3061c3db05a8a11502e34e34e47c18a6d46cb44b977934922fd8360b84ad9f44

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.9MB
Sample261017-aejdraft3z
SHA256 3061c3db05a8a11502e34e34e47c18a6d46cb44b977934922fd8360b84ad9f44
MD5 061dfd5832e33169a2389f152af9ff60
SHA1 5c225c7b57dd71035db3d62bcedea20a67311366
SHA512 a27f9654ef0cdc7efe15235a24c594ab850e71df1abeb4521e58e75b5868dc7647975d14ec767608406e2b44fcb5412059b01dca11a4bbe71c0794157a170d52
SSDEEP 49152:M+MqavvJdy5CSyL52Ep9rLfFyQ27jTxhJIK4c07YaYzYVT9qfhgarSj8RoTCCzfu:M/vR/OhJIzcSJTXMfGBu
TLSH
T13D369D4BE6B940F5C0BBE1788A579617FAB2781A873197CB4790475A1F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5112	elevation_service.exe
2784	elevation_service.exe
2680	maintenanceservice.exe
4168	OSE.EXE
3696	PerceptionSimulationService.exe
5156	perfhost.exe
260	ReFsDedupSvc.exe
704	SensorDataService.exe
5688	ssh-agent.exe
1560	AgentService.exe
5668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eba110cfe4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/996-6-0x0000000140000000-0x00000001404F2000-memory.dmp	upx
behavioral2/memory/996-197-0x0000000140000000-0x00000001404F2000-memory.dmp	upx
behavioral2/memory/996-72-0x0000000140000000-0x00000001404F2000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f995438ccb5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000891ee0cdcb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002995de8dcb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a011acecb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bce7738ccb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c8ef8cdcb5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
2784	elevation_service.exe
2784	elevation_service.exe
2784	elevation_service.exe
2784	elevation_service.exe
2784	elevation_service.exe
2784	elevation_service.exe
2784	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	996	2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	1560	AgentService.exe
Token: 33	5668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5668	SearchIndexer.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5112	elevation_service.exe
Token: SeDebugPrivilege	2784	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 4424	5668	SearchIndexer.exe	101
PID 5668 wrote to memory of 5228	5668	SearchIndexer.exe	102
PID 5668 wrote to memory of 6140	5668	SearchIndexer.exe	103
PID 5668 wrote to memory of 2508	5668	SearchIndexer.exe	104
PID 5668 wrote to memory of 5216	5668	SearchIndexer.exe	106
PID 5668 wrote to memory of 2548	5668	SearchIndexer.exe	107
PID 5668 wrote to memory of 5884	5668	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_061dfd5832e33169a2389f152af9ff60_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5156

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:260

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 910cb29eb434d46b7c8763a56d6ca0ab833cb747df5e65931f80d303de875d99
MD5 ea5d6b6ad689c7e2c1e3f6319f202a5e
SHA1 1d43c8535a3238d7c1ba79d4cb047d40f9c4e1cd
SHA512 6b6da0f05dd75dbcd134999f6da5735e574f1a8b95a2302454fab9b759d0e57d7603e073db5c24dfaeae6c2d2d6909f704be82042c7f64b1b96b7182ac4605ae
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWfItfGBu:D3q6HjBlMfGBu
TLSH
T12DD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 600189d2763c8b6ee0f97c3ed94293ec16f6fbaef7011584c309101f413508bf
MD5 c77b6c61fa38d6d3792ca825b0478378
SHA1 1498cf1a969db9ca98b211fad938135c968649a1
SHA512 a4743685e298b67a6ab37e162a067db43cc459ead85e137db735d7928f649e3bafdad5e4e53ebea6518fa63814bc49c3a08cd70552cb2324aaef9af47882f1e0
SSDEEP 12288:51XLsswWkxy2lRq2czAE6JooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4Os:XXYfDtczAE6Jfs8Yt2xysCqvk4Qm1G
TLSH
T1A305F228B3E40CF8ED675278C8A18516E633BC9587A0E78B03B495651F333D89E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 741a65e64ba8092f7ac3a582e87fcbaeea1b1c5937124a7ec247b64e4d82859d
MD5 0eb3748b8afd0763c31ba1f0a1280ffa
SHA1 12c0f828631082bb6b15e3f809bf6925e85cd3d8
SHA512 9c9df88cb1a46ba15335d4d6213a9ed955151ed0e180190bd61f6344b41dbb1b2e0bbe4823db4de4b14d45bbf4a2345e92ef7d2816afb8498468680b27c58081
SSDEEP 24576:/0Le5ji0hmxirMX6Jfs8Yt2xysCqvk4Qm1G:/Pji0AcHfItfGBu
TLSH
T19E359D16F6748735D073C0B9C5D2A68EE972308257308ACB4286D77C7E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 af60f1e80ca4f65fa752b21903822ebb73c2e073911b669672741f9d0b1a850a
MD5 1949ac2c80290762bd674d02af511c46
SHA1 c40298bc9a79e0e34115fec4c89ead2cf9086095
