6d9e6cf5d1b6a410706a42f8f4b3e900ce75cb6798af6bbbf0cea0d8f21ac152

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Size 2.9MB
Sample261026-rn6dbaxshx
SHA256 6d9e6cf5d1b6a410706a42f8f4b3e900ce75cb6798af6bbbf0cea0d8f21ac152
MD5 bb7e6e6fc8159935dff9a01b56554d60
SHA1 e7b2de5dca0f18e6df9cd87018ee3ea919cabc12
SHA512 b439fb27db1ad736ed07fcb26dd0c0356a8f32b8464871ad92a7fa9025981c894a99aa8b6b717ab9a6f39908267683684daec36273cabbb016b6fbcf50f18c60
SSDEEP 24576:XKlYNlCRZoHjto1GFxlXutIs1WZX5ARLvM3yReRdqmCAzxj884koHjto1GFxlXuj:XKYNlCMT/M+wEyMRYmJzxj8Z9T/M+w
TLSH
T1C4E52362A5E120D6F37291304A931AC2E973B41A27F4779B07A0BF255F370E17DB6E81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5460	elevation_service.exe
3244	elevation_service.exe
4144	maintenanceservice.exe
2900	OSE.EXE
3492	PerceptionSimulationService.exe
4368	perfhost.exe
120	ReFsDedupSvc.exe
2268	SensorDataService.exe
2020	ssh-agent.exe
5620	AgentService.exe
3880	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5b6ffe1cc17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/492-0-0x0000000140000000-0x00000001402F1000-memory.dmp	upx
behavioral2/memory/492-228-0x0000000140000000-0x00000001402F1000-memory.dmp	upx
behavioral2/memory/492-75-0x0000000140000000-0x00000001402F1000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cac60935565dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	492	2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	5620	AgentService.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: 33	3880	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3880	SearchIndexer.exe
Token: SeDebugPrivilege	5460	elevation_service.exe
Token: SeDebugPrivilege	3244	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 5780	3880	SearchIndexer.exe	101
PID 3880 wrote to memory of 4556	3880	SearchIndexer.exe	102
PID 3880 wrote to memory of 2480	3880	SearchIndexer.exe	103
PID 3880 wrote to memory of 2304	3880	SearchIndexer.exe	104
PID 3880 wrote to memory of 5144	3880	SearchIndexer.exe	106
PID 3880 wrote to memory of 1084	3880	SearchIndexer.exe	107
PID 3880 wrote to memory of 4396	3880	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bb7e6e6fc8159935dff9a01b56554d60_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4144

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4368

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:120

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5620

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 480fb868e8759eb877becd06d3f6fe5a8e7e52cebb465c41e5a0797117b582bb
MD5 d389864bb02658ebab677bbb16c1dbfb
SHA1 ed56d90919dba0755ce67f791cad730f9732c48e
SHA512 e17b5914bee85c699385f45bf38587a82185a61fb10ea559938816eb6365d953b01f79263252ce1542c62b5aea32b2f004bf6cb2f4c1873e67f2b843a6bbed00
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWT/M+w:B3q6HjBPw
TLSH
T195D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 fea40e3509883823904ff1f2a91f6db857c568af26300da44e5d75ec675b252d
