCCA95A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 89a092a3c6c6a1c5b7118f95a6b29c9a5c92c6b28cc2dd002fae2308a7e54e4c
MD5 793cac13c1df7383b4e55f8b2ebd0461
SHA1 66e20f4378a6484c2112de2aa2ba31adc4474350
SHA512 2a63b32e0e72b817b2fe0fd95216070f0a542cdc2e4ca17254816183df033e50485fc6d69482274696bf8873904f9eb83f96a22288a2c0ce0b0b55b60b70d3a1
SSDEEP 12288:Ih0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T172C423A1AD5509C6E34BC3F0D0E7CBD1E8E12EC672414E6B57E0F9531DFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 1865834e4052325ef0c79039d644452fdbe35d5888ccead194da9913df079978
MD5 e8917efc60a9e297a2468f2706a122d9
SHA1 501d9deb992856b66cac26e847c439ccb352320a
SHA512 922c37f8e4e6348b2c5d54666b6a8c679e36ffbc5acd2db6efe5d7bd8dbbbad199f77ce97837a5ac65c2dd9f2b8b8751a9d92e676842721bfc8957b91d06d265
SSDEEP 12288:nD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T168C423A2AE5509C6E34BC3F0D0E7CBD1E9E11EC272414E6B57E0F9531DFCCA95A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-10-12.1726.4796.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-10-12.1726.4796.1.aodl
Size 10KB
SHA256 2089f413fb31af679579e06aa32b8dd410204c432aefa6a3f0e5489aba1a4680
MD5 51c06bda190b457d4a3db02733ffaf3f
SHA1 89a2b1b9ad976e26f54de509a2ab3da6bbd9ceb0
SHA512 9130087e847f53e17fd2aaac228fa0f9d0351a5179a4c139c743476992e3a453fd91ccec21ab595a2acf7ad331881efa14c883400891bd85a0c7695a319b78f3
SSDEEP 192:uPHqvbONFsOB8cf4fgPSyVFYPa4h8gZgx41jp1D/2ILPSPv3gHn:/T5J
TLSH
T17932AFEBDC614220DD8710395961CE8F2AF5C4EED0E7F82E63D77D8A141B91527BE222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-10-12_172653_4796-4912.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-12_172653_4796-4912.log
Size 1KB
SHA256 1a7302fca0f22a5e86e746ff9a29640e02caae6e6250c5f8ab0692e142e36be5
MD5 729134e0cb694710ab982204abda2f3b
SHA1 2f0997c4605d9de7d036944fcf9792def66638ce
SHA512 ba2970199bc2363fdaffec58f8ad427bdd95b9cd3715a6951a50162925803fdc4feffb5ac2652616cd85584915a19266e604c5e31abf5d785a2cc35f4acc276b
TLSH
T1EE21B41A7BE40A15FEFBDAC299FA10539E3939923831C90C00E0524E4931F40FDB472B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e2ca83f91feb198e24f2efd399df172cea102ce9bafe91ce675141e9838e3f0e
MD5 60138e32ee94b01e0aa5ca0dc2a895bc
SHA1 bcf507b828732402b0fc6b25d1c16fef2fd38238
SHA512 1422524df695b5a5f04088472af2df13bcbc765b2533769e23d2387e221526ac0e706c2ba782c396e4c38d848e3b9acd26c248e19138d50e845c9215a41a6701
SSDEEP 24576:XfwvUk9RX6wkyAIEgXe4i7ojhsP5Lgrk1TWb4AN5:FMnYIre30jaNf1TWbdz
TLSH
T11735DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0987262056cdb794d57eeea7346a59d4db39ab16050af910801d8323162f2a95
MD5 26208b11ea98b58c686125e44b15f717
SHA1 6d345d0747407842a2e1496a24827c57841a61eb
SHA512 69d87a2d61a910b4554dea772c35c450bac40d8392b698814a2361df7dc5598a28f225946f70b5a0b77aa929cf47c691ac7a03bb6263c9334e5d238ee3c4db14
SSDEEP 49152:1YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ie30jaNf1TWbp:4ySzP6U023W
TLSH
T199067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e881ded0575ff6de3c2acfb286fa9790b5cdcc0979a89da7e5fbe9635c3fb4b0
MD5 8ffa29958ef759096496ca9176fcf021
SHA1 05fa7d643f95420213e9429248d262a03675d4de
SHA512 f64651e16e8dc1a9a6c5a24c54f3f92813150a59f34e87d2160216aaceeaf421a726ad671cf3986a17d730f0b8e155c0bdeceba03c5544f141b14174fa575b3c
SSDEEP 24576:447Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY5gXe4i7ojhsP5Lgrk1TWb4AN5:447JUQjTirIhCnDHUPfF/ye30jaNf1Te
TLSH
T1F365AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 167854ff8f13879cbdc54bc797f369a74d7088642955950b11de87fb2f5bdb68