SHA512 d783ef4a3ec407abb40b07ebe90c3cf24d199c56ef4fd1d39e71ead5ded1389ee442c9b85970c56a2d12f20e51e72891d552b123e711bdac6f1ac94fa61bea1c
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyuF6Jfs8Yt2xysCqvk4Qm1G:n/ezSC6vUzPvxHjyLfItfGBu
TLSH
T182755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a64812e0280dba145e969083c519dcbdfbd17c7622262870b0ae2ae6c7456cb0
MD5 f680dc08b602c8f1b32a921df2f3598c
SHA1 d223e28fd739147143651e508daffe4ca2d230d1
SHA512 30e16aefdf90ea5262c04dfcba22323fc4dcb3a8e2ada53e08a4c3e6e979f04265323b640cc8ca329acc16f7b22a4db7b332a9e5d2300a728b72cddf002295ef
SSDEEP 24576:zVbqPb88hv/l+6QZJfs8Yt2xysCqvk4Qm1G:zVO88hXl+TfItfGBu
TLSH
T136559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9c1b8500af2d029d4564930eb74f38d7ff702411da65dc67895a26137e3727cf
MD5 1e4f43d0daf4434ce1902cddc788b57f
SHA1 1110abf2641a378b60ebdb64a84a81cf73966309
SHA512 df32399df4efee003a88913249ba13f5a4d4740d8a4d46fdfcf607209cdbdad267f686ece3a0957ce433cd8836042484c7b845ebd420b66a61abba4c3249250d
SSDEEP 12288:iRDZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:iRDZJfs8Yt2xysCqvk4Qm1G
TLSH
T19BC42351E2A98C88EACB3B7011D4542F2431DFD6F1F0A207233776AA5DB858ADBDF449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 97334fc8d3ad1a09cf3b34a31e1bd89c61e8a00f9c60910dd7a8bf2fe78e4ebc
MD5 c5e50f4f34b80c8b9d422116a99a4468
SHA1 9c0cce7229bdada4057d0c7c632eb2978d4b8ef3
SHA512 b449bfa563995ea425693b16ebf7776c9a0b536e9f2ff0c1595a98233ad38fab7554da5a72cc297d5c4cab4906fa2cdc904bdf91ac29f15cbbe732f52cfd04ae
SSDEEP 12288:2eBNUbTVO86UIZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1Fw3:2JIUIZJfs8Yt2xysCqvk4Qm1G
TLSH
T10C05CF3BEE28FCD1C27A5DB856918600E77278708B61A3CBD175830EDE235D15EBAC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 65c7593af3e0e4a5ac8afde3a404e3b9a1062b473dd04a5200047d3e25568817
MD5 5b7ae80da76e529c1fbaf824ae985078
SHA1 b6d324497694b10eea6e543f26d530e348605547
SHA512 645239c65b50112f55b9338677bac0c31e334ec6e92f02cc88c60196ddd1f60aa7e483193c80b594196207202345849465b1e8647fe605928d2d7ad16a288949
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:RQvGAdlCEL8c/yRNw5C5MfGBu
TLSH
T14B267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a14baed0bbebcdd7aa67138ef6756edcd138e0f664815e084c14cea201f1585d
MD5 0d4c162582ee8a1846dd6f38409fa402
SHA1 f647d2823bd5dae4e73b0f8428ad50a9d8f16890
SHA512 d15701379b778f3f263bdfa52ea29bc4eed1c6fa864c669e2d621b278d550c1be2dd207e3f44bdbb0395a65e8fd1433d12f866d260e42206202c0255e8e0e860
SSDEEP 12288:7AwSfxL/2Dc34DLLmt0LDQewsAjuZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTu:kdewsAjuZJfs8Yt2xysCqvk4Qm1G
TLSH
T1C115E030FA74D436C7BF0DB21B65C716143CBA604BA11AC3E3A89E9D59702C267B6E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1490173f0135963774fd676877fb544f87d299f1caf213db2c4ed9a0c61c5111
MD5 3f39a8ec9e24f8cae09f186c00a0a9e4
SHA1 67ae991b941d67eac374d12215ebe02b35bcb80f
SHA512 4d9877f3fc899c697d9c670f15817024713fe39fc2d469da909a06f63631f1ee94d9267adc5cca309cd292840abbf5814584859e1e9e8d38247cc82e2fe093d3
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6FB:uUEtQevvqc2W1cpV2EI32uB
TLSH
T171474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 baa81ce47f4cbac274a4c2b16fab16a27fd103912224b0b3a21ce5885465d0f6
MD5 f910a05e9b182a40cd86935b7db8ae56
SHA1 8c224584f85753ab87a23120885065af93b698c2
SHA512 3142329b2ad71c65e626259a3ae4821be18d10327b2add15181fc2b98ff40f0a2a95d53c5f24aa422570deab52cc392f6e01e1a7a2cdf80eaa0b52952a1ac396
SSDEEP 49152:2CbRquA/m2yL5zifFiV+XenmE3/zifItfGBu:7oqHVjnmlMfGBu
TLSH
T15FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cede42e00479776ba0c673315a77e2ee539a3d219d5c2ab27fb9a6677ab2cbaa
MD5 a922a0e432e7dbbdf6df63d64bf90536
SHA1 cc4e4a2361ac15125597f0f836cd0611a008428e
SHA512 5aa682e9ae3d0936bc58a140cfabe77d4519c22c2a911994a81e63f7e982b0747279065b2272f556f7ff2b0e0bf9e8724d4fb6487ec261fc37c94d9523ddf7b4
SSDEEP 24576:wAhGLJIFoiwtA5l7S53JZJfs8Yt2xysCqvk4Qm1G:wAMyFoiq5VfItfGBu
TLSH
T114359D80E7F955D4F5B3AAB899B69171EA76BCA65E31C20F2160D11F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1f95020d5fcfd6138f42495a14c5487dede60d387272ec34e2750ee3d6492281
MD5 3cea5d9ca617b6fec5e7b1916580f1aa
SHA1 6e65f4bd641c0d44dd81e42f99b7994c63806843
SHA512 07d7e571163dc0f310cec4fe4b12ce8db0ae031c6f18877bc1770afb499ef4845e7f03b30a1a93c80400ab7d71029bf3ab0cde97db21fc61647818329dc40993
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+Cl6JooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcwwD:ywuoOWC6Jfs8Yt2xysCqvk4Qm1G
TLSH
