0a42dc91f7dd2916f5ef752cb31cd521ba9efaa16abe3fc7928c36afeb68df2f

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 5.2MB
Sample261024-b6fbvaea47
SHA256 0a42dc91f7dd2916f5ef752cb31cd521ba9efaa16abe3fc7928c36afeb68df2f
MD5 a68e191aefba724ef58e2ccece42d5cd
SHA1 7685646415891284c60aa52103271007a1354ddf
SHA512 b71385b10816cc7011d7534ee49616a47756c01487f30d50e280776aaf81bc604684aed2a72fa8a2e79eeb5c6d0ce3a5ae8a6054bb36222dc0a5a24ebe1feed8
SSDEEP 49152:8alGdsSX7DxKVf81VvjoBeedMseAS6NJ3LvcwBpk1ltACqTMCVi7+tgauhwbR3PB:zgW3NjK72i+gaPJ4JTy
TLSH
T1D8468B07E7B941F4D0BAD1398A979617FAB27819973197CB4290464A1F73BF09E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4352	elevation_service.exe
2516	maintenanceservice.exe
5680	OSE.EXE
2784	PerceptionSimulationService.exe
204	perfhost.exe
2868	ReFsDedupSvc.exe
3764	SensorDataService.exe
4732	ssh-agent.exe
6068	AgentService.exe
1204	SearchIndexer.exe
2428	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a17c82f8c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4888-8-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral2/files/0x0001000000009952-82.dat	upx
behavioral2/memory/4888-110-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral2/files/0x00010000000093ab-81.dat	upx
behavioral2/files/0x000100000000932b-80.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-24_014518_4888-3692.log	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006d05305c5963dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e99535c5963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca45405b5963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001af5e05a5963dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000423f1a5c5963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093b3ff5b5963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000296cf25b5963dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012c72b5c5963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a953069d5963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0476d5e5963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
5680	OSE.EXE
5680	OSE.EXE
5680	OSE.EXE
5680	OSE.EXE
5680	OSE.EXE
5680	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4888	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4352	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6068	AgentService.exe
Token: 33	1204	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1204	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1204	SearchIndexer.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4352	elevation_service.exe
Token: SeDebugPrivilege	5680	OSE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1952	4888	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 1204 wrote to memory of 944	1204	SearchIndexer.exe	101
PID 1204 wrote to memory of 5360	1204	SearchIndexer.exe	102
PID 1204 wrote to memory of 2612	1204	SearchIndexer.exe	103
PID 1204 wrote to memory of 4676	1204	SearchIndexer.exe	104
PID 1204 wrote to memory of 4360	1204	SearchIndexer.exe	107
PID 1204 wrote to memory of 932	1204	SearchIndexer.exe	108
PID 1204 wrote to memory of 752	1204	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4888
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4888" "1820" "1688" "1808" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:1952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2516