MD5 399af6ed92c0ca13c7e1543bab58c4d1
SHA1 bc52c02c1663b15576c013d0983b6024031bff07
SHA512 9a85cf16ac57af77daea9dc2b9aca68d4b7c197119f37fb4db23f60751788635049255ed11e4c7e3ad37c14bc6d89ebdf5aee7d0a185548f8e8e6fc27d0cd466
SSDEEP 12288:Tbsfz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AFE4F15AD29802D8D15E92B5C3968A41F3733C6193E1C7CB13D0F93E1F79A909EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1de6e5f581a5b6842cc3ba22ecf65e428cc88470c213fb9ec25d67ea1d3cfc88
MD5 14d9a8ae3654f94cb624fe0b6e717a8d
SHA1 cb1ced3dae63437c703e9ab03f2230be42ae5bc2
SHA512 58262518873bcb224cbe882d3e75e9d00c44f817699de2adbffd583d33d0bf84ecd2a497dabef741e5f257bc54ca2c88b43fcfbfb8190ee236f004cbc16698c1
SSDEEP 12288:FFD0zwcfU3fiSf+JpS9dw6LnwV+OP7NnRM60QcZI1PW:FJ+wGUP3+JpS9dwdIaNnRM6PcZI
TLSH
T17E3517017626DB8BC6A950325E36C6CCAB70BD42FE05AF0372C9473FD476659B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 865c00a3626c90557d89df34cb392a1ca643fab248ad8a60ae74d9069aec6946
MD5 2a5c66aaa61197f1d9e525db11486094
SHA1 fba06c646fc18172708ffc63f60d67760939e29a
SHA512 372c29730c22b3690f7428c372d7f2dd5803acd7b86c6bf8620abde821aa0ebc311dc7dae82b8868f61e85063619712d37b35149474137b61e8f4c0f77b0102b
SSDEEP 12288:hiIpnm/6433vg2miuFQMCUwDhYZFL9iTVpRxiPQP4mbYC+G6/EI3ylCA6Q5LYx3/:hiSiCQMC7S7ZKDvw+EB6b+BctHTS
TLSH
T138854B015577EB4FC8BA4037463296CDAB74AC06FB452F027385893AD867A5FB5E23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 72c8933a19962c10ef500b80f9cfcb0d5b54a6636bbbd97f75ab364caee05a2b
MD5 b9cca2ecef917841d557541e42fa18de
SHA1 0d3cf03873b518cfab5977c20a0c2300bd80b2cb
SHA512 2712d3c662cac6ab1f641f5f8908aabab2df5dbcecca5f3b2f6cbc72d40e90be8e587fa7cbe917db4e4c7f4897dfb6e96a27824ffecf2beb9cc80dc1f591a813
SSDEEP 3:OlH/lFU6cDMqtdNlRl3y8Dl63mCllltGlslslslslslsl6QFJl:KE6yp/lDMmCtEEEEEEEZJ
TLSH
T1C78112C09B641F60CE62D03189F413440F29C6CB6CCE97E7431530331D4166CCC46B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 33c193c3dde1d6fb912d22027b23b7f9ac9756ad017cc072ff475ea7c480e921
MD5 292f5be757399af690b86060baa687d6
SHA1 9911825c4cbe69f77a825863ad1e2e1138c84f2b
SHA512 6349b01c7fee1240b2fe105631e2f866588e2a4c703a622463552a5405cb825ac87582185c81b28ea0c6a9f3698ac9fa6f717833a1b8aa6f6ad2c7e42cf899f9
SSDEEP 12288:DM7r0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C1D423629B580DC6F2ABC3F090FBC760F5663EC127008DDB96D0B69329B8CD59EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a6c3d4b447900ae2794d2e55c77d228037a031b4fc0ed9c7f86a3e2f324698ae
MD5 aebca308d1f0803ce8b31b14f88342e0
SHA1 632e9e12187ad6ccf004b21ec3f4d2cadf6786cf
SHA512 c2a857bbf79a6197c4c7f51f6152c80f494c91122d413b6701242cc487675e5b726ca64de1883b4c899d672b880ac2c3765eb191227790b015394ac17e8c78aa
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYWgXe4i7ojhsP5Lgrk1TWb4AN5:Igb4mBIBhGFEe30jaNf1TWbdz
TLSH
T18665AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 7af061358ad118bed4c6a1b3fc3d155f252d3c8ef653bf26a1fddaeda75b7bea
MD5 d787a653834ff8c6562610baeebcf438
SHA1 e2083f4bbf85f0aa9d248de4f4da27efad913bec
SHA512 4d9712aeda5ac78e1aa2d4b2ccb152206e78f40cac15fe4bec44fc26f9e56f707541a371d4946504a76924db5437420f1b5055bad38baeb5da36b25b1186ee70
SSDEEP 24576:wGqaKngL2jdshRTdG1YxITqvfPkbIcbjLm:wGqarSj8RoTCCW
TLSH
T17305237EA7C56694C43B977429B6A84A3CF33768970A46DF88E0957C4F6A7E0363CC00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8e169c0e7666418f8a44eca0c86c678c760b9960b6fd36d40bb55a0768c20b1c
MD5 f867a0992a1b75439da7b4abbe341f96
SHA1 2b6f4f69521fa92f8ca3a6944d50d68b51c6f958