MD5 96850bf1d376c6d0f4e8c489508978fc
SHA1 d810eb7b91642ca51fdea0ab7a15d7193413ab58
SHA512 9bea5dca672f566726ce60a49fc1d67c65cc48de4973afb0ac68359c1c6814d309937c6dfe85ec8489292ef830525660dc8424b7525019f0ede861a605cb0d56
SSDEEP 24576:XXYfDtczAOoHjto1GFxlXutIs1WZX5AR:CtcYT/M+w
TLSH
T1A485F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 62f0e29c25f0475b602e429204ee8ee02c2a3b696c748e0b85a0e7dea8f0a9f4
MD5 2a1936b08731cb4b86c5916a7ed3ef48
SHA1 c2606b9265489bb54da295235f6614bf19127e3f
SHA512 a44afcd7b1375d9818e3ebbc11d544477da2ca6d55d8c555fe11aaf9a0602670741fc1ab63cd572a79e648651e77884169f32fe4139ba1395079fdf723a9464c
SSDEEP 24576:i0Le5ji0hmxIrMNoHjto1GFxlXutIs1WZX5AR:iPji0AG1T/M+w
TLSH
T12D959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6f9b25913a7dca828261bf92fbc25378998b2635bc5272e96366b853ef7859d5
MD5 e430d1c3f431a4c0cf1320fbff78dbc5
SHA1 d7717e7779adae30e8f6bfc1a7cd7f0ed1895989
SHA512 50cb9fcda2d92e056840b593a02d401891471018a7f9c4dad9779f1a1dfe1099086992b8ddff475fb182551d455f4f341a557596d02ba34c0d41126a7b91575f
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyunoHjto1GFxlXutIs1WZX5AR:q/ezSC6vUzPvxHjyBT/M+w
TLSH
T17E756C25F5788323D0B2D0BAC5D7BA99FE7230465B3089CB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 278d05dcfc5bcfb461057a9ff69050ebe294969308e62e1798b6bffcba0f1bf3
MD5 00537cf58fda7cdbb5201c7c0f31b1df
SHA1 b5e7eb16b8b7931098a6df68552451a3d2488e5c
SHA512 cc06d961e89e9226348a003cff93765173c2177d3aa47c74c28de70b5068b626c436d4d9b1f50a2b934ad3abfc04debfdc9c473d3d07ae5eb9df7736cc2152fc
SSDEEP 24576:JVbqPb88hv/l+6KoHjto1GFxlXutIs1WZX5AR:JVO88hXl+qT/M+w
TLSH
T141559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 deb87cc76dc36ca43872c0ba042edea8007887302cf3de2f42cbedc4e749119c
MD5 1e47dfd18f1f6ce3b48840f306ae3bac
SHA1 9016bf196dba87936680b9c0a8abcb67f9f66f06
SHA512 b2499ceefb9d01f61395fd56cb37209389c745f6a57c26cb75467732e7953bbbf93404e4f4c59fa532fac007d6176b80d0cc0b69c7f2e2020a26ca6f4deaaa64
SSDEEP 12288:2HvhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYDN:2HpoHjto1GFxlXutIs1WZX5AR+N
TLSH
T1BF65236399F250D7F77A11B029D77A61ECB7BB06094824BB4B50FE190E3C060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 907842cb0394716672487c210d002464ef68053fb978ca3061fced567ba583a7
MD5 d4bd472238b16bbb31f20e8c3db6a6e2
SHA1 3e962ebbee2ef5139f01f6a2ebbe7d689da3d959
SHA512 9ec12ae98c8253c88ed77415a39ec2a035b9a1fa5778de935ad9ff16f33d3b70a0041026ba36a0f9952104d81b1b21cb66a97a6c957f3791bf1eed762b5b08fb
SSDEEP 12288:MeBNUbTVO86UAhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:MJIUyoHjto1GFxlXutIs1WZX5AR
TLSH
T10385CF3BEE38FCD2C27A5DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c14ea9112152852bced808ed44fd870c8a99a183f52f8f07e944e7da418fe991
MD5 80e1255d6371a36943b31e2d91427628
SHA1 1130abd386e3f4a5f95a22e13b2ccad77d150ff3
SHA512 7571b3fd3f8120e7aa3de62ec8f3b9afdd8b658c512f2c7f722602e64189bbb7520d445d158023ce47b4319463bbe30a03105523b097128931a0e90e15b3f9cb