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:204

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09021cb46e8a879979e95f4eb47806eaa7e9d759909d61ec3a9cef7f1d89acae
MD5 0eea04a044b70a47abadc096506a783e
SHA1 c7d6dda606ad39c66fceb77c940cd8d1be09dd03
SHA512 d84f905be0117c552c44abba632bfd2ed300c6582883772ded0892a5a548472e40471e2d29d6ef65a3294b49618cf6d460ee6440365c45d2d0b1fc4257bb4855
SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnK+tgauhwbR3P8wT8:u3q6mjBcgaPJ
TLSH
T11AD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 107cdbb15fa337c631758056e570df5dc2c0fec37da9ecc6b2022d7d96271d51
MD5 afb582918a2ede1b9d925d900dc65962
SHA1 f99f206a94a77c62f41003bac6a4984537704d8b
SHA512 2f9085d24b71513c055cdf394f0c51688cead76ee001a7f47feeb2693593f09af401988619b88cf3ff713de039be52f40cb71829e18745590818f933009fef99
SSDEEP 24576:0XYfDtczAS+4ZAgayjhwbmY3MaReFeDvSP3b:ztcL+tgauhwbR3P8wT8
TLSH
T1F785F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 69f30467fde3d4ef6da4eb99e440d32e814c0eaa163668c92a2fd77595ef12a0
MD5 3ebdb1caa9b7c4cdc12f27511397baf6
SHA1 b67d3981901eaf2951acd468b0e747b399bcd520
SHA512 bad182049e50b2d5a75053362651bcf6dc90314ca0058b39ffe404785f6ff690937a752946b8c9edce4f1e2f6f9817c3338fac3fdca1566016bc37817f11cb42
SSDEEP 24576:W0Le5ji0hmxhrMG+4ZAgayjhwbmY3MaReFeDvSP3b:WPji0AzX+tgauhwbR3P8wT8
TLSH
T1E095AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8704720ccec28c334abf81c5b7d799e86cf76fdd599edf603fcae0b45b2363c
MD5 08b965c46846be6edf3b43d20961bb47
SHA1 3dd7d766010995f96935d1c8d9004f3e5a18553f
SHA512 17f9dad1d1841dd1c08d3164fdd0afecfc1922dab85de180ffc00cfb463c485950a788a345a1719beb9b10303433981f0d00fbc327ec1029b76ae6e05fb7c991
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyu4+4ZAgayjhwbmY3MaReFeDvSP3b:G/ezSC6vUzPv+HjyL+tgauhwbR3P8wT8
TLSH
T194756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ff84cab25979741e5fe6382ef21d35a8579bc460b43ee1a23a53f743b3783764
MD5 e1c8eff55b544784c68d114310c6150b
SHA1 44d0e00ffd6e41f683a0bfc37bb01e64f146f92f
SHA512 327b48e17b1e28058698b3330db0ffc7a96361f3585d2be632f4a1070fdac044161256ad5e86a33935f24e419ba99a57a67fb646c7ebd493236fc11ca0b9c6e1
SSDEEP 24576:kVbqPb88hv/l+Bd+4ZAgayjhwbmY3MaReFeDvSP3b:kVO88hXl+3+tgauhwbR3P8wT8
TLSH
T1FD559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ba5ab64205c04918de15c276ac06b82c239d477770360fa0cf2eb3599987d33c
MD5 acc20d736ffdcbc3901a51ff750aaf5f
SHA1 54bc14bfe19a3f3a6c0b4c11f32d4c0264267c24
SHA512 8af114eaead8c65cb531df113d2f54f1e1cbe062fb90a8f80a7d2a5a2e090022d54b622ac5fb207334f5ec66f581c6eb2fc92ccd04ccb3b2b3116a081f4dc994
SSDEEP 12288:1G7eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:1GS+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T148652381D34C98CACB7B0B348B7A0D606699EFC52D85A604E5C97BC9CCF0DADC6B1395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 af1262683d63826baf20b9185100533d66430c884d0709e75c4b024c8a4b8e87
MD5 82df82bc1fa74a713003e6c11af05af3
SHA1 792bb13fa727f98207d6bd2135a97e407eedccb1
SHA512 52affb845641150420fe6a334bb348917932099c9ccfda4e30af0158cc4d32015ef9e44951a9bbd162eab9bcab73d71193175939986a06c11c2f6cdaf555d6e5
SSDEEP 12288:CeBNUbTVO86UEeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:CJIUF+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1DD85CF7BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1ae4802d048fc13916bdeaae253e55a45950258e832caf40d1a75843f46839f6
MD5 290609e9db5c8f464d5153d4e7ad5443
SHA1 ff7f2ea726221ee512d32c04b20a274b153ca252
SHA512 51e5a5ca4f3b7e4d60677c9e9b01a4ccb38604a14b292ab9c4cd4ca30850784490190d169e98ba204d30f7da4ef7e9c1df8eba4de362971b1f067b14bbc1e074
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THP:NQvGAdlCEL8c/WRNw5CrgaPJ
TLSH
T14F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 91bbc49fc649d144e8f15e4ed86710af3d21e67bcc8e0f6047b83efef46afd61
MD5 6fe1511e07b75e44edccfc16abf2b1c4
SHA1 b30d42c86be0afa5b7fb9c8a8ab0574c74f8c0c3
SHA512 b93d5bab1af5cabd5d8560105d2b7ef3102bd6fcbdccc1932c3d5e4495863178e96817f0999a0208de9aa4c73f62b9eb1dc420f3c9d1c5dda1866320d966d0e3
SSDEEP 24576:AfewsAjn+4ZAgayjhwbmY3MaReFeDvSP3b:qljn+tgauhwbR3P8wT8
TLSH
T19885E031FA74E436C67B0DB21B36C712146DBE604F511AC3E3E89E9E89706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5e1646024f6719d8a6a8b4f518e62efcb088f5720b65a4dfc07acb598cf5137c
MD5 ef995b0d7844c76ec59e7fb99e520f86
SHA1 e842d872784c9ff4b87db37b1c0303f7f1482c76
SHA512 bd04dca60be921b7c020c92192913824dca588033155e4f31c674efa52d8621767bbb802edda10dea955765a3be7b84cfd76bc2b2388b39453af293091aba228
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRax:sUEtQevvqc2W1cpV20I32q
TLSH
