afff116a09946546e2cebeceb2cca42d1077885bad91beec47971d0497e3099b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 2.9MB
Sample261017-maxf2adx9y
SHA256 afff116a09946546e2cebeceb2cca42d1077885bad91beec47971d0497e3099b
MD5 a447a87a831c96bf1581f12eacf0e079
SHA1 5f074eb3551c0a15671c239dc6f7b90a67e88211
SHA512 8739018793716062b3b9f55b9119af00078bd2b9d908b386385df540b1dfbdba372014cd1a51e7b32848e8bde4f888c78a80db4de5b35aebadffe5be5775ddb2
SSDEEP 49152:FORHXf3ChsmixbjpYIDLIqWr5arSj8RoTCC2CaEucW/Rrmp:QP33Bbjp7iJTRnudRSp
TLSH
T10AE5CF07AE9BC1E8D16BA23FC9464D46E6BEF505031396CB07A44AB53F276E20D3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3388	elevation_service.exe
2676	elevation_service.exe
4588	maintenanceservice.exe
1680	OSE.EXE
400	PerceptionSimulationService.exe
1812	perfhost.exe
2952	ReFsDedupSvc.exe
3392	SensorDataService.exe
4080	maintenanceservice.exe
4500	ssh-agent.exe
5736	AgentService.exe
3060	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e1a0bd94227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4340-6-0x0000000140000000-0x00000001402F0000-memory.dmp	upx
behavioral2/memory/4340-66-0x0000000140000000-0x00000001402F0000-memory.dmp	upx
behavioral2/files/0x0001000000009952-137.dat	upx
behavioral2/memory/4340-138-0x0000000140000000-0x00000001402F0000-memory.dmp	upx
behavioral2/files/0x000100000001b991-139.dat	upx
behavioral2/memory/4080-237-0x0000000140000000-0x00000001402CC000-memory.dmp	upx
behavioral2/files/0x0001000000009cd6-170.dat	upx
behavioral2/memory/4080-142-0x0000000140000000-0x00000001402CC000-memory.dmp	upx
behavioral2/files/0x00010000000093c2-128.dat	upx
behavioral2/files/0x000100000000932b-127.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005675999a205edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f6f3adc205edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095df039c205edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad87899a205edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003572329a205edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b41ce9c205edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4340	2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3388	elevation_service.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5736	AgentService.exe
Token: 33	3060	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3060	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3060	SearchIndexer.exe
Token: SeDebugPrivilege	3388	elevation_service.exe
Token: SeDebugPrivilege	2676	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 5816	3060	SearchIndexer.exe	101
PID 3060 wrote to memory of 5348	3060	SearchIndexer.exe	102
PID 3060 wrote to memory of 2084	3060	SearchIndexer.exe	103
PID 3060 wrote to memory of 2552	3060	SearchIndexer.exe	104
PID 3060 wrote to memory of 4756	3060	SearchIndexer.exe	106
PID 3060 wrote to memory of 4344	3060	SearchIndexer.exe	107
PID 3060 wrote to memory of 4460	3060	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_a447a87a831c96bf1581f12eacf0e079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3392