T1BF05F14572E80CF8E9A756388597C136F7B2BC423A61D71F1360C65B6F37251AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 01c3b92890bb31ef0ce826451eb6a266098da38efde1410124e635b9b14efc88
MD5 bf2818e2a39d73dea6789e590c851a2f
SHA1 20d0cb8e51725aae4e85cced9c2f41fec40cf7b2
SHA512 5ba7bdf6a3e6a868a3f7762faf1c081315fc24b79d9a753eb04cc59eebb707f9f813fe13dffb95791d2a89aeb43e197dda6fbf2c886659a83cef414915f8359d
SSDEEP 12288:QBZ1IyeZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:OZuPZJfs8Yt2xysCqvk4Qm1G
TLSH
T189E4125573E468F8E593227884E0450AD772B893B3B143CF133552AA1F72AC6DE7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b6a2e08f3a151bf76fc153ed096147213ad7e01b041c233e6f1c0a913a8b050d
MD5 c5601024953ad9533016fdffdb5b5ff2
SHA1 db072b9975f2caaa7014eba5739ee8faa49abebf
SHA512 32cccbfcb6b8313e9eb44d0497b2cf2c323e26df5cdf257a02421aed7df053389630b358a28dd01222ab7f980a08364732d1119487ccde2e4b191f981d2e1e79
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:EQRQyi36YOcPQLvw2gAf+PN3MMfGBu
TLSH
T1BB666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3069445804be3f3a6b45320427637f85adc8ded054c19f0dc7a69f067d8e0ae6
MD5 218d7458339b40cb25b8bafc37a4e9bf
SHA1 8299e90fe9d03cecf1e46663b6059ccb57700143
SHA512 13b668d60ceeb40407d1e991e2a39a9252a64aa1a754d068d9898b99418688c274e5754c2751a0a7e767f66dff5af1d8e84051facb887b7f549f0089aeab0318
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:pQRQyi36YOcPQLvw2gAf+PN3MMfGBu
TLSH
T180666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c667889cafc03a497f43657af1fd5a5f3b7cd4d3e48f448221317eb05d07ff78
MD5 ba5f2e5f8eae947430920798cf6cf10d
SHA1 b3c7d72ccfc9ae4faaec533a777b47d0eb025dd6
SHA512 94d847ac215d1931e4bd47c3d3fdc9cd1df24fd20800907d59147f0d5854f73b8602ed9fb0314c5d095b1fba20f0e98e9c65e9402e94a98ac81357a556dfe783
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fZJfs8Yt2xysCq:b68Qg55nhheWu7PNU3/SfItfGBu
TLSH
T1CDB54933B2F60099C44DE1769F4A872196D27C758FE0E3DB8115721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5ef6c5b96a761c4b92bd27e369782c18349181f326f55d8a0faa6a2497290506
MD5 cc9504756be1c27011c6818f2e88461a
SHA1 275fad395fd4b46f925a7ffa7e4b54fec63bc08f
SHA512 c1578b04a53a87b0252f9400f153dc7c366ee87fbd64c4240b413d0549ebbbd6e87c3c127d9e77ebf554655a27fdef2ad29e4be316283da94e266c3985d14378
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:hy5112gYy5azzVvL69nLKnhZrMfGBu
TLSH
T1CE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c1e46a75c431e1a72c391497a25dbf5a38a5fdc9565933d86a20c80b59df9c0a
MD5 7067b0a3e9c623ad7feb461d66f4a210
SHA1 ab31dec76ee3f0d280575043a54ca6d1faba6ac1
SHA512 213f40c5e1f49ce74c960a41521d0e2be4ebbe154be857a3a91267fccdc860a1e202cfc299edd5e8a207750b693c8075851aec755d58fdfd859cd8b5887f0a19
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJfItfGBu:pu6JmVxd2dJMfGBu
TLSH
T171D59D13F1DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4cebeab5d0d5d97827905c96280cd24ee28f3da1ee62ca38cfd23454f14c1114
MD5 fa35f221572b69797ddcc4837038bba1
SHA1 0e379d4fe1143a63dc1f9cd4173cf1a8a7163b55
SHA512 d30569d438fa24d5f949850068b6b8a7703a359b2e1540af47b27be4595ca73b00363abf633da51f808073aee69a93e729ced70ebfc71072a8efc4cda19620b9
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xAfItfGBu:0mifPbRlMfGBu
TLSH
T1B0B5AE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8068ab817c659620d745ae926cb62d840876b097bccc658bd2f4663af660b960
MD5 f4240429f18a0c7486c935bedcccacbe
SHA1 dac51e58872511891bbc5a9ff6717f257c375284
SHA512 11e43e33c19c57971f6021a681a56bc31ec6f43fda90197f9a06be9b946e16edd3743cff4646e2daeac6e7329b8a1a33a25f2ffe08894d533dbaf28735207fb2
SSDEEP 49152:rSuZQIY0Be2KRRVtOnks6NMHqffItfGBu:55dKTi61fMfGBu
TLSH
T1BCC5BF03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7914067d721bb19996f6f9fb075682e3bde8b277f30a6337b295ffd46de44a47
MD5 676f5d5e13ac1dc6e01af1efb4bbcaf0
SHA1 e2e89e23d145aadda0af300e084ed2389b4b87f2
SHA512 068320029d336fea5cf33f08a3c3524402eacca852a96c4f7bb334fef44b6f10a35aa5cd75055afdd08b8fcb088e080cfe3430737d019bad7fd1ed38cf77c4c5
SSDEEP 49152:chtSn8EApI0figngiDn0AP5wEfItfGBu:dX2iyphxMfGBu
TLSH
T18195BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 558807e4d376c5b8938bf2d0e9afecf2a0d4ad467adb6d77795b5620add8cb28
MD5 d2c940378c09fea2e2941d68c864ce1e
SHA1 228a6aa551084e1da42b2b538121c1f7f0ca7b9a
SHA512 3807b8f3ffcb86c619d7868b27d2919fb113a66d9d75266e4231590a1d8499d84eab13aef12373e56b83d1b95d7f9e34c9c99f0a4130b61398d9545e4b6326a9
SSDEEP 12288:EbZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:EbZJfs8Yt2xysCqvk4Qm1G