T11F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 49f1f12b6bcf5f8edcf8d27c6403acc3c09e53847b0ff93d925066921ec5698e
MD5 4579f84029450810cbb759d839eb7872
SHA1 d4b3df6ec8aafedaa4f5224286bcb301d70be6e1
SHA512 b87902212059ed814ce9aacd90683f598fd5c24118de69f8e38c83e7af503d047aa34ec36818acc0cd0f56fce70e217c8d5fdb1a8dece9c5dd4d1a5ba40ab0d3
SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zH+tgauhwbR3P8wT8:5oqtVjnmfgaPJ
TLSH
T155D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ea8ebe2fbe94fb3abd0c10befc0eec9ea85e93a0220ddb075a144f151789a370
MD5 abcf42cee56f7e11dd3f8cd8ed682a93
SHA1 bae6c6b7686bd5bff45c585a03747d359807bf7b
SHA512 edc052dd93a9aa6dcec81a6b21285c37f3c85944fc43a543a76c888245f0af4088e3112a000ff2d862025255345285e2b56db1767f774bbcffbd602e9d7ac579
SSDEEP 24576:uAhGL6IFoiwtA5l7S53s+4ZAgayjhwbmY3MaReFeDvSP3b:uAM5Foiq5c+tgauhwbR3P8wT8
TLSH
T135359D80E7F955D4F5B3AA7899B68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 81581867326f18c7dcfc0b1dd42bec5736c72b528b4b51d68d82a2a86dd03c25
MD5 6f09090973d7fa3547ac9abad733ad26
SHA1 288208206d11ae5965b900d28dfc37dc7eec035c
SHA512 3abc91ba41e66e6b42df0f0a375d97d91124adf285719d7fc2166480c363b0c2fa1813e735fd7415116b39c0bf3d06dc28c5c759a6c48ea3fde76f483141267a
SSDEEP 24576:BwuROWQ+4ZAgayjhwbmY3MaReFeDvSP3b:BwSOD+tgauhwbR3P8wT8
TLSH
T1F985F14673A80CF9E9674238C6978532F7F2BC422A21D71F57A0C75B5F73261AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 20fdffbfb99fbcc343ebabed1a8154574e899cba3bf00cb59fe377860b6028aa
MD5 6e9d0d5e674580796f077c5b7167fa71
SHA1 0d24f063b3184864f12cf816f92a963465a2305f
SHA512 212e5d66e980b9b785f955290f47dfbacc99b416da2be2738297c010dc5378f303ac754641ff45a8822b6c491248c25b823e5832b875ecd834352ec1f5154313
SSDEEP 12288:TyZ1IyCeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:+ZuO+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E8751285239860F9D1A7033CCEF60A10E7B2BC922B7243CF9595679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 58a8e939b96ccd24a8b09d1218d3cc0fa469d663d8d0fb3324f804bf7d70fdc6
MD5 65b52c927b763e91b73a2ffa19e79e2b
SHA1 fe0c36e35a83232ed8b58dfba5d5e7dc718bc8b6
SHA512 19d8e46578337ac06909407b4bb1d357174e2c7053c1ff692f1de78ee22cdcfd3d4282f1679462a67d18aed983dccab719d3b7c47ea03d83f467b11ca4639957
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:uQRQyi36YOcPDLvw2gAf+PN3sgaPJ
TLSH
T100667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0ec49511687856bcbd875b56962f6adef71f8cfe7a3bd9a9614a9685579ac09e
MD5 4b4a981c2b42a914c9febec064ea0d21
SHA1 b081d606962aa07c329ce2889df48f585578d85a
SHA512 3e9551e8f4f7cd1e106133c786b49dfe476753b320ae03e52ca73819059db60bfa5448413ab0ed948f1d2be085b901725190611f02ac3cda9d1218a20253359a
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:qQRQyi36YOcPDLvw2gAf+PN3sgaPJ
TLSH
T1E4667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f37dccf4d9be39f3df143f06dcda9bbbb604be29f966e91a16471ae61f50ab2e
MD5 289841d67c238057eed93b195046f80a
SHA1 e8bb137eb531bd037bebd55e26e5717ba9a88936
SHA512 d91929bdb8633c2c671eed7713192add39f54c7fa476c800376a16c9b57c027173178d0a9ebc0d995692da1f3d9bb9ff82763e37a9af7c6da3769984d429d70c
SSDEEP 49152:168Qg55nhkeWu7PNU3/X+tgauhwbR3P8wT8:DthTRc/KgaPJ
TLSH
T11AB54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ef066c24386d3aa4bb4582e0143032376cb273e1efac084229e125e5d2a305f7
MD5 246411954c992fcf7e11468b8b5ea6e3
SHA1 be88237765f63efcf9391ad312cf0aff164a78d6
SHA512 f4ecf8e0ef531c6e5f417bfdaf81ccdadf5b1594ddb0fa223ad978b9ac6ff93ce3e31d634338be362e01a303549824dcb9b8db691f89709f02a3d22a1fced380
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk995:Qy5112gYy5azzVvU69nLKnhZVgaPJ
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d144a8551ace95f15c9796ab6ed8655ca068b006b5a985dcdbc4b44fb5d65dec
MD5 9503fb0b29aee70df572e37bb7f93ce5
SHA1 d727418d5fef339953d58f5802926ebc42c451d0
SHA512 2406517b2d7f0f78a3a534f9cb095e19078ed01afa8c45a03f614bb8c3956fa52bd073b965a0e716bce893ed0a868838a9fe35be14021904a02f74d350f4ec2d
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glC+tgauhwbR3P8wT8:7u6JmIxd2dFgaPJ
TLSH
T1B2D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5f6cdf2e81b45dde14fdab192d68fc58c0c38bccc6d2aa9ce12b1aa6ca8a7bf4
MD5 ea8ce53da99c97403484e72a79e534b1
SHA1 cca6214e2d8ec5c2a71e0a3f21594c70439ed1c3
SHA512 2d1bfbce11e9b358396a31deff9bf312573458354d9a14a9a46fc53735f5779f6fd24f6462d2012f907ff895318cf592d3ebdedc34623404eb654a653a23da0a
SSDEEP 49152:s1hpsNoJpF1A67U44CwH7R4xl+tgauhwbR3P8wT8:smifPqRfgaPJ
TLSH
T1A0B5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 65f5cac08a696d6fa5896ed4191baefdb362115e77fc66465e1a4d31f4ef56d5
MD5 d72204baa7bd5fe1fd44f018c687610c
SHA1 95a633992176f2824e642515f9db75654eeb8e71