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 34b5c18e71c0f3fc1904f56cc530ab590f23ba57512127e75cc55e72ad0670a0
MD5 34bd222d2b64814307010082274f228d
SHA1 1800b8367459a949212e3bfd8325e045fc2e0ca0
SHA512 f27bebb024eea3eb471c4ea4375694ec415c378b7da2d3417687b832aa1c6e541457f866b639e45073aab1d1545b90b57f4cac60c3a3298565d6f91bf7f8fab1
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8CaEucW/Rrmp:F3q6HjBUnudRSp
TLSH
T162D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 053f9e24b58a884c45fea83e8f6c0a0b4859f4d401997a641fc0216d2387d9da
MD5 6a2ecea25d323f9608581eaac864d10e
SHA1 bd730945a8f495c2968101bf840d175a6f0de7b8
SHA512 23fb2de6e251c5e63498173fa61776f882bd63eeac5dd9929a29839f5213e226bc51952915041ad8072b5d0cfb1840bcb5a9be3d7bd15dcef6ccefa2c81c6004
TLSH
T1CA51B5BA0139793604C6EFD6BEDCFC16675E206D44FD10B8B116EEBC1CBA585D2A2260
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.8MB
SHA256 dc9c7a5408d856ce6a8adea10b5b75a67feacbb6027e895e2fd8a0920106a076
MD5 70c13bcc7ed6d5e878e23abb7895f0c6
SHA1 d53dd748ee0ec0d5e1b34e399dabcc4a75b443de
SHA512 be051e4c917979ff916fdcb059de22d9a3b9be71cb167b01887efe18975365a541172f52a70c6387688972640a4066362b709003c2556c7b0cb6e7da9512b36e
SSDEEP 49152:wwcSCaEucW/RrmpBarSj8RoTCCKCaEucW/Rrmp:w9nudRSpBJT1nudRSp
TLSH
T19DD5223AABC50AF8ED5B93398CB28004EA733C9543A5D78F43E8A5694E777D05D3E610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.8MB
SHA256 429beba610a3fdd84f003beb86622b387e79211cf9475aa88c3d7b4c909c7d54
MD5 a39040b339829ff3ee56d2a69ef4246e
SHA1 8c9febd85663ccedb952ca1118d227043fbb1a47
SHA512 2b21046e058313e2e1b2400c3569a4aa1eac26b9474cf47cb5beddb45c47baf26bc29bb2b3e5ae3d4367dd455bb5d0ca6a5f8ae1c7ae1604b7825b0bd44c5581
SSDEEP 49152:RwcSCaEucW/RrmpBarSj8RoTCCKCaEucW/Rrmp:R9nudRSpBJT1nudRSp
TLSH
T18AD5223AABC50AF8ED5B93398CB28004EA733C9547A5D78F43E8A5694E773D05D3E610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0e18a4303c1d0191f55329ef25322fd637850bc7b0dabb944d10517d71e5bd16
MD5 70c0288af2d84d2ff51e04a62eeb52ea
SHA1 e5ee7bc2ee057cc5aace8220cf731f3f740c4440
SHA512 3a6a6c40928956ae2477948f1a5d18c6fb67eb439d59275b8020df6c3817848bd474e479e51407b84268f88d7ee284f1d02860232b95a995298bba9929afafbf
SSDEEP 12288:F1XLsswWkxy2lRq2czAQyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:LXYfDtczABCaEzwAyujOhcid/RrmpF
TLSH
T1B375F129B7D409F9ED678239CCA28111EB733C9547A4E7CB03A8A5690E333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cff0e6ae31cf690b617c9a6713fa0f7d859d88c84cebd878382310de9c8c80b9
MD5 2ea5de90e7cd022a43a1311bf269251c
SHA1 3d9cb91990d2efaaf781aaa2908f78a54685c1d2
SHA512 cf7ee535bebb0ec14880114d37ec04e03bf66a475683177b3f905055bd0d24665ebdc782408e56fb2ede9ab7fe08e34a050e4603c9959d8494d52654514725b7
SSDEEP 24576:40Le5ji0hmxirMdCaEzwAyujOhcid/RrmpF:4Pji0Ac+CaEucW/Rrmp
TLSH
T11E859E26F6748331D073C0B9C5D2A69EED71308657308ACB4286D77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 129a6255f69881f9195b18d5d3a902c56a07c4e21ce2a29be1cb2d0066f104f1
MD5 d552a8a231d0db6cfe5e2f5bcacf9254
SHA1 32c7575e21ce318ce9d462016b6d43d7b5e12fc5
SHA512 f97cdc62cd3493edfaeb1adcdc76b06079cb616724d0e7e6cf01cb31de0f4c0f89e331d8e85704defb3263eb3e92c93eca28d1118bf9b2a40708669224427728
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyurCaEzwAyujOhcid/RrmpF:V/ezSC6vUzPvxHjyiCaEucW/Rrmp
TLSH
T1DE755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 77cda9ccfe73b2c99f46565245d2a7da2cf7e9eea56a9e0e7b1ae22fdfdbc66a
MD5 198885e178741fad1c1b71d7d0ba2bdd
SHA1 af3e0f6fae0e55fc1f7a869f2121befba3072582
SHA512 0f31b7553fd4c9b5e2d63e3bb66a1407dc6837f09caf8168c99dd977392bf0186806aeca0a6522fb957640fd890e6601d78f5afc3b104f9b078551c4e42685d3
SSDEEP 24576:nVbqPb88hv/l+6ACaEzwAyujOhcid/RrmpF:nVO88hXl+xCaEucW/Rrmp
TLSH
T1F0559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6cc84e9916f3aee2ccf6d7842cb45641acca330063172a1c43f39f14e4102a3c
MD5 5f2d27d9c9ecb6cbaa5531fd189c8ad8
SHA1 e1377efc6832716099d8a2a695dc42834d1c40ee
SHA512 1449f12eb31c09bc060b974123cf8e8a66eb5728f18f50a406ff49a6f9cc42018806765a3c34ff5a2d37aa84f9b260916f4c4e13381c79732ed8193199776532
SSDEEP 12288:1RYyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:1RpCaEzwAyujOhcid/RrmpF
TLSH
T1BC552327CF8957B1FB8A27331CF61024EB553C961599CE8EB66DF2AD847C6C0D88E121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 398f497726464a6d41247372c4283b4b1235491e754004de9412686dad59bddb
MD5 22126d364ca47e094f24f1b7a749da9b
SHA1 907303cfd28b60bcf276286246d86a46c8f5e2cd
SHA512 b9c9f29bb8219d603c6675541b748f124e8e27780fc7972955bc49c7e027432c2dadc9e7407627a32ef320b65adbc09532a06ded1b224bfd10d680e0b14036ca
SSDEEP 12288:IeBNUbTVO86UJyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:IJIUoCaEzwAyujOhcid/RrmpF
TLSH
T1C075CF3BEE28FCE2C27E5D795A918200E77278714B6293CBE165C20EDE235D05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dde2871a699daac1e8bedf8f2f24b1f2820195dc2eef232f1ba75826a91370e3
MD5 2189abc2d60bcb2a10348ecea7704da0
SHA1 4b62f90be7dca2f117971a28d153f3aad61f9fb4