TLSH
T11FC42350F1EA8D88E9873BB001C4515F64319FDBF2E16207332B716A5EB458ADADF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 5d04619650e6b4885b6e3c969828eb0d87ce182f17623e1880740d05b790112c
MD5 6d16053cabc3295bd06e131fa62e4dfc
SHA1 f3a10c65ac9df8aff7c873e932160e71fe4853a8
SHA512 8c2d706ffdad7b2abdded564d08250b9fea5f0053d37651c2f2d58208a8501458529a3bd5b21a300a3a574f21c5cc29c66ded02f25172336389eb18b158b2867
SSDEEP 12288:ZKZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:ZKZJfs8Yt2xysCqvk4Qm1G
TLSH
T195C42350F1EA8D88E9873AB001C4515F54319FDBF2E16207332BB16A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fae6d216fed9f76bc11b98a3f480cd22faa525e535c459bd538554cdde04eba3
MD5 9a7aa732baa412904588becf04ab72b2
SHA1 6133f0a115a5122bb4b5d19e7b9297121cbe2443
SHA512 257c8f1ab7eeddf9200e4c6ffde2cb15b574d10dac9f8f851556b4ba181bfcd879404cf12edaeb918d5f9a2dc1561b8aabefa197e1989c07ce291b0e34b86c3f
SSDEEP 12288:QgZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:QgZJfs8Yt2xysCqvk4Qm1G
TLSH
T199C42350F1EA8D88E9873AB001C4515F64319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e0ebbdafe430e772e980ae046f236b7b845e2d205e8fb551b70933080db59333
MD5 1cfba000e6e9d1994237264dfc96779b
SHA1 7542c71a91f81e483eac753b1ab0af083dfbc89b
SHA512 382b7a37bd25a1a8aa99ca821977a34847bb82e6a4dbea3496484fe9e0fe0b65b0106ee825f4dea3a1267ac8306b47dcce3213fa48e36838144db0aace8ca499
SSDEEP 12288:nVpZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:rZJfs8Yt2xysCqvk4Qm1G
TLSH
T121D42311B3E94CC8E89767B081D0911BA471BED6F3B1635F2322355A0EB0789DEFB958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 e7c449bb4a6e83429a9dcf8515379372e4e885b8f77de2f9f786a706e5633b14
MD5 3e8b3a8734c9f02d55d38a9f09f3b9a0
SHA1 5820e5906f27d16069c102af546c25d6ca054e33
SHA512 010df92f580f331a11cbb8d58fd9278cd0be07bc4872feb4b522a3f37aa1f27c99481021eec35a7a5604adb31751491aaa40a0ed17a5fe315a6fc501ecead6c2
SSDEEP 12288:2RZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:2RZJfs8Yt2xysCqvk4Qm1G
TLSH
T1D5C42350F1EA8D88E9873AB001C4515F64319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 28ae5f22ce3af55248368f36af45a1529cd6def2b24ba3cfb06420ff9f05f988
MD5 dd553ed506b35bdfc4bab5a6479c6bde
SHA1 4aa69506dca9d79f2d5f686712174944179e45c8
SHA512 75585f83a6d424cddbd5a5f5e7b9c7ca77b6e139955b61412a3e44ad0ef1bde1febd35039d83dfa3d7031f412b78a2fc65c19cb5a673624504b39b2ff45469fc
SSDEEP 12288:1GZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:1GZJfs8Yt2xysCqvk4Qm1G
TLSH
T1FEC42350F1EA8D88E9873AB001C4515F64319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f68ddc2392f91e83905a68232ebc0d95c378416043e2938f0f83fde4fdc732ec
MD5 e6dd94f486f825e1cbf7487e7c5ea997
SHA1 02f93a5b2dd84d5b2bf97627e4a0e0c9542b5b33
SHA512 cfc57b014dba2fd45f807627fceecb289f224019710642ae17dcb639d4c2f233eb0c207b2e80943797c002f50cb387c316d8d8d6ba80ed16cd3d3defd09b9d1b
SSDEEP 12288:6SZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:6SZJfs8Yt2xysCqvk4Qm1G
TLSH
T1E8C42350F1EA8D88E98726B001C4516F54319FDBF2F16207332BB16A5FB458ADADF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0542641a18657c7d9519b48e8b8ba47c311daaefc2159dba7b708bf7c1f41fd1
MD5 c48e8f58a56c0751ffbfd3d53c2a6ca5
SHA1 c006960e9f1ca9a8ab83c1aec1e5906c958c9f24
SHA512 fcabf165357351d2183eb27ae7d9babac438ad1728920857a43096c6708405b9c9a13dcc722fba673d1a022d8141d5aa4feabc53ff3c417e0ff211aae8103bc5
SSDEEP 12288:7iZwb6zzFEoS2cPvyqZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcW:mZMSzFVSOqZJfs8Yt2xysCqvk4Qm1G
TLSH
T1A4050194B3A00CF8ECA7423E88558906D5B2BC5A57B0C60F13B8366B5F333915D7EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 64e07812c8c5502b320b8940f016329f3a9dd326ab0524408f816ccfe637cc64
MD5 0a5828b85fc1412a24c7f393f0bb5546
SHA1 c6bf1d8bac9cb95f01592b030926d1ec513e1c9b
SHA512 9e1cfeb4bd07e10ce7c0062878e116abd9dac0ea2239beca29ebeccfba8b7bff291a527a3a3b9e7e6749b72941a54914fda57a9c7c8aab0e2a49355d764ef413
SSDEEP 12288:o/ZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:o/ZJfs8Yt2xysCqvk4Qm1G
TLSH
T11DC42350F1EA8D88E9872AB001C4515F58319FDBF2E16207332B716A5FB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8fca17736a3093a70edd885c10deb2f2cbb6c0eefe9926408b29f012e238c583
MD5 56d13c923d34d04e28c1ceab43bd5a39
SHA1 72d0b5263a1c3c8584b97f195be93db4c18a1632
SHA512 f444a0d2485ed1d6d0aa59f6a17264dc5c1df4ca18af44387bed8235b345503a8ce9db2db155a90304c912e10327cb2dcecf2699ffd90aea6bd2b1c529ef95c1
SSDEEP 12288:4zZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:4zZJfs8Yt2xysCqvk4Qm1G