SHA512 242ff414c5bfaceb3165b7d70cfa1e581dd9f1c586c2ca90b04cf477417d675d38f902d85592da25390a3e42bf156289f15ea444ea8090cfa09a8190ea29ee3b
SSDEEP 49152:qSuZQIY0Be2KkRVtOnks6NMHqO+tgauhwbR3P8wT8:05dKqi61hgaPJ
TLSH
T1B4C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a39ad15f47423e082b993f3bf866cc713c2feb2097570af925706a0e3016538
MD5 b2276d3c78da258df0c68f42f2df84cc
SHA1 cda5958428551587368391bf012079cd3434e7c7
SHA512 70aefda863c8febc9e9d9e861f39853ee3bdcf20617eee0925ea070ea604f695059d8d25edf772c5c282ff952893d0466df72df90a7ba9f30384fa167c249c46
SSDEEP 49152:PhtSn8EApI0figjgiDn0AP5wR+tgauhwbR3P8wT8:eX2iWphTgaPJ
TLSH
T1DC95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 46d310053c4f2d43e942c16453d0f37456759af1e3bc50950b9b7fe3290fbafc
MD5 68a8d509323e5377a75354632d84bdaf
SHA1 aec611c89120d99317c6117c6a4f2191c5b80952
SHA512 7bea4a1799e195f0b772dc4c4a79565962652b4fb45236e69a18507315e1c67caed9267725e1507d58932047e711d43e53f7f5192054c3caff5154646a9abf08
SSDEEP 12288:6jeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:6a+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BA652381D24C88CEC52B07758B6A0A60A69DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5e73b45ece5239c98cdabe0e22fb51fef224573321896d78bda69be3f444146b
MD5 d6f1c6843cfe6c9b82c23dbafd216ef1
SHA1 ce731cf418fdf9e8e53d5197eea118c7049b65f2
SHA512 1b5ff5e3be13d8090546f315fdb5383f644d9824d808b51580267497da4e371ce0be0c0c4757102eb45468b0542f64562e2ead9b1507c980da6717853174989d
SSDEEP 12288:YeeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Yj+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19F652381E24C88CEC52B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD86B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 6bd3ac908f4ddfa09822f9ab575dfa0028f18be06c23e96ae094fd6ff629640c
MD5 c9fd59ece0ad73b9938420002617b22e
SHA1 3f5eb1611e84bd1ec670c18ef4e59b1b6a0f612c
SHA512 64bc73ff59411814cbc78c730cecf8cffd6657a10e8b502e7ff8ece23546ab905c21330aad91778d04392d39a352a96fea942b2eb3cc4384efdf6cd100ff905d
SSDEEP 12288:zMeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:zN+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T163652380D24C88CEC52B07758B6B0A60A699AFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 424e63775b70da855b8e37f639e46e853f154ad3ad039aa3962c95d5795089de
MD5 59d858e7925f6f98a9318e3e5f1e58e0
SHA1 41ecfc3c1373abfc87ba08e751a22e2baa850017
SHA512 d3957ad8bd9db9c18c6bae084f6331a4bd4db8ab6a37572895c1a957281b04725acb62bbff3e8813db677e829199051f67b4caffb06a2c31f9e0f28cef26f51a
SSDEEP 12288:pVBeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:g+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T17D652341A35C44CAC8774774CB760520E3E9BED66F62628FEA853B854DF0FE88A70794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 20a47371e11586e7ddb141b8f077887636cbd628f4c825b5354dd3f00cf5864c
MD5 c6fe9280bd02713abd249804c14467fa
SHA1 aa1ebfe85798a5a9644746000d41efeab0a814ff
SHA512 abc1eb18563c3fd4f25cdf9f734dd08a7007e1d7580778472c16a003293b937d4cb51bd0e05e02973dc18035dab9f33b6f50bb2391627b8d11133e02b6a5fb5c
SSDEEP 12288:H5eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Hk+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T124652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e8db72daaceb6f801114a9c21200269a7de5d7c02605aa66550824a0c3be854e
MD5 8aa32fdb6859f75157bb6cdda9dd3bd9
SHA1 067a4f0ace077de4d77c4320c8133bf4982718a6
SHA512 a7aef0d2e6e25919a1173b1a617203cdad627ef0ef8a80a7f93059ef85d196ddc33f18f3aa17eb49860a56c04ae9694be41d104eb13ef6e538aad68e74db9414
SSDEEP 12288:DaeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:DP+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T12D652381D24C88CEC52B07758B6A0960A699AFC73E866144F9CE7785CDF0DFD86B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ecd7b618d43c16607b332776ac1a5353184250d641dcdcc6820310e3dbc1e35a
MD5 bbb8b659dfd2b2aafa2921584fee9c9f
SHA1 2f64773309cff525769655e7c8ae4ef11aa405f4
SHA512 6f3b7fd1ac65abaf637d85dec6ea046ef957f784543472700d2f5e4b8de671698db97be3dcd46a564dae85b9a552d63b0b86df6458d7e22d325a3fe81a07ae71
SSDEEP 12288:PWeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Pb+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T180652380D24C88CEC52B07758B6A09606699BFC77E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a7dedee2adef2a33a85709a9aeefcbdb84b966853994a9c50322ed99e4dd2286
MD5 9ccc87c5312ed2d8017328ab5f1fa1fb
SHA1 3b4beb0420fa8923e8a72aee70aeec7201725050
SHA512 fe9629e2711998c43ccfdb057535bbf0dea03716201a2aaad7587a748b7f06822318ae0f63239f929217250969f074399c9201bc8a83af71d5775c3d58ac6270
SSDEEP 24576:EZM3zFVSOD+4ZAgayjhwbmY3MaReFeDvSP3b:EZM3zff+tgauhwbR3P8wT8
TLSH