SHA512 7b280aa305081529adfaa077176d4bd2defd08566f3196d275649697861ead720dcbb7b80afc80763a58b8d4a1af7a739e41f4ab0526c798b24e9a25cbca716f
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:tQvGAdlCEL8c/yRNw5CGnudRSp
TLSH
T133267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f96a162c4ebdc522e616dd939458abfe64da03796a6d450d09bce1f9af1ae2d2
MD5 544ad6eaadac3587c80ce1b491c9be29
SHA1 de9bc31f6226ef435d72fae280fe5db344da8a2d
SHA512 ffbf07841f780bf87a316672daa39bb9df7de826e4a6d2a1cf28eff19e522657ee9bd15579e6c7f3d1d5a65f606f6d110f83b3882706f31fccc884c167872690
SSDEEP 12288:rAwSfxL/2Dc34DLLmt0LDQewsAjTyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm5N:UdewsAjuCaEzwAyujOhcid/RrmpF
TLSH
T1A875E031FE74E032C7BF0EB21B36C716546D79204B611AC3F3A89A9D49742D2277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0fda17bce881916a8f7a9d4614cfe5cc9a80b029d935f164f736b73dc69594c3
MD5 d82bb3bcd959471bb6df845a4cb57750
SHA1 00c42b41d275c9c4ffc2558386d0796057487193
SHA512 f64a26021024c911a7858160a4408fcd2a205f5833bab94a13accaa867e7415ebed2014b749b4494d6a05c3f5e670d2bb70641940d1e0d213e1d24295ac9f75f
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1nFp:YUEtQevvqc2W1cpV2EI321n
TLSH
T1F4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a702a0afcfe7208a99d263b4f228c5e3d98a87bc64fca85e4cac34271b0d67c9
MD5 1c3612cb82598e2444ae22fcc1eb4fec
SHA1 e433018934fbfe7ca1758a13920a497d0c31b3ee
SHA512 aa7db85d5333f1d0c8153f786e491cf6258b436fb45d06c6f84c1ffe95809739bd0ff8aecb3c0e4ded6540ff02fdcfdcba15add9605610c92a2f133f6d02c200
SSDEEP 49152:TCbRquA/m2yL5zLfFiV+XenmE3/zOCaEucW/Rrmp:soq2Vjnm6nudRSp
TLSH
T180D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 923c15bbbcd9e8e82e6d7b4f7fe614de5fcf406ef918b19929ee76537bfe4c18
MD5 15ec4e6e673356c6bbdf197c3b591d6a
SHA1 9dd4cdbc97cfcdaf1cdfb446b9073b250c848f90
SHA512 e152473ab5543c5ee97c6eca4fde48cafdc34dc59f3830bb39d18e35a9eb29b11051aa9941d759d3dabf88f265032e540942c7651702460b808fedffd4649bb4
SSDEEP 24576:VAhGLJIFoiwtA5l7S53vCaEzwAyujOhcid/RrmpF:VAMyFoiq5/CaEucW/Rrmp
TLSH
T150359D81EBF955D4F5B3AB7899B68170EA76BCA65E31C20F2164D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 35c9381c38454161596841cd44630c8af2ef9b2d55ab56552cd43abb79453017
MD5 b0ac234f8ca06a476357d72bdf4552d5
SHA1 57be23b7438d5e6e5c19658167e6c07ae6da33e6
SHA512 adcd880575316c41f2d5b2da4ab229188d863fc6ce5ac69bea445b5aa95cabc34eae3841a141bf2f54b516e0928e368a812f871ee1b5f0370c73daae99fdbfb4
SSDEEP 12288:4mw5HEjsChNVBFgl0WDm+C3yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpD:1wuoOWHCaEzwAyujOhcid/RrmpF
TLSH
T13565F14A77A80CF9E967923989978135F7F27C022A25CB1F1364C65B5F37360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2d011a971fec2e95e28e94cd15223c4e5a5393bc7335c929bb9d722f0c9d317b
MD5 c1bd3fa5ce71315e7804a0bbeabbb23a
SHA1 b42b65c357af997c6cd8b0093547e1fd6e1dc008
SHA512 42007063aa425115c0c806ea3fdd13b6c5b2cb5c4c151e4ad1783b636cf0050b3ce73501d698cac340f2236ab7b14432801ecf0b4fa4a13601247ce9e90cc3d4
SSDEEP 12288:ZBZ1IyjyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:3ZulCaEzwAyujOhcid/RrmpF
TLSH
T16855126A67D462F5E297533A8CF10104E7723C92277683CF2269A26E4E76BC15D3D332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 23ef2b15c5ce78d4fe3a55350e6d9fc107f1eeeae89adf560c18ae9368836c5e
MD5 a1167ec53957fb40a9bcae58ee8a2bd6
SHA1 073efa2ef0cf54bd52468cc3d4b87aa61897297b
SHA512 78998cab11d38327f0cc58f3c1a0622f02669bc5340458b4e9115f31366958abdac39df6493d6939a71684e523ebe834e6903959fa1d09e5ad3332a55f060b8b
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:+QRQyi36YOcPQLvw2gAf+PN33nudRSp
TLSH
T111667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 37e448a98bd239111c168e29526a6883fb6c3f9cdfacc33d8953af1960d9e868
MD5 b160b643810452d483df5a8ac461d04a
SHA1 9eab80303aca77c7463bac35734d607319f7d380
SHA512 10ebdb8a61fca397f08da0d6bb012d56534ef7970394ab95eff36a727da6daad7fed43cb9cefb5ce385206f8ec1352874970f88b2cdf5aa61cd8f575ca236465
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:jQRQyi36YOcPQLvw2gAf+PN33nudRSp
TLSH
T171667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 75556abc2a3fec77a45845ac1a1f36ed222bcad6417ae9d6a9177b38870235e5
MD5 f80575be046b28776e5521d9f80a1f0e
SHA1 c0864d50981e2320cf701a2031f06af667d6bf6c
SHA512 9b488b2597fcf202dc7e121d1c3d7d437991ca9af7ce4fe0b4c3ca0e2dafa3bd999ce5c558faf99b8b7dc25dde7efdf2334c034f392c5b671f17924db30bc10a
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01CaEzwAyujOhciK:q68Qg55nhheWu7PNU3/+CaEucW/Rrmp
TLSH
T1FBB55A33B2F600A9C44DE1769F4A873196D27C758FE0D3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e2030eb889b1a6ebd161895fdd20d05fd4561c93fa922ee3ffa8f57e20326aaa
MD5 ad57b538a5ef86a7df3accafe73cfbd8
SHA1 5aaa47a6252a55880d195a6c1a1d193c9bc9b101
SHA512 eafa04a8ead76f0c9f595faddbaad7592c4cd01d9f6120eb7189f381f588878e3a449b03924a26cdcc463ccfa21347ad47d9b4d38442932dab004b9836e8d6fa
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:uy5112gYy5azzVvL69nLKnhZ4nudRSp
TLSH
T159168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f75feb77e91d26c014fde89fe65dd02d2561e15f4d299b13c3f083fd1c638f6f