TLSH
T184C42350F1EA8D88E98726B001C4515F58319FDBF2E16207332BB16A5FB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b5ea7e8918c436b3b49a29d13eba6620cc14e2a0a3e2a18c05376bb2e392ebf8
MD5 71ccbba75eda398c8a50d712aac3159b
SHA1 459e76982bf8f44493a2558151720b40d7f69f47
SHA512 8a23007784515e8440407f147e041c83350924665edcad0696c338be13791b3514f1e9638d1a5abf286be603da5c205104d54d93089e337b3cd837bd8c681038
SSDEEP 12288:wyPz5L8eZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo9:BzyeZJfs8Yt2xysCqvk4Qm1G
TLSH
T1C8F40207B3A524F8D167523488911A06F772B876A7708B6F1364137A2F336D19EBFB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8fd8b634728ae4ac4439e3c098d3987358f5e4177f19d0205a7412f39b2e3993
MD5 13b71105ec089c12ef19dce876eb7d93
SHA1 13d8fc83e7043c81c76da1ea96a8fd38b15a601c
SHA512 ae345359d0f62242dda37f07e6ad9f4e580964b6bc342132595ffbec4d8c0865da9fc90e6e1016fa02adb454679adcb40db1a540cfb3f9f775847b958e096067
SSDEEP 12288:O/ZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:O/ZJfs8Yt2xysCqvk4Qm1G
TLSH
T1B1C42351F1EA8C88E9872AB001C4515F58319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 088af8f0cf4c44800cf4d1535665b6c89fb222ed35177234b8fabedfe8f7de9b
MD5 7837d4d250d886831c6b2fd80be19e55
SHA1 125bd7f83a5d9c826946c2bb2528c06373f57586
SHA512 a114c0eaaea18cdfdd7f083b556307867a8ef7bf0bf3dda88f543ad32a51e78ee944fd1d30e03693f28809836f69b44a2fa74f634268679bc3d076f247cbfd9f
SSDEEP 12288:V/ZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:V/ZJfs8Yt2xysCqvk4Qm1G
TLSH
T1ABC42350F1EA8D88E9872AB001C4515F58319FDBF2E16207332B716A5FB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2503a23c2d9f9dade1bc3e9184fa2651c8210c23136ae1cd97aa3dde8aad128c
MD5 b1b33c6cabf4d359d9662ada58b62385
SHA1 92a01e3469f9b72d1cde2f485957cdf2194471c3
SHA512 74239fd380f535db2faf0960bf517e1b275aa8348ebeeee5aa0f16e7074ec9011a38036007f9ea7402eff99b574d4724d374c6c13ce3330bbec166e586becddc
SSDEEP 12288:TyPz5L8eZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo9:ezyeZJfs8Yt2xysCqvk4Qm1G
TLSH
T107F40207B3A524F8D167523488911A06F772B876A7708B6F1364137A2F336D19EBFB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 fbbbb16fac64d5547e862e352c85d4bdead27e2ef2354863685d87e5e2ae488e
MD5 3264ea3245e86ab4d0b8ef1d8600ec15
SHA1 7b38848d2ebde73a9c77ddaf03322da21f67e98b
SHA512 7552c3b4ffb15ac14e7a50d8a81ec2c456ccef480d0c154e0fc5cb05f099d93f047c58e60fc9aa102f21781e4c28e028b41ae87e86a6a0bf9bf4a8ee902e761d
SSDEEP 24576:zTHaLl3z0zDwZJfs8Yt2xysCqvk4Qm1G:zT6LljJfItfGBu
TLSH
T183050194B3A00CF8ECA7423EC8558906D1B2BC5A57B0C61F13B8366B5F333915D6EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c4c20df84cae14d2a35784864277cf075f47d6c4c61d086918aae24cf1fb0693
MD5 94977f04e51e951d7a3dd230d0c92ffc
SHA1 6cbd6762806393e4b09098644a8815ceabbc98cb
SHA512 a71a1ee8c81e441c3c7b00699e2251df0fc2fb02424bde9669aaa4e349603aba281e11229e918a669d6f09c1723bbb0012137e1647c49d13e876c061b4806d51
SSDEEP 24576:P37d9CHKy7GZ8ZJfs8Yt2xysCqvk4Qm1G:f7d9CHKyaafItfGBu
TLSH
T13925D090F3E414E8F0B79A3589764512DA767C9A5B70DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 15ae06f9c7fe2135fde076e95a1590cb1edec7f00afef7b4e48efd97d44778d2
MD5 227e4e43e31d446b2d0429d091cae460
SHA1 012a71c11166ddbd39be84a23f67a752f715b4f4
SHA512 b927cf918888aad9d24b0ba8cf6b141b82ab7dcc882cbdcc3d0ae984d313d19f66a79e098a4a93d65ac7850050c6fd51e65ba95b7adf85651b87896138285a3d
SSDEEP 12288:iAZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:iAZJfs8Yt2xysCqvk4Qm1G
TLSH
T152C42350F1EA8D88E9873AB001C4515F64319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 a54cc2089f39e6cb7028ad7f08c936455f1b89fa8206f01ac6ade5cd1d12651f
MD5 eee9e4dc0544d4d2b34e052cd3328262
SHA1 86c120ea554d39cfe9aa0381223226b21b92303d
SHA512 149b9b978c19dca2e54f5c6ec1a14a113ac08b385d51a3bdc2ee737b47c52f2dda8f3dcaa2f83a7be24fe0f3f1b6800820f81bcd7dfa758e9dd25cf084f38b46
SSDEEP 12288:T+ZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:T+ZJfs8Yt2xysCqvk4Qm1G
TLSH
T1CCC42350F1E98C9CE98726B001C4511B6831AFDBF2F16207332B716A5FB458ADADF89D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 0ee7bc5dc259f7903fa95e2d4e583fa04aac43c8a6311d8a9a5783e9dd789967
MD5 a6efc83ceab3c8674d7132b811e571cc
SHA1 5aa6df8835de6ff366499ce7bbdba86f5538cd59
SHA512 764ddac59479df0fb09622acb8af28c012d5ca6bf8d29d4581c61e802bd2ec8a62f2b1930b201e63dc41e62a3e61bfe3df0158983da9e2f8a09bd5353a362afc
SSDEEP 12288:btZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:btZJfs8Yt2xysCqvk4Qm1G
TLSH