T10A850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f0b3d3104359317c6cba7cf13b3496ce43984cab98016cdf95799455838c090c
MD5 7cd72604cc978cce35906ecab527eab2
SHA1 437fb6b429d4523b25dfff17034494d495eb30b2
SHA512 3ca4547891a857e314d9a70eb8b2af071d72815f09b22ceb9774cd3414d97936cb293e2151084937666449fff0ef1d4ffb6d624e3edf25df96993b968fe0b3db
SSDEEP 12288:+neH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:+e+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T190652381D24C88CEC52B07758B6A0A60A69DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c86296ba39f7aa786e27f3e34a3a33943ec8da09fa084406e2234dc856223efe
MD5 8610c8d7788cad710c3b9ae637ae9faa
SHA1 e6d237993b102c47d28c6eff94e4f38b81d2ca90
SHA512 3d96a14c9afbbab9e87c76795f88bce97573581845b6236bf850779670162e5fe2eb18e9947af4ae29f3767475f7d99d808259189f108b7d2b4c2fe6afa72c8f
SSDEEP 12288:3reH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:3i+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T196652381D24C88CEC52B07758B6A0960A69DAFC73E866144F9CE7785CDF0DFD86A13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d3ed3dd67c7ae786732f09bd8b4babca720daab5b615288059972b70635bf7f6
MD5 d91c49666f1324965ac81656ba58f851
SHA1 5a140f6a9372bbe814c6e668fa009919f2e31570
SHA512 8aa002aad30a538818b0ff8b4c4514e74ea7b47ca1a2fc2ebb97bf0531885c7f274b0bb99d5246971e45fa9e53bdb05f7c89a1b125b53f38dc3f14955dc3a9b1
SSDEEP 12288:kyPz5L8CeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9zy3+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B675124773A430FDC1374238CA620A11F776BC721B609A9F579417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 12548a11ad59928cce7b9abbf9616c64294a7bc408e8f532f6432ea3710ef6cb
MD5 880f7bee01c0c1ea56424a8e9fe2936a
SHA1 929abc8e6e5097ad3a1aae3e5adf6c5a373dbb7f
SHA512 0c6acf4de2af66533574e69ac472943699e78d314ab4fa2dcf0639fb893784e096b62156332ab4b54b46b8f2dfcd956b1778b8cabd608a5a1db78449d04e4bb1
SSDEEP 12288:yneH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:ye+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T103652381D24C88CEC52B07758B6A0A60A69DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 c4f01d47b32bdfa43f6da73fa340dcfd9e2ad0db7603ca0f1ab10cc68a04f42a
MD5 161e8b824c38474e682beba0de716bf8
SHA1 cd0064a8cccaeed52fbe0a363318115158e48b80
SHA512 879182da19542798d27da73d6395378c082080d52bf64eebb1c6e1e8dfce634de1f59fc68ce0b3ab8e8e7ffa615cc3b37db9d069a9299d292b23d3406936a3de
SSDEEP 12288:AneH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Ae+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T121652381D24C88CEC52B07758B6A0A60A69DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 08232c81d3821878bff30f9bcfa8ccf77829412048d81bd6bb3a18c1994216fe
MD5 7180364df4b582d20fe7fa932fd2ea40
SHA1 1dcf75b76752afdde6ba582a7d6c25b357615f48
SHA512 5d59130dba7c7c1327d9da6e2ef5f524a4036b8605eae344599099eaa029a843f7187dd6b61963e91aa25e341831eafaab13e4f11c29f768ddc7b4b9ef41e74b
SSDEEP 12288:1yPz5L8CeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:czy3+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1AA75124773A430FDC1374238CA620A11F776BC721B609A9F979417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 23fd9a097147a3a86bf8c51a3971fce5bcd4864b4e662fe34d6270d9a0182ca0
MD5 013d695a69231c1b78fc31566ff23f67
SHA1 d7aaa6ebaf3b5b67475752a3e1a4b70297d0d467
SHA512 c8376066b5fa5d79d210bf69e65ea0e206f3fa0f7df535472b09c5dc800cdc7739be7b4fe43f01300dc3326d54500e286ccb9b985c96a58b739c0855dcf475f3
SSDEEP 24576:GT8aLl3z0zD9+4ZAgayjhwbmY3MaReFeDvSP3b:GT7Llj4+tgauhwbR3P8wT8
TLSH
T1AA850194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 8a9f9582849d6c3134a3e773bcf021ec9e996f9bff5a8e670c05799a9d9e4f73
MD5 63f6d7ff19c972ec4d31f15bd5c8174a
SHA1 e83270d135a2c651f05ef477aa3f15372faeb713
SHA512 73e9d2b5cf2738a5d9c859c6b9e8708a2f7af5937762fe93c742d007b805998df3937378b98bc38e28c32384d8cadf7d7f934da599b44153fd7244d836303e2c
SSDEEP 24576:c3rd9CHKy7GZZ+4ZAgayjhwbmY3MaReFeDvSP3b:Grd9CHKyaf+tgauhwbR3P8wT8
TLSH
T1DA95CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c50e657e83399b46b460e4f557a8269723f7206fb6f0302e7ac48c9fc7deb43e
MD5 dd799947b93580018ba5f929a01b3ac5
SHA1 0bfd912624204e954ce32892bdb4fe6799862900
SHA512 d8218b8a71c55a5c5022727cca984e3f0dbf4d5fb43b8a2e5056d0c1cd8dd4393f1862ccda44df6032f116e8bcbf598ed3b4dd19a3646178e34a017f08cff5f6
SSDEEP 12288:VseH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Vt+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T175652380D25C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b5a08b1ca6bafbd7920d62fdf6be2d9b037308d6dbb17d1b2db23f153f880184
MD5 c9573101b84a1532a93384a7b0c20841
SHA1 15ce7133908f9c195bfdaac0329c53af8e24a7f3