MD5 271933db403fc5113c24fcb8c631d934
SHA1 9102ac59f7db76b034dd000500560d9fd3e368cc
SHA512 fa58d7e9d29e945f0dccb12488b7739673b5129981aed32c582522a9622e07bdbcc21d3dc17e60f5e6289ea774988ad700287f47a962ffc998660c6dc8b95425
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRCaEucW/Rrmp:iu6JmVxd2dwnudRSp
TLSH
T164D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f79b9aa8188de383f0c25ea8d19fda470ab0b650eeb53373905872cc8e08313c
MD5 c1a2d03acf9340329bebff726eca3086
SHA1 33f7230a795787c6cb452985da00f58f01f37689
SHA512 54f92d0642fe14eb3f48ee177a2254386d57b85f413417a2156621cdd8d7be2d9e195f71137be67887f61373133cb6b9b2ff71547ff28c8bec12c108e0ff9fef
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xICaEucW/Rrmp:rmifPbR6nudRSp
TLSH
T1FFB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4df019f891b766c1834bf4a275647944a1c6fa85b5593b4419bf7b2956a6dcb4
MD5 28ba08e4da23ca8521074085e66596f6
SHA1 deda96b025ab3c458e4b2e8e39118a37603d29ae
SHA512 4954156b40a9ad30616ec4a35f39590c69aebd54a0554c39fd3a1bcbfb2bbc4f106b15de87c51caa853ce321aec672b139e9dbe602ba26eed286cbeb99f42407
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHqlCaEucW/Rrmp:d5dKTi610nudRSp
TLSH
T1A9C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dd30832140aeee9eb99f726493d64c691080fc3657e182bd36dfb2f5a239a089
MD5 4a36fd989137cbb19c75b3489fea2bfb
SHA1 c5395217088767600602440b1ed10106d2cafbbf
SHA512 ed8165dda4e1ae9892ecb288b3723c363a55d0ab8bf97ac379dac7fb5050278eec2decebe9175413f3bfbef1c05287c848c9cac882daa93a98d18e4a04a86e15
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5wkCaEucW/Rrmp:KX2iyphunudRSp
TLSH
T13C95CF13F2D901E8D05ED174C7468632EA62BC160B39AADF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 101d8558b565efa481e2f54cdbd3c6408bbe9116d792f8b88bf46c0406c91383
MD5 a33bd1e84acd2680213b520b0e4f0435
SHA1 943d8fcb57014a407f52754af65c3750e58e6ca6
SHA512 aeb6470201c7f721b3178634d494bb0d9924d987d9d72df8966225aba2087cf0d06e4ce6758bed269ac78d46998503df3622d2c9d628b18a2877ef2b7b6d9851
SSDEEP 12288:QgyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:QxCaEzwAyujOhcid/RrmpF
TLSH
T1C9552327DFCA87F2F64667330CB61064EB553C9776AA86CEB65DF12D84B8BC0584E120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5718f83dfae6d47be7cbeda20237b011c4f99b80dc6e3bdaf0465a6f919e4e34
MD5 2229a72676931c0c9b04202d05ad6bbf
SHA1 67f71d7e47d7650ce654b17cd0fe70cfab7c9648
SHA512 ee061b2a9774ec2f1c0a32aba1121dda0f374928a0e1085650552acc8789f39d6b053e99f27727cc6737249a9d46da4d1c7c420548946fdabe59df0c2a1a6396
SSDEEP 12288:OPyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:OaCaEzwAyujOhcid/RrmpF
TLSH
T15E552337DF8A47F2F64567331DB20064EB553D9776AA86CEB66DF12D84B8BC0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0161fce6705fc45d785c7bb3b4db55bbd8a6a5469ba4822c1cac7f8afd31c81b
MD5 7498ee12dda38dfb39a10dd368e6ebb7
SHA1 f75dcc43a151f8b5129e375b5c3da16a5ea214b2
SHA512 a6fc13ee2c2c89e15036ebde19811a4a8fc3ac225318fa3ca6153f6090184fcf98f67f522fcfcf72b2fbc7c88b2ea0494d74a70c047fa8f8111d7fa75cc7174f
SSDEEP 12288:ARyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:AQCaEzwAyujOhcid/RrmpF
TLSH
T180552327DF8A47F2F64567331DB60064EB553C9776AA8ACFB65DF12D84B8BC0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7c5d83e32dfaf94fcd86e07592b2709ffcb2359a4a32d7534ab0eab3b3ac07e7
MD5 ed1f5eb75940df29d967d337b1aacb3b
SHA1 41b6717f660f35ebc7d7881d1c431d1feb746f6f
SHA512 aa58c62938a9c6c980b8bf596ae350a4f845722526aea6a86bf194466c8197bbdd0e9063ce9e696f332e29756484c7a2ae4b59ce2f6de3b83302ef6ffab10578
SSDEEP 12288:cVKyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:ECaEzwAyujOhcid/RrmpF
TLSH
T15A552327AF8A43F2E956E7328CB20024E7B53C96677687CFB61D755E0CB47C0986D620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9f007f0e61c4c3041f430eec37fe8a9e346e55d1ef42454c20fecf60a37b41ed
MD5 a2dce2363ebc46183f4ea91ecddc660b
SHA1 d84bcf1c760b62890693a023d075949d685534d5
SHA512 1de849d0b59175859a3f3e7c69023c9f3f0f9fb848600023a3b1e2c0872ff0e627464b8dc606f235612441249f487dd11ed6773465ccec55dddaa3be1cbe093a
SSDEEP 12288:SCyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:SHCaEzwAyujOhcid/RrmpF
TLSH
T1DA552327EF8A47F2F64567331DB60064EB553C9776AA8ACFB65DF12D84B8BC0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7163b9cc1aa0ca5139650d7fa6e0ee14897297b6ebd8a17e476e40f8b755e847
MD5 56b59701c4c1be36fde8e59a1fecac96
SHA1 ca9918b4f296a9f4319351abedb9563b862941ef
SHA512 c3dd7ba673aa8bb55ac4cc3abb0b30e0641d5b7656ed1d3978fad34e74bb97dba0a44ec592b1ad8b60773c6165e232760b7747360607d956767d8c5c107253ea
SSDEEP 12288:W7yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:WWCaEzwAyujOhcid/RrmpF
TLSH
T133552327EFCA47F2F64667331DB20064EB553D9776AA86CEB65DF12D84B8BC0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8f9884f53504f26e6cfa0749157cccba7188ca544397715e2988ba9cbbfc4794
MD5 441ed223a51b22de8daa4407f9e29975
SHA1 f00e1a08d5b4dd176d3c9b411f534e1ec7161056