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:5QvGAdlCEL8c/yRNw5Cyw
TLSH
T157266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 eaca46b3b309eaa26dba9e5b74cb37c21e1f3b8ae0f4537bbf0245ad807491f1
MD5 8890c7c64f0b615d352469a128ad21fd
SHA1 e00d282d5293b3f6e854d0ab138d44ee6dea10f5
SHA512 4afa99737fa28e07de53a1bfd15c7ce6f87a1f8fb387316e36bdb445fa228401439a0cb4c6a9d25181b34fafeb6205042de5a9edc8c943b525e165414342fbf7
SSDEEP 24576:V7ewsAjMoHjto1GFxlXutIs1WZX5ARoN:9ljFT/M+w
TLSH
T1D285E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bd260503a94490281cebf2f0f4f04f2711853d749ad9dc8d0529251a5bbb9cdf
MD5 78a0f20278366b5d0dc7e71566a5963e
SHA1 dd44871a0d81b9ba4e2b55cb0cae38f93ae11c63
SHA512 10403751e87c12e3a6a8649d516391b75792df9bbbd153399b4636fe3a95819aa9d567c0a6bafe94e62e519ff44c184d69d508342d101dc2e9ced3526e58a9ce
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHa:hUEtQevvqc2W1cpV2EI32
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7413e805128c85872df84eccbef1175e5a332cae145a91ff2033391287bea8f0
MD5 6deb6d37cb85ea6a06a5958399cfc994
SHA1 80b2d1526a15bc7b57b0bc38e7efa4fed79387cd
SHA512 da11bcbe071bcb69764a4667d308c3501d32d464c6f772cb9fabf22e14262303e3d15c72068d0e610065fc72b308e92d7d4181a29ec959295019953ce76af36f
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zlT/M+w:VoqtVjnm2w
TLSH
T160D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 843139655384bb90598145a6abffceb64063074111004a5e6f01a631c5ff155e
MD5 7c02514e5cde553ce6e8fa2fff3e26f5
SHA1 e2fd0a931b95f5c343dc08560d2b8808692d5d8c
SHA512 ae91fde7ddcb01c12b03f026e10e3b3d41d39817bc6764098a9fb16b12e51166b12d370db1bd42e506725c35569eec4c3296da943daba6605327d9c91d8acbc2
SSDEEP 24576:HAhGLJIFoiwtA5l7S53roHjto1GFxlXutIs1WZX5AR:HAMyFoiq5ET/M+w
TLSH
T17E35AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a6f01d386513fe2e3ff10611696e1c611ba56bd9fc409ca620bf56c8bd8579b5
MD5 951128c52c2f1056bdf09576d01d5609
SHA1 1e53ee1b87091955f3389c934606095ad01472ac
SHA512 3554ccfe183ea9a5df0533a4db0a38522afee8caf1c8b253c906de037384829a25b55027656ac346a6a330642379851de26cfa1601570b82bf54b45718a7b904
SSDEEP 12288:lmw5HEjsChNDBFgl0WDm+CBhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:AwuiOWgoHjto1GFxlXutIs1WZX5AR
TLSH
T1C385F14676E50CF9E96741388597D536FBF3B8022A25D72F0760CA1B5F37220BE29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 549fc3905ec058f37e31fc276bd9e74ceeba5f145a771dfb819a494cd26cc97d
MD5 a799eb8f19f7767404525cba7ce2f084
SHA1 c4ce0087d700d7a481e1d211253a4bdeba81a37a
SHA512 f75a4a325f2f7faa41d3109b108716d547d7012ad72c48498bdadaf31054cccea3a2b9875b2f7cdfd8f04b36be85b3b23f7c24197e502dd65439db66f474ec67
SSDEEP 12288:RTZ1Iy2hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:dZu1oHjto1GFxlXutIs1WZX5AR
TLSH
T19B75125626F020FAE2A752789DE36A55EBB3B013173503DF07608A290F375D16E3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 89bf3953ebcfe82df27d127d0865495cbbca548c138250954236a0bf68552da6
MD5 797d5998fc0d96ed78f3fd52c3fd1002