SHA512 2c1f2fdd16cd2efea3ec9617565914e27ab801db7be45ebb17e5a7210ed349053ca2b9682e7db9b9d6a03292b4b4bb35bab1ed800e89b85825e8faf0b26b8232
SSDEEP 12288:qieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:qX+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T182652380D25C88CEC52B07758B7B0A606699BFC73E866144F9CE7785CDF0DAD86B1398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 46529c2bce3845d4940a795bd9412aba6b80bae53d4a60003fe6fcece5fb5401
MD5 e6aa1563d4e93d55707a5a9e751d583b
SHA1 49fad787ae14fc75f8cd3ea45db6a3cc9f7c104e
SHA512 94a5feb8af9a06ee9ff6cb37b935f6055452508ff076c16a55258d67d126ea2dec5e1641ca28fe61ecc674be31a57addd0aebb5d6aea9481ddc674e174e33558
SSDEEP 12288:0VeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:0w+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1FB652381D24C88CEC52B07758B6A0A60A699BFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 03b16c7b27ca615c440fc1eee9ba0efeac883239235812e0af9cea94778e503a
MD5 2e24d3a1c71cced53cd9eb64e64b0318
SHA1 56ea9460afbea9fd06c5d177b164acd7d8a69ff0
SHA512 c8aa4b59ba1b908a43601527c67c0a125c6f1f8b475d9ecb1b59979ecf2979572007198b72575dde035c071055b9016259a4f4ab1a9dee5466bcb2061a916392
SSDEEP 12288:KneH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Ke+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T11E652381D24C88CEC52B07758B6A0A60669DAFC73E866144F9CE7785CDF0DED86B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-10-24_014518_4888-3692.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-24_014518_4888-3692.log
Size 1KB
SHA256 7840fd6d2fae6783c14fc582e702f671943cfe863dec17bfca05f4aa9b13c38c
MD5 e125a2d60a7f3262d4880e981e1b8c8b
SHA1 13cbb3c4db583b8998baa38af5fdb7d60c0313c0
SHA512 47aacb4b28f9946f8fd3e348e9c2d8216aaa65d907fde2a5532d949a47b9be64e9de0e229e1a5c8b2926bb1c8fdb5e1bbbb900dfd4abce8396f63874d40fd719
TLSH
T1F52184196BD40A06FEF7DAC298FA11539E3539922C34D95D00A4434E4971F45EEB472B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 c290347cf42c9749a37bac2acd9d3167cf995349fd96fe248fb83c218cbbf435
MD5 4642629464e97995d74690643f5674de
SHA1 a1fb39975c9ee46558fad2bb8d0790a6f3aeb788
SHA512 0424ee4fee80111fd0ac5bceeec542a752dbccdb8c859b9df62f77a307954a8bf6e20255fc69ecd051bc8ac22e476997924fdd08828a3d8d122e08dba65ec81d
SSDEEP 24576:Wfwvzk9RX6wkyAIy+4ZAgayjhwbmY3MaReFeDvSP3b:FMnYIy+tgauhwbR3P8wT8
TLSH
T1A895CF29EBDC44E5E1B7923C89B74606F6B178591B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c6efb212ddcf82f2853813f5ddadcd042c5d63bbbc7e545d0fc656e70a41c8ae
MD5 52bd4786586ca4f00950e560015e6605
SHA1 046e2fc4b5b729b8a68bdf376efce236c5303fbe
SHA512 5c96d1f1171d3d01f9177610d54c19b8b5494a3b2af51d0c3dbf784fbf286814b2d8db21dc4d4d655a2153f2ab7fb262572ef20a62a193fd2f484a739dff08f9
SSDEEP 49152:jYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0x+tgauhwbR3P+:OySzPMgaPJ
TLSH
T1DD066C96A16801D9C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 63a9ca230ced13d3daa637b24c4ec78b3e41c89b0f738331a5cdbccf5a508c93
MD5 2f3e95e14f840c257751382d89d6b0f5
SHA1 0ba05e8cbedbc9ee99a3bf3913018c08bd29a406
SHA512 68a7ee36252cbea3969f199dff8c19ad13509563ca9eec385b2d1d9a16d6a2478bafed2c98cabe9918068a390959e71e84044d7f112124f7ab36c565a2eb7f5b
SSDEEP 24576:O47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYT+4ZAgayjhwbmY3MaReFeDvSP3b:O47JUQjqirIhCnDHUPfF/B+tgauhwbRG
TLSH
T10B65AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 4dfae4a2271725897fa9fd05acaa73551cd37e46964f50b0d4e3cfa49b45e4b2
MD5 05d892ca692df9ba640841ea1dd590b1
SHA1 6af9a7a3a8ce988f9c266cb54b77350a1d71d14d
SHA512 3aa3cec03a2594de02a733e83c55ca56ee5689aba775e6f8f4fcdf39983be255bddaafc9eed9a78811938635b0db05559d469aeb82450f687f22ea28f7b2e5b5
SSDEEP 12288:cpsf3eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9O+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T17975F149D29801D8C06E1275CB564A40B3777C6697E2D3CBA6C0F67E0FB1AD48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5045d2dbb1c43e68acae25463879f3106069a601a2a9fd8f9e99b57381ba399b
MD5 d4d215aa07114eb8fc16315f94eed3c7
SHA1 edd57652c2c7b5e49d2c079bf1878eda9d98f4b0
SHA512 3c40554469c8b22c1369f42406ce4620b9f81c57fa7002ede5b2a80bdee70a7ea22af674a5450d790a826f1ef07f804ec98a548af44ee4032b39501b8bf2b766
SSDEEP 12288:EUCJLU3fB75Vq7LGeMwQQznrdKghHUVsMPrtHb4EbEteH7Ak0I:EUgLUPyLGeEWrdcVf1fEYcr
TLSH
T1033529107666DB4FC66940321E33D1CCAB707D41EE45AB0373CA8B3FD576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 61cbb04034fe5672a040ad7a425d0da6aaa70202d970662b0fe74b9ef2daae9a
MD5 390783f93820a6289f218f69a604d137
SHA1 dd1414178f6b6a81b13c25eb1fc12c47db746eec
SHA512 28ec758a80c2fc1a08d7c85f16c5ec7893dcaad7cf635050c818bafd44926cd214827476cc3071d9bb7a97ea054c1de37d8ce45de09c92f86894700f65201a93