SHA512 67ddbfe6ecca5a935ed121a110ec8c92d8762aa0fa55e421f876a8abb8b959b4657f82303da9d1a0822cd4ad93a4b8dbb7c524d566c570aa63b8e74745dde81e
SSDEEP 12288:5HyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:5SCaEzwAyujOhcid/RrmpF
TLSH
T138552337DF8A4BB2F64667330DB20064EB553D9766AAC6CEB66DF16D84B87C0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a3d4f92743dfe8373afd13c4bb51f28ce6163d3b81e51154bb328d9499dde3eb
MD5 13c4fb9235f30abe106c2964c10a5f3f
SHA1 63e5705f1b5176499b4cf9e0f11f74a15d9cec88
SHA512 e1f3773b086ef93d2ca606e5c4e6c519b4faef31593faade9884e6b6da361f7454e9db42cb2885933a6afc621d06a48da84ff9fcb6c9c7058f9903822ec95768
SSDEEP 12288:HiZwb6zzFEoS2cPvyvyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:CZMSzFVSO6CaEzwAyujOhcid/RrmpF
TLSH
T10C7501A5B39019F4EC67823ECD664915D6B23C5A0B70CA4F13B8366B5F733A01C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 65f0308adad7ea92f8fa0358e6a33ee8c138c71b9ffdd4dc03a62d654f40d65b
MD5 c885ca9b92cfe426265c603515277986
SHA1 40f5e424d55ec59e74e65586a528dc61b2c799c2
SHA512 8c259504edf93fce4a5f9fa43a2ab51d5f10fcc37462b70378309a64aa06302a5577281875a4e9bb6755677f12b6d01c99cbb91990678a9ceaeaf7d09bce461e
SSDEEP 12288:mUyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:mVCaEzwAyujOhcid/RrmpF
TLSH
T14F552327EF8A47F2F64567330DB60064EB553D9776AACACEB65DF12D84B8BC0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7c0fa02e28bf867bdb522c4dc801f8301a2ae9e67844c2da3e08105a84d92d68
MD5 6163ac9b54a4eb7033cacd7fcf2512f6
SHA1 ad4bd89767c931fcffcd51c6e90c21f6557d1fa9
SHA512 2835d8e8a125265b7d43ec57359ed37418df5d0226a75704f816e976bb0c71a3204cee3519cfcc0508c8ad8b274b6f3f6dec8815a8899a0a63e75e91a4e4d93f
SSDEEP 12288:ZoyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:ZZCaEzwAyujOhcid/RrmpF
TLSH
T186552327EFCA47F2F60667330DB20064EB553D9776AA86CEB66DF16D44B87C0584E120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b2822e7caab4f56085c71cd5ad55865e7a2b4d3c3351cff61807ef762fcf3a06
MD5 c6a061aab8ca453490afbf7fcb1851dd
SHA1 426910c032ea1abc56c09ae56a945eeb37479f45
SHA512 dea85093b9fc8e58233315a6209165863e4cdf2d4e9a6ecc5c18f41a58cf096f23fdd2c83b250884cfc8d38dfd3eb398e724fc16a3289df7ad7563bb8a43e61e
SSDEEP 12288:SyPz5L8jyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:PzyeCaEzwAyujOhcid/RrmpF
TLSH
T17C650117B79521F9E16693358CA20611F7B23C7217248B9F63A8627A1E377D09D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5786c0aae3886602c842a4fad114b97bf26de91ceba8bd0ef29ebd62c6c672aa
MD5 75d74be9d87da070308c0c7b63d5fe74
SHA1 31b85b9fef8d7e7db9b4283e437aa31fbe3dedd9
SHA512 82d188b75cb13485aa8125fe1e11ead8c2f08b887aa03ee78e5affbf3c0966cfffde4842d729c5c06a7ad762483de128144564adadc852456aa64323a2e54e41
SSDEEP 12288:1UyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:1VCaEzwAyujOhcid/RrmpF
TLSH
T18B552327EF8A47F2F64567330DB60164EB553C9776AACACEB65DF12D84B8BC0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8266682b7dbeab170c6f4673d50771a841180c11d49dda6faccd752d1edf82f5
MD5 d20174e27cf665d87bbc1762ffb7ce36
SHA1 35ce06ef90c3cd1b7b15f1e43cb99b55a50372f9
SHA512 9c8014fa9bdccfdebdabdf2abb1cc6749485b5ffec9def5740276a5bebc22e53803b3de85ba27cb11a270105515c74ec7d9c683150c6b9c4c269a8f9e5c09355
SSDEEP 12288:XUyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:XVCaEzwAyujOhcid/RrmpF
TLSH
T11F552327EF8A47F2F64557331DB60064EB593C9776AACACEB65DF12D84B8BC0584E020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cc65894040e1cf19f08b0195416c59631b308840f1d5734bbfb648eaaf46702e
MD5 017f37ab3994b552f3209d2739372d31
SHA1 9e5d3663e361aa35bc8ff0193ad497166f02af91
SHA512 83db2b76cac59a59a7f91ad3e1b39ad4c5c40d2e208741e329878a912fac5c862ff3373a5023a4560c42a6151ba422f47204db1fa7385dff6ad67f70d191fa7d
SSDEEP 12288:4yPz5L8jyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:ZzyeCaEzwAyujOhcid/RrmpF
TLSH
T13E650117B79521F9E16693358CA20611F7B23C7217248B9F63A8627A1E377D09D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d53da8fa11e0c9ea7d0379cd81954f54d4adf64eaa62823d0756c825a1b50aec
MD5 fa18af95ae906002efc63e994b25f4cc
SHA1 8a68594340a24f96748138f2d72321a9b4a65239
SHA512 59f342fa5663a0f116019e735f9779447a61a5f8fd751c46a7831a80bc7e4021526fdeabc9ad309c5332f84d2c0d19bf0f38dba13ba6db80425e010d782edebc
SSDEEP 24576:MTHaLl3z0zDgCaEzwAyujOhcid/RrmpF:MT6LljrCaEucW/Rrmp
TLSH
T1A97501A5B39018F8EC67823ECD664915D6B23C5A0770CA5F13B8366B5F333A05C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 c4a16a24039b9f4015fb2751828139a1226a87ebd10a68e1398bfda9bf430fd6
MD5 f917c9796ff814da4c519b55d80530b7
SHA1 8269c74b67a997dc25c40d9b8e9923c9359b6926
SHA512 cd4e519f535b2335508e933ca8b0ad5d65350740fdf73f55b3015f305e2383120ebb79ed7638b4f3997f20be671dcfca34ff71ce60ba4028831e7249ef58a0ce
SSDEEP 24576:937d9CHKy7GZMCaEzwAyujOhcid/RrmpF:d7d9CHKyaGCaEucW/Rrmp
TLSH
T14985CF90F3E415E4F0B79A358D764511DAB67C9A1B31CE8F03A8661A1E33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 58f9cbfa4b13a89ef7e0f8678a56ee50fdfaa30f41202b4b0398354ddcf38b55
MD5 d6916cdee49cf7cfa374908b1dc22b62
SHA1 174db72b9cd53cc4db8283e9714bf17230458126