SHA1 1a2f8b91518e2df4462a158029cad6df2be801ec
SHA512 b3c26e205a84cb5e942990e69950eb61fc0f28731042c903320ad0ca02f538dc09ea0045196d2fe4e02e80f911ba2678e0d01b19723ce3f7631e12acc52efa8a
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:IQRQyi36YOcPQLvw2gAf+PN37w
TLSH
T139667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1ebd4a45d3f4c0f30f62a24172f5eb1498c9896fe7d6b9cb6b92baadd9dff37a
MD5 680194ed2119d5f97a1449e98a73445b
SHA1 687c1774f324a13cc3ea92f627fb2bdb397268c6
SHA512 1c3e6b0550e1a836a37ee92d03ff926ade3b49bdb029a2730a4402083c7eb1455a6c96a81b46e9bf6af8dd8f6c5b4e44a9798501a5454bc02fa9ac112e8c39b9
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:SQRQyi36YOcPQLvw2gAf+PN37w
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 43899be1c4964148ca9767e4432fdd01edcf6c6ee1eac558f015179fc27ca3dd
MD5 ec161dd26f05877d052eb90f42d693ec
SHA1 42a21a87d4329f76f5dba499984c9c829914f88c
SHA512 61834a7d440175e197631cc2463d4fe1ae2bdee96f5ea456d66bab547e18a6cdb3c2f2d83b4b2bdf4f651e06555bfc3b85fe9eee901afdcb39c79ce45f85cdc2
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0FoHjto1GFxlXutx:b68Qg55nhheWu7PNU3/1T/M+w
TLSH
T127B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ee8b4bd2f422da8f46b0a82bd14bac14c27d9921fecc44ffe6873758937ba5c4
MD5 b4ce09c8bdcf2d71492e5ceacb1948c4
SHA1 f4569decdee4873d3719be028115db0873980f71
SHA512 125c7bed30f5a542113404ab7e250a6a324a1ae4742ea9961e39d462521ddfe20f54dcaead7ce67d3be49ec4e8d4c2b621d7d6b296f9872aff1dcf6c8ff32e30
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:Yy5112gYy5azzVvL69nLKnhZkw
TLSH
T1DA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a415f6625ee0fdab123c2ce6e862a5899b5d39cb9acf15bcec20a0b6f9148946
MD5 4b4e06e75a05bef0ff39e267bb4a7fb3
SHA1 c1cd7c078cc1a4aaa41ea6a8ffa939e412fa358a
SHA512 e5c86c66ed3020dc562f42a24d6385971cf9d2bf8cabd52e07f392f31148ccccaeb833aadcefeaef2a571d304bf5b7ce94c836dfd45a7891168e19905f27ff9a
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfT/M+w:Mu6JmVxd2dzw
TLSH
T17FD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6cfbd74c5529f9c45c8b50c16a455006abb9b7f3f24921877cd706bb4d904a3
MD5 7adf73d6e03b97fc0f26e64f10bafad4
SHA1 e858160e8fa6e98f928e676ec582320164aab7cb
SHA512 e70aa9b54b7a3a0e541c49543774cd5f9435dd756473ffce0e21fdb0a841292bea53369c7caa0edfba94cf4980f3ef3d8cca33d53aefbdd6a045a1d230ba7472
SSDEEP 24576:shv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3CoHjto1GFxlXutx:A1hpsNoJpF1A6UU44CwH7R4xrT/M+w
TLSH
T107B5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1c0574ab70a378407c9642f8c11abb9732a973b79453ad23a45e056a38e0d657
MD5 e51c8ad3b8cf3726ef30a899867f686b
SHA1 7b23fda7418bd3b5a805fe041e324a160c609c7a
SHA512 9ce4367e70dcc01b7ccc02e6f52a7e438c77927e9761deee098071e47c0efbc9becbfd58bdf021de910d3145d4baa515f12afd1701c0ad9240dfe6d14bdae321
SSDEEP 24576:W4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnq1oHjto1z:KSuZQIY0Be2KRRVtOnks6NMHqmT/M+w
TLSH
T111C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f108e91acc98ac4c11dfcf92c2b87c81cfe902645f68feadcea162f29ae96652