SHA512 954ac3fb6f0293468010bfc0a5ded37c626ad85d75816e4e0fc9e1c9bb6c8b02c9b153a9e8a0505f4571bd87de7a844e86c78dba7624e97eb70e11b73ff122e1
SSDEEP 24576:YG88u8FpJqH1bzria7/mJgXe4i7ojhsP5Lgrk1TWb4AN5:b7ZFPqVea7/he30jaNf1TWbdz
TLSH
T1CB35F16577E101F1D07BD13889824663F6B2B8251364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fc3164c92512f4d56e1a0af698d69960bca21353f145d2190498b84249815ab8
MD5 fa9476062be2368602bb18bb508500c0
SHA1 38dad8a4daf3288e0bc5c4f027d60b5a821f8707
SHA512 bb50c5b14ddfe8627f588e8923484ceec3747d25768625844d44ab5c3746f4fec64ab155a90d390dba7d9bb8ff70dce42f8f89a9a433975bf53ebcf74e9ad1e3
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQe30jaNf1TWbdz:4G05lO43bTU023W
TLSH
T1E3D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 faa276551b05816f53020dbaa0598fc25427c54d5507c4f4d82c4d7bef16147d
MD5 0f3650ddba5ac277300506050826d955
SHA1 4c41d8e598cad16f239cea33aa1bb0f36692c656
SHA512 acd5263bd1cb7bee13d67e95260995e3fc525d0984c65aac92764316fb0d1f8dd73c4805fab1deed1396f5b5fdc896a40dbfbeb324277a81a5bdefeeb54623b2
SSDEEP 24576:Tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7gXe4i7ojhsP5Lgrk1TWb4AN5:ra5POZ3BJt2pasx2+mIe30jaNf1TWbdz
TLSH
T16565AF5EA6F801D5D1B9D17DC583861AF5B1346253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6db1e8968b4c43af2c8f42130a4e2a700b32ffe2e7d968c7aeb5fdc7d637f482
MD5 09a0ecc8b8a1608dad85270364afadb5
SHA1 93798e6fdb73fcfa3d54a0fa6bf869f571cb1ce8
SHA512 f325f563feb530b21a849a1be3e4a58f8ef85d3b279d6644c51a08e8db6cef2b8865f66a52f4b13faba3521f3c9d56fd86c8aa588ae3a42e7f9ec82756016c26
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkxgXe4i7ojhsP5Lgrk1TWb4AN5:YNc/zEOVHFBe30jaNf1TWbdz
TLSH
T1A3858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 7f3b946d050e24b1b83b347b3c9433192c52c44b84204c8a84b4d1fd8be1e606
MD5 78881c4e2639cc37a2ae75d88bcf1246
SHA1 cf0590583a9c567abad137ba54699c49130102d3
SHA512 be000d651e4706c989ee50ed2da807ad3bbc6ebe9b3e36cba17dc3d515dc7552d2327be77257a66b073e223d05d085f097375697724fd7f0a3158bffc740503b
SSDEEP 24576:M6DIFaKngL2jdshRTdG1YxITqvfPkbIcbjLm:M6DIFarSj8RoTCCW
TLSH
T11A25125D63AA01F4D06BE13D96934506E5B2B2B487074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 80a642a17c467ebf16daba2f28dab8dd6465f4205078208841ceeece2484a179
MD5 64756605889380e13eee60ab6454e030
SHA1 0328e15ee0bbbb3f09657a1459d1e53c67e248a7
SHA512 2d6eb7ca3922185e7e93164c80f87c7ae59eb1988e055b3fa8318d8edfb0fe60db453d035e15beee4528ab21f41c9ad18cf113f99120cca4f3725e0933fee9f2
SSDEEP 24576:ETkNvNnaFeYhJNtmZBmhaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ETMwBtOmharSj8RoTCCW
TLSH
T11B75B06EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 56486613a92660b6c0823758bba9ab507aecff6dd4add881690ee6bcfe67502b
MD5 1a997a932c31eacf714a49dcd9295ff5
SHA1 65d3c0d88ebcd9046569c9fbd9d2abb5272920c6
SHA512 14890602202371de7361428b99a12eaae93e934312ae0ad1343ea0aeac0b7ba3c48b7f3d1ddd713689002dcd37b15a10dc0e8596bc75f250976d3ee836225bc1
SSDEEP 24576:KPUr+NQ1gXe4i7ojhsP5Lgrk1TWb4AN5:KJQge30jaNf1TWbdz
TLSH
T10805E12F66A818D5E67AE17C85828719F7727852131196CF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 ff84189296d2e7b34b4a57ca919cea07b340eaf3196743aec2a4613ae810dbff
MD5 1646df90204ad2d62410a8f27d4a320b
SHA1 e00ed005ce777d8668eba0e4d5ab68b255552578
SHA512 28dac3c5a07596897daefc5fe61683bd53212bfc060bb8a5a25cd114fbb94c497f247c6add2589bb0bc20e160579dba3d35bcb961d3aa673a144d1efcab8982f
SSDEEP 24576:uD3FHshBIYQgAsgXe4i7ojhsP5Lgrk1TWb4AN5:uDVHeBIAAje30jaNf1TWbdz
TLSH
T16625E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d557150613ad80a0f2a1dc14cd2a3260d53d56f382b55ec8d3c29a30bd1bd34d