SHA512 8e0494509601703793c12f30be5070926da52edf7afcfd96f692913f7ce4cdf94d155aee1983b019ff49bc592b58a9836483b4376db7719478d21ace5a41c204
SSDEEP 24576:xfwvok9RX6wkyAIYCaEzwAyujOhcid/RrmpF:XMnYIYCaEucW/Rrmp
TLSH
T1B385CF29EBDC44E5E1B7923C89B3460AF6B178691B31C6CF129A536D0E37ED05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 805964bb7bdc1088a7f2b63386159a65cea5574f9ee66a52a5a4751c24b6a730
MD5 fab897512f1346d1eaa00625ec88f127
SHA1 359ecb4d127e9fdfb5a6644667c0ba6c54a8ebfa
SHA512 c2549ea040edd6d1d9599667ac34be732f3aa5b6609bfdd12bafabec3acec3724c49f61b2cd49cf210f79788ce5b1800f45f20e682753c5c75c5c19211a75889
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ECaEucW/Rrmp:OySzPXnudRSp
TLSH
T18B066C56A1A801D5C1B9C1B98F1BCC1BFBB134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7da2a0eb25eb5208c48202ed17148121d126859b4d097df91c7142203daf6f0a
MD5 48bdcc9328d98e82bfdf2f22492f0297
SHA1 362afc0602787b5393ff0d782531ab6181d64ad6
SHA512 894da75a2669802901d74f7bde81b4a36ac896b508cadf8369db6cf93101d70c5a01e5833a9ad51e7b42f39686bcc430755d2e7ef18b483be50132acbe8653b7
SSDEEP 24576:m47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqCaEzwAyujOhcid/RrmpF:m47JUQj1irIhCnDHUPfF/0CaEucW/Rrq
TLSH
T17665AE1EA3EC01E5E1BA92388515465AEA71782E1F31CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4315fe14c1f06dbd66bb9e2cd916f657457542a87ccdc4d71735205bd9aea82b
MD5 9acd02cb5f761286e99aa49730f61184
SHA1 a9a949fde57b92458d8ae594855cd436bed1fca9
SHA512 ab38fb139aeb3ab37db08e00450438ea8f0a02cc124923878c56201ffc3ed09845410dc5c2fe8105fd6152cc3fbbf1fb0f1da7c2f6ddc48a7aaeab62ba869538
SSDEEP 12288:pNsfEyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:ulCaEzwAyujOhcid/RrmpF
TLSH
T1A365F11AD28802E9D06E6236CB964640F7733C6697E1C3CB62D4F53E0F796D09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 33623d0a40e80544360c845a804f7f5804d989f8be0cfb1fa024dadaa1015915
MD5 939e715f70810f5e7595d413c9f3ad5e
SHA1 e168d30351d314e72d47fa1daf1145fecf2909db
SHA512 927ed5a40a7aa973dca9b25a9eecbecef0b42f28c45138838c69db8a4a9db376625d61d23d4666152e4d3badd1248e2c914453a67df4759471e9417e8ef58dc4
SSDEEP 24576:Nd6b0SUPzXy3Er+z9oeIyoJlbgyBjXriJ:fSUby3n9oepoJddBjXri
TLSH
T1605517007226DB8FC6A940365E36D6CCAB707D01FE046F1773C9973E9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 b0e4771e5f4219848c6bd6b82deee9e824cd09717be8ef2a0a54f4d9494fb2d9
MD5 6eb29b2f09052688144aba8bb267655a
SHA1 1d94c4c4c7b9c407bd0fa8424783caf243dfe032
SHA512 a5ed8bbaddf4e07bd48d73d1c8d4b9b01a23a56c585df3da66526635cf186d9a6bcfc94ae48d544ecc910961fa9f29509aeb09c8e8003c608034ae8db94db0ff
SSDEEP 3:OlH/lJAVEnBNlytU8rECfTI/Bl3y8jK63mCllltGlslslslslslsl6yFCsil:K8ynbgtJrELVKcmCtEEEEEEE/Fvil
TLSH
T1868192A80B444A21CE92A03108882B8C83B1C18564C0E7B7024A20A5AC30A468D43F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 9f27604b90cecca466d0d03f73e3777c4e7a4ede35d913880d9fc547c6fae898
MD5 fc5ce85a1022eb771696a39c78c765cd
SHA1 4fbc3cfc54aa829f55ca3c1315aba6cc4f276a8c
SHA512 1a1a181b3470e35422189c3219c9d700102027ffa3cd3872b773880670f92c187f6a8d3ec53e4b0faaa9e7398b72f5e6b8440b871b83aa9516182b0b03f857cb
SSDEEP 12288:uNoQyew/wxjJzXYISSqp3IrsVPkEAa1PQ2vcRs5VqTWeHwDGc0lUyfTkTUq:uuQyE1sVPkvoIyBVqWq9lFLKUq
TLSH
T1B155180055B7EB4FC9BE903B123696CDAB786C02F7453F057345883C9866A6FB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f1103775ecdebe2d2b4ccacb50f02b4de2eb212da728b67421d20f788dd4dd31
MD5 d388740d96cf799149001e4ab7144dd6
SHA1 c23a3071f8fc63085db1d97d10a680910e7c9958
SHA512 213eb27dd978e99d76cadd1e1ce6f10bf4817c970547866788b682443ad2a07974039007ae0a660de0ae352b2c78ec087b0c55e07244f77a7226e9d58330ff2e
SSDEEP 12288:VF71yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:DUCaEzwAyujOhcid/RrmpF
TLSH
T19D552333DB898BB1F96A673208BA4034F71A3DA61B59C6CBF51DB26D4478BC09C7D211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 200f3f2c512ab66156d6da126ddfe25d56868c14d2e58e3b8558895e0fc5d4c8
MD5 5346c4f33a5f64022657d84c37ec1b98
SHA1 36b31800e1dc3f8363722b90673bb133097094df
SHA512 c62133d9fd1195f7e7815039c8afe5d47dd1c9d17fa88e2525baa37bd9c05cae7bfd2b177f51e32952e031749636ecae38db2b4a684b2c837088169f3fc0a33c
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYrCaEzwAyujOhcid/RrmpF:Rgb4mBIBhGFqCaEucW/Rrmp
TLSH
T10465AE1E22EC02F5E0FAE2B89DAA4417D6B278161731D2DF1151423D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 78c225b8a8f5e03c9e062899cf3b7e78df77e1eca06d7f43b532ffab616b2e8a
MD5 9f79269b7b68123589fc96bf7fec9229
SHA1 d7489f3dd6cba0a739e259468678b359f36455f8
SHA512 78234d331ad230df748e106341d2856cdeef18a8c0af2e56927f293a244901b7a1b1de2cf01b043b3ac499344362804d5b79edc0b7f64245a1a696494b42cb9d
SSDEEP 24576:s8kNvNnaFeYhJNtmZBmdCaEzwAyujOhcid/RrmpFmaKngL2jdshRTdG1YxITqvfv:s8MwBtOmdCaEucW/RrmpEarSj8RoTCCW
TLSH
T1C5A5D12EABE846E4D1FEC6758D238516FA727851073293CF9290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 850fe4427406f29423e1cdf39533d68f7b1cfe241533a720cec093717bbbc9b1
MD5 d2e774d1c8e5ef84ac28834d709697e8
SHA1 9dec7486a12b463bc37c60e4cda86e57260c77b6