MD5 9f9958ad1d9d7bbf72cf5cc69b422f86
SHA1 bec8610f7263a0194a63086504fe307b1b7ec8d3
SHA512 9f3cd6e55d9a5895d492ce32eef41a8a60f970d6a4bad844dced10ba44ac148d7cd9b71b8c208b186d4ea750255ab7932719513ecf94df718e6bf985f07d060d
SSDEEP 24576:shiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLCoHjto1GFxlXutIs1Wg:shtSn8EApI0figngiDn0AP5wvT/M+w
TLSH
T11A95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 72c0e348147228b4bc4541a72f5bfabaa16833f4230f67090c7a9c5182d59300
MD5 12f800bdad9bee48e69d30a8dfc31c4e
SHA1 d885e2aabbf186761bae2ef9cb1a27bd0890fedd
SHA512 53d0befa0e3d5491282ce4fade26e2947d41c08093dc4ea1f209a7d1dd2ee76a6e04fc9279a7015f77a2b3be1ff3310fb44b3b3852523f51023084c63bef6fbc
SSDEEP 12288:kXhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:kxoHjto1GFxlXutIs1WZX5AR
TLSH
T1806523639CF340C7E62551B069C77AA5ECBBB307594920BB8B50EE190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 86d7f26ddc725fdbf3395c1c525423f9e5a1eb2b7b175ad35836c068d4f5c05f
MD5 9f66201b461d96fbc28decdec7d3ad41
SHA1 19ca9922db738a6e095e7cef8994755a8314ee1c
SHA512 36a55359166e4868effda96a3c22f6c431f1cd7281aee89af92d0e980096119a088f262aba227fe331d81c8886699c97cde92f07dbfbb922c9644ffb395a47ee
SSDEEP 12288:DyhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:D4oHjto1GFxlXutIs1WZX5AR
TLSH
T167652363ACF340D7E62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a021ec6291600e5f5a7988978546d73da427c904c3756df3a68cd96eaf2e42c3
MD5 bdd927b40df42a54b8609cebbff08fa1
SHA1 5e15487de367a1dfd17dcfa56f3377821f346668
SHA512 96c1d356df214cbfaf761427bc648fb08439ee9cb3e02f9fd48d7b53b895f977de3e67f69bee779d1e0883b11720904e95a7c01d391b47d0900283d8bb9a7f65
SSDEEP 12288:ZohKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ZaoHjto1GFxlXutIs1WZX5AR
TLSH
T1B26523639CF340C7E62551B029C77AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ccf0d6eec854431e8cd92eedad899f97909b539bea6315834888a302d24ecad4
MD5 efbe315b0f8f94c7ad76520873221a0b
SHA1 492aafc6971b882ab86ca59c4793242ece9371b7
SHA512 56dba0d3089fe336d3e83403a3eb1cd4b757c7ef0ac1772710ce04183a17840a102ebe3a4b3dc9cde36db90d395b050c5ec79684a7c10b91f5f9cd0d3e55ffbb
SSDEEP 12288:+V1hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:8oHjto1GFxlXutIs1WZX5AR
TLSH
T1706523236DF200C7E53692B49DD36661ECB7B6465B2521FF8B009D190F391A0BE35BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 676336610a8a322e71d9ab27dcda3e60ef993aa35783bc8935537fff1b6c4fcb
MD5 6bc9f634f5c8524275f9c06ee61b4588
SHA1 40b66f49719f19921ddcc2955a0c8249c12e117a
SHA512 d00cae0afd6b18a3c0e1871db1255d87cfc9ba5a9919cf1e9895fa3f31def70b4970eee0c105b9573f47aeb0cb97973a45b7b84b254b1ec0d6890100a9a75f09
SSDEEP 12288:6thKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:6DoHjto1GFxlXutIs1WZX5AR
TLSH
T12F652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d835ce2c0a85cfbaf318fdbd6d100a1c91482db3e43f6a7a0bd29986d6d62b88
MD5 c64c7dc132b428f1cec5d870f6260cb2