T1B2C42350F1EA8D88E9873AB001C4515F58319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ba3f694994f19e7acb3b9e03d248bff0405db5d6f8b4eb41074bdcb6581bdf52
MD5 4e94c8ad983531d168c4dd3bc9d2a0d7
SHA1 3ab3db328358984674d0f3cd31b5f02d29fca5c2
SHA512 b25bf9237d72224568d127355d77f7e46b7907274f537099165698d3c74d0cfb3562504ec8d3d80a65253ca49ddeeac8cf1c1e4deaa7299620bbdb19c60a12b4
SSDEEP 12288:b/ZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:b/ZJfs8Yt2xysCqvk4Qm1G
TLSH
T19CC42350F1EA8D8CE9872AB001C4515F58319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 4274138cbfcc616db806ea1716618c02ca63a82de83bcf4df87693effb43c605
MD5 d98754621500ccabe8f136594a8fe579
SHA1 e9efbb78ed62470c625ec2f82316d9039aa33bdf
SHA512 8e18a7b957ebcd7ec06ea797bbe67563e14f07f8ecff7bfbf1f2d0e98c445c643599225d3719af7e53bd9cc3497331a2f4dbbd27e8e66ab7faad61bff183d6d3
SSDEEP 12288:5AZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:5AZJfs8Yt2xysCqvk4Qm1G
TLSH
T1CBC42350F1EA8D88E9873AB001C4515F64319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 95afdf8ada83187ae54c6d8017f35dccbc7d3b5f75a6e433c830b426fd1ba16a
MD5 5866e575d765e018a033e83db43dfe90
SHA1 bbdbef87d3cf29d963b7199a13c68d9e8de2bce5
SHA512 a9ef11f57dc2ad8830e6960b2ceb847b3b36c518ce5faf51429da7ae451ffab540f9ac575bab61dd9cb57b491c9102cbb8c06b1395be278b3dd5d09fa47bbfaa
SSDEEP 12288:znZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:znZJfs8Yt2xysCqvk4Qm1G
TLSH
T1C0C42350F5EA8D8CE9872BB001C4512B58319FDBF2E16207332B716A5FB458ADADF85C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 77448d5b6607c2b288fc9436aa696a4fe34b9ea9efa8029958067f1003645108
MD5 375b7ae1049f2831fa32838fe876dd0f
SHA1 bdaa76ec59e58e73f935b7a9114af6577a4089c8
SHA512 98c3c3d1c05fa9f128bd2538fce031c4624818c08dadc7d62f10f8507bc220a19daab53f471e4198ebde954e4c2071ab8d6c4635e1a82076720320751ac7de6c
SSDEEP 12288:FRZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:FRZJfs8Yt2xysCqvk4Qm1G
TLSH
T1D3C42350F1EA8D88E9873AB001C4515F64319FDBF2E16207332B716A5EB458ADBDF89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6e48f007d2a47e737444c74a23e5955b4c5b7ed3bb2b7e7b5676876e3bcaca6b
MD5 2500fc4ea63ac72c7932d160ac3d6dd0
SHA1 b6380fb28d733ac0d68cbf87da8f33f17d347fca
SHA512 9d295b180784dd2192b3252161becd0aefbf3654040e560c6352a2738db1b8a9bdf384f4f35d63e45ee194f3ddbb76d4768a1c2cfc93e70a7acb2b31c8e7445b
SSDEEP 24576:3fwvok9RX6wkyAIj6Jfs8Yt2xysCqvk4Qm1G:xMnYIafItfGBu
TLSH
T1DC35D029EBDC48E5E1B7923C89B3460AF6B178595B31C2CF125A536D0E33ED49E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7b21848f6701877e5f05a7ff717e42d36d9e30bfc2cf46724291583f7257dc17
MD5 0738c0a153312c9b3f69bd0e9748e6c1
SHA1 d2f54d88533df83fa9a91b6bc0afa88d10a742bd
SHA512 b954e5580f5f67051227d2716b1c01c98bf4fea64a9489e50a8bf8c25627e064f04b82a0bce457804f432e4c84d8e9ff9f5c5632850f2cb8a79921fafdf92df5
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05fItfGBu:/ySzPBMfGBu
TLSH
T1E8067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 76b560fd04f024a74acf33585b9bb2e0b8f1d8f1f1925eb7b343bcf7470dca90
MD5 54ba59c0fa0f684b3aad709a013ab75e
SHA1 2f5ab3336fe278fb885fbdcac1a256420d4b14b2
SHA512 21fc183fb61e1c0cf4b7454b267c6b2449f22a40cb7fd1dd3a3ea6e6cfde1be69b7481edc835d26e3aef64bc2c417fbecff9eeb506427017235f7445b160ef04
SSDEEP 24576:S47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYa6Jfs8Yt2xysCqvk4Qm1G:S47JUQj1irIhCnDHUPfF/JfItfGBu
TLSH
T10665AE1DA3EC01E5E1BA927885554A1AEA71782E5F31CACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3d26d7376787e3829b15b1fab90fa83848eb7b0f8a7d720486314e3eed3d884a
MD5 7796c176fe2f1339ed88215e5b5dc840
SHA1 198290dd4370ef8a79d9fdd7948b5bd458e457e7
SHA512 9ff01094710ccd49fd9ca57696d46549e7c9148c6f401bd78cb52d673fc44082591834b8a874e0e71477f9d9dee554872bb007929fff48740ba760196c229c00
SSDEEP 12288:YNsfPZJooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:5PZJfs8Yt2xysCqvk4Qm1G
TLSH
T1E6E40119E29846D8C0AE2274C7854606B3337D66A3F1D3CB23D1F57E1F756849EEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 421cf3f881276eea7263c49fc9f30d5380887ad79f12cd45694d7227823ee95b
MD5 2273ac85a7b9edffeedaf97a7f696877
SHA1 6276b51d967712cdaf39417be416d799d805d2e6
SHA512 3921fa6e376ebe8a982e753ac3e3bedee9fd3e15f354525dfd53ae940cacb0b29a1d5c0844318962663a44c948c318a5082581bcce81317e68448fb24f4db64f
SSDEEP 24576:iLbfEUPyEqR6gMMnH2sq+MSkYl6IZpJH4TiiMzs:sEU6EqR6gMMH2s/MStoIZzH4+iMzs
TLSH
T1A75527407626CB4FC6A940325E36D6CCA7707D05FE496F0373CA873F9476659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 30d97e0475b7ea37680866d5d0acf83fbc4a4805517b9bac0c91d9ec089a4a29