SHA512 8e6bf386f24c5d7a3119a4da2513af9605d9942818621384e3e8112d2e5bf40fe651981e7f187df526f229a4ffb2288a16c213520543c4635f9dbfc25fbfbc87
SSDEEP 24576:mG7GaKngL2jdshRTdG1YxITqvfPkbIcbjLm:mGCarSj8RoTCCW
TLSH
T17605237EA7C56694C43B977829B6A84A3CF33768970A46DF88E0957C4F697E0363CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 81676b9f62d58ea38abc884fb95a6ad221b7413b35c5f9b47df577e6487f185e
MD5 3e1b913b546856fc187eb6d79a0e07ad
SHA1 979cfde3b290bb065836e8b70f581d5dd15b2383
SHA512 4758836efa6cc14c2cea5761bb12a5ea04c9e0aacb692874915015ae28341bdd0680dff1f494d86cfce4c765ac493c3e9bc74bce06dd9973f10270ce4f25e6cc
SSDEEP 24576:xG88u8FpJqH1bzria7/m6CaEzwAyujOhcid/RrmpF:U7ZFPqVea7/DCaEucW/Rrmp
TLSH
T1EE85F165A7E102F1D47BD23889924663F6B278250364EFDF07AC8A551F33AD04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 24ffe8493d4d2968fc4f87087f32e8332dfbfafc5b9acfeeead49b51e8dd143c
MD5 801fa8b2e00c7d50cbb492fc375c155c
SHA1 79ad9f977654fe10a6dee70e6b32119243c9bf9a
SHA512 6e581a9bf0165644af1697825083b57a8ee2daee00f2aa7aed8c52417518ea479e2597f92e794ab1dc403da99d49dc9aac80e9ef7d39354c0c106b4c1de5397a
SSDEEP 12288:6HvUrBFrEjwaQOyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:6PUr+NQjCaEzwAyujOhcid/RrmpF
TLSH
T1D065E12F66DD18E5E67AA23D89824219F77178621312D2CF02E4917E4E77ED4BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1867f1f491edbcceca77cfc2f6819e203d09eb9e63351c8e542bcba0e12562b3
MD5 18b067db452299f619738f7f169fca75
SHA1 3a1b48fe4c54859d4ddc2a828d9a608b6116cbc4
SHA512 2ea6177e39a8bc8c6e8be5384eff4ef4f3a7f1f1f8f053dd1e74a515700e35d640894f072a50ef1794a39a2c52fbe07193a65dcbb44d476e4c4583f7fcd5ecbc
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzCaEucW/Rrmp:uG05lO43brnudRSp
TLSH
T1C5D5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F27FF0997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8e638b92abdca034b3d112ad79e9373797beec11c8e5ea9acac16657141886ef
MD5 5966595029102d10a4da0df39e9ee3c6
SHA1 54fbb584399e255302d6c0d4c5d1c8fe4b6678c7
SHA512 a8ad7b30127a6a6826716ede253f9343f2fef3844d62d406fd0111a35d18e722398982389393a23efcdad2fabad1cd072fd66d81f02887591f86079bf55035a2
SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnECaEzwAyujOhcid/RrmpF:ga5POZ3+Jt2pasx2+m+CaEucW/Rrmp
TLSH
T16265BF5EA6EC01D5D5B9D17DC583461AF5B1342213329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60aaf0503381069eb14f39c4c406edee59bae1250381fff71cf53ddad1245544
MD5 296a2e4611f53ddd8794814221705ab4
SHA1 c59ed1c957bff84d4a9d4d9ad0d6083abed0c2fd
SHA512 3e0fc0694912e094026569cf91df31f7baecf6093ab6e68d7f009bab7f20be9561a864c3ae78dc200e79b0646267015b817f39b405f91cb0731b9517be9b678e
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FknCaEzwAyujOhcid/RrmpF:2Nc/zEOVHFqCaEucW/Rrmp
TLSH
T171857B2623E901E4F5BBE1BE89779546FA71786513348ACF0291811F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 6dd1df7f4ad8ac708df3d2a741561e1f7dc1ddd370a1aae01ff626905ef0fa73
MD5 072fb8c1dd04d21383fcb5b96f9368d5
SHA1 d806e5014dc09153b2e389b80245d8e26b1eb51c
SHA512 6c189e12a29c9425c4f88d0c0c03129b50c103ac0c2d070e6db0d50712e21a2ae366130a4f7c4de11a08ce114a5a3df4e90836780fbbdccbc3eca5f1558d68ad
SSDEEP 24576:y6DIHaKngL2jdshRTdG1YxITqvfPkbIcbjLm:y6DIHarSj8RoTCCW
TLSH
T19625126D63AA01F4D06BE13D96934506E5B2B1B487074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 99cbf6b77f6ec40dd106d39a41749ffebfc018dfef3f617ee3227382743252f6
MD5 041db63856d1bf9d83501efc4cbe0f85
SHA1 35e03b68b430957cc2680d95cabcffda2477f6cc
SHA512 abc0ed6c5f4531259ebcabbd0607971bcbf1b0b2b7c86bc08e8d9df13462d2af3c4cedc0af95e02f4cca2b8f2ddbe905f56a3ffd7ec76ddb9857839ca2f77f08
SSDEEP 24576:EtydaKngL2jdshRTdG1YxITqvfPkbIcbjLm:EtyarSj8RoTCCW
TLSH
T16215235AD7C456D4E97A27786EB385882D727E249B0783CF89E0E63D2F367D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 3129e0519ac5d27d48e5443899edda56f694abd95196043a1c5967d5fd21212f
MD5 d5bfce30902e24f4d217f3900e074c57
SHA1 5e37fed6fca851e0a3126d0358fe70279a2b0127
SHA512 bc3bcf71ec2392d5a2a49142a4496d12ead99aa8f1e0c92238f7ccb9b85ffe3990036dfd20c86aa73b16dc7e636a4cb62af257a86f9d4c9514b0753f50c27e50
SSDEEP 24576:/DkNvNnaFeYhJNtmZBmdCaEzwAyujOhcid/RrmpFmaKngL2jdshRTdG1YxITqvfv:/DMwBtOmdCaEucW/RrmpEarSj8RoTCCW
TLSH
T129A5D12EABE846E4D1FEC6759D238512FA727851073293CF9290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7461baecc740271ad5845c2514909d97fd746349bf32120cf4d2665faf022b6d
MD5 332f98a914094aff3889c7ceaddf3d20
SHA1 8a8a3fbb76da4e584ab60f65a84ac3e24357ee74
SHA512 edededd8a8108fdc79f64e712a4ade664976ea80147d7459995d9cc748669837893695066b58699a8c5a33dc40299a8b845865aca384c2d967333dbd3f4249ff
SSDEEP 24576:ED3FHshBIYQgARCaEzwAyujOhcid/RrmpF:EDVHeBIAARCaEucW/Rrmp
TLSH
T15D75E13EEB9C04E4E57BD27C8A634506E77138A9032256CB1294D1BA5F6BEE06D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1a0bd94227843b8.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\e1a0bd94227843b8.bin
Size 12KB
SHA256 fd2357da7fbe67eaabce89e4a9716d357eee57705cb3473d90452679c7be3f50
MD5 37b28d7b0bff863b5ec0d8b21176b34b
SHA1 694123c3a134aae2bb5ff0a13ecede6b08f56211