MD5 9161424e782f912b50a820bbcc62d392
SHA1 f9443e6c8e7f3a89f1e400b4e200d9a871739dfd
SHA512 bc021d80aef79fc56703a26d7dc1328b7eb44a9c62e4afa1e3b234a72477991e974ecc5c71d0729cc6107f144b45552b40a47b5ba7b1f3c6b47735039db17edc
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+Cp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:ywu4OWRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17C05F14676A40CE9E5A78278C597C632F7F2BC412A21CB1F07A0C65B5F77261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-106-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/256-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-100-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/256-340-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/256-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1484-123-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1484-131-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1484-125-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1484-323-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2452-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2452-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2452-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2452-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-186-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-40-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4316-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-32-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4580-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-324-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4580-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-112-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4580-118-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4660-143-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4660-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4660-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4660-145-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4660-137-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4684-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4684-299-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4684-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4684-57-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4704-84-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4704-78-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4704-76-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4704-318-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4716-320-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4716-95-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/4716-89-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4716-90-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/4796-67-0x0000000002CA0000-0x0000000002D00000-memory.dmp

Download

memory/4796-87-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4796-66-0x00000000021A0000-0x0000000002223000-memory.dmp

Download

memory/4796-0-0x00000000021A0000-0x0000000002223000-memory.dmp

Download

memory/4796-19-0x0000000002CA0000-0x0000000002D00000-memory.dmp

Download

memory/4796-21-0x0000000002CA0000-0x0000000002D00000-memory.dmp

Download

memory/4796-13-0x0000000002CA0000-0x0000000002D00000-memory.dmp

Download

memory/4796-8-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4796-6-0x00000000021A0000-0x0000000002223000-memory.dmp

Download