SSDEEP 6144:lx22A01xIlg5C/wWgqSqicpxoUKy+tMxpeH7RFGYyNaFGaSl8yOFGCSlvqasy+tN:6oUwWVvSRFGYyNaFGaSl8yOFGCSl9s
TLSH
T13E45A6805437E78FC5BA6032072B5B4C7BA4DC5677496F22B3C9453AD82BB12A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 becab19ea4af6cd14067f739c23154d9e8779d648d408713909f64a1a5eb60c9
MD5 d42ab3eebac851f56c9fc2f0c53bdffd
SHA1 8aa4353b1804366976047dbbeeccdc4ad4033a80
SHA512 d36e171eac8089cf05f5431595377137cea9030b7c56494bdfb15e9176793ee133b33072b18a13f9d3da280d5411bb0a3a78a9125e5d131964893a9ab6d13ac0
SSDEEP 12288:8M7PeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:dm+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T115652351D34C888AC97B07708B6E4930765EBF962F41A1C7F58977C58CB0DE88EB1399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3f3f90349f92745e6759a560dd9a5b81ffa0d29d3049f2024115b8d84626164
MD5 3b014473c44f627e0bdaa11b90d2e232
SHA1 edd9f90428fef85097d548cd71028871d3fe6c91
SHA512 b322ce61d63c03f455604dbed5435905b1986d2137cae3929ff72e27bd1023b17e9339bd7658be725123453d15f50fec79b96b40ebadc369d7153865d31820c9
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bY4+4ZAgayjhwbmY3MaReFeDvSP3b:Agb4mBIBhGFT+tgauhwbR3P8wT8
TLSH
T12365AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 aea3617c7891f0ea1553f8ad60e0fbf47ed6f7bb972e2685cdc3b63efdfb16a2
MD5 c38868c3838b75cb9f0d0f151c98848e
SHA1 df4f1877735fe0fa686d19469fdbfa9741125698
SHA512 f2dbce39ba9f4e86f245b25b76482d2c64a804ad55e27a15addf208948ffc30cdbd6f05b496a4efa5e11866896c43f500620c65f732fb3199e9d2b51ae201c85
SSDEEP 24576:MGyaKngL2jdshRTdG1YxITqvfPkbIcbjLm:MGyarSj8RoTCCW
TLSH
T1E305237EA7C566A4C43A977429B6A84A3CF33768970A46DF4CE0957C4F6A7E0363CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e821a42a7df0d47ee1ca9f83f6c1ad695b026683ed29ac2181a1876abdd0c8d7
MD5 8b7c0a365a5db485c35b463b204a41c6
SHA1 749fb3c6202f1a320073d46443ca5541f88aa436
SHA512 9581b953ee9f2375e41e3f697a2dc27d4d09802be0bfb90a3a4053c6053385202b1d4c9e05b72d15c5f7a8c549db53996984246d9e6c513186ba74ddd7c3ea31
SSDEEP 24576:4G88u8FpJqH1vzria7/mD+4ZAgayjhwbmY3MaReFeDvSP3b:77ZFPqVya7/Q+tgauhwbR3P8wT8
TLSH
T15495F16577E401F0D47BD1388A864663F6B2B8250364EBDF06AC8B511F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 aebc280ec08bdc16abf8d305b3e03454d378ad681f3df1af3f9e0d337e80664b
MD5 4714d7956a201273ebb25185bdfe0424
SHA1 429cb7315a94a204e83a288bb8c7bc08951033f1
SHA512 4ddcdcfc769efe6d5c3992e716c47629597e27cea749b2f164274d5b775b02fdd1201745c7640e9e64181dcebcb037b830d226230f9f5e5fa0ce4eb06cc0a437
SSDEEP 24576:RPUr+NQU+4ZAgayjhwbmY3MaReFeDvSP3b:RJQU+tgauhwbR3P8wT8
TLSH
T1DA85F11F62AC18E5E67BA17C8A864715F771BC621712D2CF02D0917E4E73EE8AD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2458d03d23a5e726ec8dda45969e3294d3bb622c42bc64a0e44ddecbba3aab4c
MD5 cda1a7485dbaa93fc1f263a05279d265
SHA1 e10db3605388743966167083a5fdb92188196a50
SHA512 9cf3dda5f91fc6e642e593b40b1b727f4182d399c8dd1342337ed776f26315b52fd70a6af5172d53e380d4814a7ec2b7269b91037e3538357f53ba8cd5001c52
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjP+tgauhwbR3P8wT8:eG05lO43bdgaPJ
TLSH
T11FD5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 75c8edb886ee3d556a460bca0f2ff6919a49663f0e6b6f3392ccea0011f7a15a
MD5 0214b9796530b3bd21bfdf3ac6a7b167
SHA1 cf91bc921ab0a4ac6c99e11f8917cc84b30e141c
SHA512 724d827040d1d8ef8b3f59f0954468e444b93ae8f57294d4fb2f70d49d8d226ce61c6f354a597fce1adbe015b2fa47ac30b5b661156b0aebe7b0d20f5ccc084a
SSDEEP 24576:Vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnx+4ZAgayjhwbmY3MaReFeDvSP3b:1a5POZ3lJt2pasx2+mX+tgauhwbR3P8z
TLSH
T1C765AE5EA6FC00D5D579D17DC6834616F5B1382253329ACB122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 40e1fce3fc4717aa46d4dd0abff43b2d460cef92540d7cab5748aeab8099c701
MD5 ac62304120afb13d121dcb385b1db575
SHA1 52695418ef62c73849c4df574c017cb7ee4aa2bf
SHA512 d614a1c25533abe92b5e5ee4ea15209b0d65346c35bf9972335d8924e8c5df510f58403db5ed6f70f2bda04b42a0142af4a7ef6a87a41267c168b3874add100f
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkL+4ZAgayjhwbmY3MaReFeDvSP3b:rNc/zEOVHFw+tgauhwbR3P8wT8
TLSH
T18B858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 53481370a460c8badd8c54c7d2ea7a886bb9721c68ddc55f40aa150e5a52041a
MD5 a8d536bd267d0e6629c60f80ba1c7197
SHA1 bb91515ffa03be4bbc738ebbea2097c8a2977e83
SHA512 1015c1d001a5c4f9b6e1cebcad8c12180f081998af3ac38ca3fa573a3961d07011d225ec55dfa25afc3bbbdf744379092fec4c72b5440e60e2b7e96e3626e3c1
SSDEEP 24576:T6DIWaKngL2jdshRTdG1YxITqvfPkbIcbjLm:T6DIWarSj8RoTCCW
TLSH
T18B25126D63AA01F4D06BE13D96934505E5B2B6B483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 6cfabf2663457b201ab398de9b79c978c739377601ebd9d455421a96cd79a711