SHA512 33c418d49f6ae49e866fa233177adf2252f2ddc56cf340d8d895bca0045e0592d587e734354c49a545c07a8b9859ea71a3fe000aaf06b7076d05f86ec43e9678
SSDEEP 384:7NacvjiX4B6sasWtYwrfSlPbuR/ts3Dke:owjY4UBY9Cpe
TLSH
T12642D179DD707EB4E1201EC4A6721E4147CCD9AC1EA3FD4CE3B194482791170E25AA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-79-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/400-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/400-264-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/400-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1680-74-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1680-238-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1680-75-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1680-68-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1812-92-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/1812-97-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/1812-337-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1812-91-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2676-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2676-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2676-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2676-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2676-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2952-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2952-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2952-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2952-403-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2952-402-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2952-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3060-213-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3060-387-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/3060-219-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3060-212-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3060-389-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3388-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3388-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3388-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3388-31-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3388-29-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3392-386-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3392-385-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3392-121-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3392-135-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3392-129-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3392-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4080-143-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4080-237-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/4080-149-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4080-151-0x0000000003900000-0x0000000003983000-memory.dmp

Download

memory/4080-158-0x0000000004400000-0x0000000004460000-memory.dmp

Download

memory/4080-164-0x0000000004400000-0x0000000004460000-memory.dmp

Download

memory/4080-142-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/4080-176-0x0000000003900000-0x0000000003983000-memory.dmp

Download

memory/4080-179-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4080-157-0x0000000003900000-0x0000000003983000-memory.dmp

Download

memory/4080-177-0x0000000004400000-0x0000000004460000-memory.dmp

Download

memory/4340-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4340-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4340-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4340-6-0x0000000140000000-0x00000001402F0000-memory.dmp

Download

memory/4340-11-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/4340-66-0x0000000140000000-0x00000001402F0000-memory.dmp

Download

memory/4340-17-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/4340-138-0x0000000140000000-0x00000001402F0000-memory.dmp

Download

memory/4340-125-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4340-120-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/4500-186-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4500-192-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4500-388-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4500-184-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4588-58-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4588-47-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4588-48-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4588-56-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4588-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5736-196-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5736-207-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5736-205-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5736-203-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5736-197-0x0000000000810000-0x0000000000870000-memory.dmp

Download