MD5 98d7e9ab9d120f0a5a96210577295704
SHA1 59323e43b1fd56d6df1cc92fd5f725af93c25130
SHA512 c65ef3eb61059d5a17700e0071f57bbea16bfbe0a41385b468175d601e3a1fd44c0666378b4b4311e3e3a547fcd1268f13cee4bc5c92f640e59a06ff73d216c4
SSDEEP 3:OlH/lKWDKpqlXnNxPBlLl3y9Gxtg3mCllltGlslslslslslsl67rDbLll:KYWDyeXnvRQK0mCtEEEEEEE
TLSH
T1808112031BA50A33CABBE032422ADB640B23D092F5DBA7E7260229413C413F50C1AB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.0MB
SHA256 633f9858868ddcc10477de0875c409dcc4ad0e1df23a62d5647e8bf878b7468e
MD5 4029c1fe38a3f60930f81042e1f4a1a3
SHA1 4437070f926f6139c17d109a543166af51a28603
SHA512 fdd541fd008d996691ac81d4123dbec4e87e970b0f1594d6eb9225bfb332727e85332407c82aeed0572b13f7d23677577a81c0a394f6f6a66d014c82a2cf0b70
SSDEEP 24576:nnhqR6gm9RsMihSwqR6g2plmriqR6giqR6g4qR6grMSqMS5B+ppLJz:hqR6gmsMih5qR6g2plmriqR6giqR6g4u
TLSH
T1BE35F70095B7EB4FC96E9037133286CDBBA45C06B7893F057345C93C98679AEB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2a09c39529a4e8bb8a4e34e46185a5022f6c1994f7e27dd5d5ed49818b4a34b0
MD5 b5413d3f7abe6010d1a673f36c973a9b
SHA1 0366cc903e3bc55b6abd47d2f34b4a8729eab7f1
SHA512 72773d69d9e33869d2b30178e8c0de4c1bfd26c31d5bc09b3d7790e54067ac9dc0ad72589d10be4bf56fa458ebe665cd5ba1339d0f543dd1639d88f11053d209
SSDEEP 12288:0z736JooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1FwzBDwo97:y36Jfs8Yt2xysCqvk4Qm1G
TLSH
T1A8D42311E3AD8C48E8A737B001D8902B2425BFE5F7E092877316729A5E745C5DEFB84D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fdc871560f33ba9e799b964421e304d194808e07aae1fea5f8f952e3b8bdb9c2
MD5 9717d1acb2257d74d102c5195d622bdd
SHA1 6acff0f718f9eaaf0cbae10727b94ae2cd780e57
SHA512 201d101b006b68af176d226d9f0ce0d5fc4eaed01f287063d3c0c360a67f3e4df2e124e05b50bb4f4c4ab0f1bba6f2a8ba758eec05f6122674353fe7e7434830
SSDEEP 24576:6G88u8FpJqH1bzria7/mq6Jfs8Yt2xysCqvk4Qm1G:B7ZFPqVea7/4fItfGBu
TLSH
T12335F165B6E101F0D47BE13889824663F6B2B8251360EBDF07A88B551F33AD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 c96b16d687c115c8588b8c433817426d17025a279cc7ce9eb380b70d7c2b43b3
MD5 1464a3ed8cddd50b07ab41920e867412
SHA1 c031a5afd4598dd66db5c2a87abd1abaf538ef8d
SHA512 fb3d9c2b9f126f9bf0a9c848383300cf5c3648e8121c4724790142951a3c191c8509605be1b8225bda4996baa02f0a7e14f76080a35d409a96c5185e6a62aee7
SSDEEP 12288:7HvUrBFrEjwaQ26JooCDPCy33dFKYfWpo5IuO+qysCdHUjcQTrJcww4OsmcPl1Fk:7PUr+NQ26Jfs8Yt2xysCqvk4Qm1G
TLSH
T13D05E12F62EC1CE4E676A17C8582861DF671B862535192CF02A1817E4F77ED8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 636e93b8710edb4ecb70db13aceac5d97389970f17479a8973519aa82254f0ea
MD5 37b1aacc84bac856a2ebeb0436cc89d9
SHA1 01eb9dd6540b64a9df8b4c182258ccaf22b679b2
SHA512 3d49428d11423c27c0a4c84ad44e4fd71b9b2176bf2b82b7652dc227dce307e2287c0c2c546032f063e3ae5991bdacceac2e9b9a1bec856efaf7cdafe95612c6
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/fItfGBu:KG05lO43bSMfGBu
TLSH
T1D0D5C06A62EC11F8D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 154a2c5b5b55a79b5fa25fc674cea60de267a116fc851287947680bee25dd44b
MD5 7b174e1a3555f64a8a579e6ca77cdf51
SHA1 b1aca32bc063a72a6fe962646a1bbd8e73bb400d
SHA512 ac508f433206cff75fc0a98134a39776d7e59b18343e8c7b300554f95990dd48e82ec5b04cd76ad444a97f7e1f7551c44df651df5f1f27383b36ff7a7e827681
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnk6Jfs8Yt2xysCqvk4Qm1G:qa5POZ3+Jt2pasx2+mHfItfGBu
TLSH
T14165AF5EA6FC01D5D5B9D17CC583861AE5B1342253319BCB122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 31aad7f45d4f1bc13e67704f0f4a2f9714bdcca67180edd435a2a3303b89f0a8
MD5 2cd0f4f99785a9b32d70bddc13def7a5
SHA1 140a6eabbfde88965b4412414a332bf1932040ce
SHA512 45ad24df0b9fb5f00b40cb749d6fdf05b1da144abafb08ba53730b6bdf8ac202d0177957a56637c54c5cda2cc35603bc71c199af2331a90ddca66b39e0363133
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fki6Jfs8Yt2xysCqvk4Qm1G:6Nc/zEOVHFYfItfGBu
TLSH
T141857B2623E901E4F5BBE1BE89679546FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 7e793404e0759d6de29ce9ca55b7cec8e2dc7fb99b1d049e397823e0e33301f1
MD5 ff04246388c0ffd4ce59f9395857baf9
SHA1 6d3c5571e2089c7837c528c67d31bbc49b8a40b9
SHA512 a077641eee66d21fbc105e37492b0524ae275113a094f20f382b7d8a870d3ca0fccb0017a15f3854853bea9a57970595e8a783779446c38a4a629d0dd4077151
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYF6Jfs8Yt2xysCqvk4Qm1G:rgb4mBIBhGFzfItfGBu
TLSH
T11865AF1E22EC02F5E0FAE2B88DA64417D6B278161731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e39bcd5245d4b55a475d4271cfb68b8c08d956d107222116bf8e9b1a433e231