MD5 ed90aaa478e02b78a66c38b6eb3947d3
SHA1 4ea9ec60c2278d60be44a9065c9ad3a3eb336b07
SHA512 8f0e55049cd91031e9f2a7a3e8bab78e9e4a7221d5be12534a3d9e8cb88738c20a22b93159e41edefe144e1278efe9e6f391d3586ab4d02f23009c705c5e8648
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmpaKngL2jdshRTdG1YxITqvfPkbIcbjLm:wTMwBtOmparSj8RoTCCW
TLSH
T19B75BF6EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 b6dcc9cc7802df05dabad5b8b9aadcc6f0946648be44f0fdcf299ecea75d4da1
MD5 1d4f270fddad476b509f78a6af174a80
SHA1 8037656ab0b987faca0257adeac0dfe185c1f88e
SHA512 f97ce02a06822a2614d84c331b24dd1be71ba86aadafd87ab46077cb4be319c914e8a1686a12881c79640d02ef905b78db3a1bee6c22dd68bfdfbf548adf409c
SSDEEP 24576:JD3FHshBIYQgA6+4ZAgayjhwbmY3MaReFeDvSP3b:JDVHeBIAA6+tgauhwbR3P8wT8
TLSH
T1E495E17DE69C04E4D57BC2BCCA634A02E77138A9032266CB12D491BA5F77EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-101-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/204-331-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/204-107-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/204-102-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/1204-338-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1204-166-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1204-172-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1204-165-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2428-422-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2428-365-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2428-371-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2428-372-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2516-47-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2516-58-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/2516-60-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2516-54-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/2516-48-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/2784-318-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/2784-98-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2784-92-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2784-90-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/2868-351-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2868-119-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2868-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2868-113-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2868-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2868-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3764-334-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3764-125-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3764-131-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3764-124-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3764-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4352-41-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4352-35-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4352-148-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4352-42-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4352-34-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4676-349-0x000001F253D80000-0x000001F253F4A000-memory.dmp

Download

memory/4732-144-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4732-137-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/4732-138-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4732-337-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/4888-110-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4888-13-0x0000000002ED0000-0x0000000002F30000-memory.dmp

Download

memory/4888-6-0x00000000020C0000-0x0000000002143000-memory.dmp

Download

memory/4888-8-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4888-21-0x0000000002ED0000-0x0000000002F30000-memory.dmp

Download

memory/4888-0-0x00000000020C0000-0x0000000002143000-memory.dmp

Download

memory/4888-78-0x0000000002ED0000-0x0000000002F30000-memory.dmp

Download

memory/4888-76-0x00000000020C0000-0x0000000002143000-memory.dmp

Download

memory/5680-69-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5680-63-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5680-62-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/5680-302-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/6068-150-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6068-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6068-156-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6068-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6068-158-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download