SHA1 a1b109e2356b855ec8c023b183120735e192ac20
SHA512 fde002cec4324ed6a63d77c12275a46c71ee3b4be91f36e3be0a4b57239782c84642740a760c54c8b32a97b88ee8f722127fe1ad4868ea9b7ef910ae0f8a07ed
SSDEEP 12288:OuhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:O0oHjto1GFxlXutIs1WZX5AR
TLSH
T196652363ACF240D7F62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 1f62164bb545ac1c9a70a0a949f5fb139448407b8d6a662b519ad655496fe44b
MD5 9e32adcdb3436dc8db44e360b6403fe3
SHA1 82df0e7108fa74c007fc09d7fa13877d995dd763
SHA512 a1f28553b699235714d9086474469f69d03d8f9070df26af212d3d4f307a402a60515fe602039e5f764ced605be3206472abff3643eb32af8ff13c1a57996cc3
SSDEEP 12288:9KhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:9woHjto1GFxlXutIs1WZX5AR
TLSH
T16D6523639CF340C7E62551B02AC77AA5ECBBB307594910BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 729ecc610a67f1658cfce0c3cec455254c40baf411719a232bdc95a21fa9e770
MD5 1ac60e8bcbcfa9b428d4af478374d489
SHA1 f02d444d0c98d29d4852e06dbc10600340203884
SHA512 c8e661920c1eea2cef8f2a52f8c96b372648f954093b5d6c969a8a9dc4753ba6ffa5418caf140ca134c5d504421c805a5df452d4bdf0615e38087ca510911413
SSDEEP 24576:xZM0zFVSOYoHjto1GFxlXutIs1WZX5AR:xZM0zf9T/M+w
TLSH
T1BA8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d2a3cdd8a3dff970d57697ae4c32b9e9619ae0fa8a8f7c60d8d19cf3e79111be
MD5 fa4aa1e6e13dd6a55ff106070a96d900
SHA1 12abbce4365170d7e08c14c255c6ed996df74979
SHA512 342ce3400e5837f61e3b522f82de1380970209c4e02cca815ddc9350842cbf6ba7c68975233970376db158f5851ccbd2f5fb31384d44d632bdc3a5697bd993d2
SSDEEP 12288:obhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:oloHjto1GFxlXutIs1WZX5AR
TLSH
T1226523639CF340C7F62551B029C76AA5ECBBB34B194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3e1b03df5c2a1a19677937ab43fbdf618319770b2961b74bf92fc89ce37a820e
MD5 f32f7d89ac474678afea83a5ca77a46f
SHA1 49c5b04c4ba9224324c20a4e67a07856e5183ef0
SHA512 77b286893e62fc936b16bd39b39165b53a4cc6c0faeca6268d7b067a776ce22830910f3462ab3c703bef4eb0246d36a20e26ea944932712bacec105ad77c92c0
SSDEEP 12288:M/hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:MZoHjto1GFxlXutIs1WZX5AR
TLSH
T19E652363ACF240C7F62551B029C77AA5ECBBB307594920BB8B50EE190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a0ca5fa1e9652de38c76e235843acc61cdedce2252f09e9e61505d24667efc25
MD5 829186ede9e3ed76f3decf8918818684
SHA1 e18f007d5a8f5d88d12cdba5c457426bd3cfe313
SHA512 b3be693be66c730486766314be13ab2a22c0e53dff222a685ad3af8865bd4d639a1a82ab08f70f8b9188748051e5a0659aff42721833336b8baacdf91df35c9b
SSDEEP 12288:ByPz5L82hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Qzy8oHjto1GFxlXutIs1WZX5AR
TLSH
T16D75021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 6a7c77b8d08fd0e314fcab35c7046d9ec562f155006c2889eb822ce674db3f04
MD5 b46642271ac74fe1b9a4e20efbd15c3f
SHA1 1cf0b699a876c994d9565c028b1a777e89055fea
SHA512 ffcda40b21d336eafd9e81e9a80eacae51ee666c2e12f92e68432706bbc795452b3c5c52b6b984696b3641fc4cbe81363d345c72fff2cf05792304072d7ed871