MD5 5c6bebe3617b4fb67f83792a026687cb
SHA1 f063f5d6b297ee87149f45e33317ccb7830647b1
SHA512 132e180ffa2c56be5feeea2cc1b80f8b67dfeb92a719a9d3389f46d9ae7b5cdc6aafe443c94fa904d09ea58df0505f969a85d4182857b7726562d7f3fa63f96b
SSDEEP 24576:t8kNvNnaFeYhJNtmZBm46Jfs8Yt2xysCqvk4Qm1G:t8MwBtOmtfItfGBu
TLSH
T1D455AF2EB6F846E4D1FAC6B48D238512E6727461173293CB5390C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2aeba0feae889a9e8be9e1ec5f4eb08812ca182dc66b643738347d19dcf2ac5d
MD5 05ae8bcba643cdd48fc4a65b7f92cb5d
SHA1 b0c89e24db764af49a3d8ba5ab77b0c0c2084057
SHA512 e9280099b1413c5d5f740ae1b4b0e08d3c287b3941b92019801c021287975d785b939eec1f53d60f8ede5d73cf4c40dd282ef92d2452b91aa1f70b798e23a44c
SSDEEP 24576:sD3FHshBIYQgA76Jfs8Yt2xysCqvk4Qm1G:sDVHeBIAAifItfGBu
TLSH
T10125E13DE69C04E4E57BD1BC86938607E67138A9033166CB129491BA1F7BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/260-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/260-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/260-361-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/260-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/260-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/704-115-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/704-109-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/704-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/704-344-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/704-345-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/704-347-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/996-15-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/996-174-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/996-17-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/996-197-0x0000000140000000-0x00000001404F2000-memory.dmp

Download

memory/996-6-0x0000000140000000-0x00000001404F2000-memory.dmp

Download

memory/996-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/996-72-0x0000000140000000-0x00000001404F2000-memory.dmp

Download

memory/996-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/996-172-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/996-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1560-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1560-143-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1560-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1560-145-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1560-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2680-57-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/2680-47-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/2680-46-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2680-53-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/2680-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2784-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2784-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2784-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2784-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3696-81-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3696-73-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3696-338-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4168-61-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4168-68-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4168-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4168-318-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5112-31-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5112-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5112-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5112-30-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5156-342-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5156-85-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5156-86-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/5156-91-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/5668-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5668-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5668-349-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5668-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5688-122-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5688-128-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5688-348-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5688-120-0x0000000140000000-0x000000014013E000-memory.dmp

Download