SSDEEP 12288:hbhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:hloHjto1GFxlXutIs1WZX5AR
TLSH
T19A6523639CF250C7F62551B029C76AA5ECBBB347194920BB8B40ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a5d4506df2bed75bab1fdafa701e1c12993c2f3869a0d60cacec327db365572f
MD5 2fae840707d3eac6fd7658cae9961937
SHA1 c94c1b0014076d625946c5cd7170f82ab84bb9f1
SHA512 c9b2976513c3f550d0c6a620b59585ec6f1211316b703712c8533fb270a7a7994bc58a6b3581c9e104969d76b574931b68ed74e4fc1e9d63bf6015afa5bb8f76
SSDEEP 12288:abhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:aloHjto1GFxlXutIs1WZX5AR
TLSH
T1B7652363ACF250C7F62551B029C77AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 6109b42666d9f7ff004c66b9d1eeefa22501c866a7f906b8ed13de4fbde5a241
MD5 bb27c9b5a5ea9dbde36265cb1ffa1d78
SHA1 998a8a9b9e5ed7dd3953d290f0b696543571dad8
SHA512 7c1d36c1058e61804d322c3d3937e0d421a9f650170ee20b8d5d38285a3253cbc206066f4fb4af18ffc80f1fdd7f603b524becb795a30dd268e8a99c16ed30ed
SSDEEP 12288:KyPz5L82hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Xzy8oHjto1GFxlXutIs1WZX5AR
TLSH
T1EE75021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 a11f18e3b82e84c827e3c0fc8f1f7fd2597eca982ae8ee1de17a02d68c478cff
MD5 51841eaddda4a852355efdf4757061c3
SHA1 a1416892f859f4a13143796936460d9d1fc5d631
SHA512 b9e24615cff1899ccb884d77b8dd346a93e7516e8520123773b85efbd0cb8d04c89d88d3b11938ff8fedb69fd22b26f114bbbd9a7bbd267975f117267fe598e6
SSDEEP 24576:wTNaLl3z0zDqoHjto1GFxlXutIs1WZX5AR:wTALljoT/M+w
TLSH
T1778502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 f02d6998f3de3dceeb9802a0c139490c297048f4cca81bab6e1a212d6149896d
MD5 2b464c7179b66db7c73fce39c8c2bbae
SHA1 9d7a9c6cfa4aa958d8250e1f23fd61a35865fd21
SHA512 1b9685cc25b1ab52c2b992aeda2f55d4bc0e95d2387c159d69bc5e708073c49a0b829b3261ca72f3d4d58c76661d6692458819b54329b3cd61f4af3e48e05541
SSDEEP 24576:M3pd9CHKy7GZWoHjto1GFxlXutIs1WZX5AR:2pd9CHKya9T/M+w
TLSH
T12895DF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 fb1ce804a3b8b6cbcc097b39f39aef04473ffc7f04be03e1126fbbf274588789
MD5 9542eab7712ff9dee4bd42859f04d51f
SHA1 18ff2148fc11b56dd5ce6086728d9ba60d5af174
SHA512 9cc56d176319c7acecc25d0da114ea2ec71daecfa5b9757e274b31a6073944857a8095b2c2a8247ce0f275d030ff5e0cd970645a8c3827a8e48d5e60038b0846
SSDEEP 12288:bIhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:b6oHjto1GFxlXutIs1WZX5AR
TLSH
T192652363ACF340C7E62551B029C77AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 323dcc330774d951b6f75d1e9c6e245f4884f00e0634edb605a5bcd027f4bbfa
MD5 07e13505bb22e30d4607c1691d0a80fa
SHA1 0fcb73d59e9c44de1c59b102bf05b9eb74b7e592
SHA512 674cda70de358ca2f0e62f93faf98779da1aec40b821c7fa3746f1e5a230dcff1e32d763defc0c3de5b0178fe4af45e29706e27a5827eed480c4a8d0a8f01e96
SSDEEP 12288:aWhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:acoHjto1GFxlXutIs1WZX5AR
TLSH
T1E16523639CF240D7F62951B029C76BA1ECBBB307594910BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6b52e4c671934fbc80ec26732a551e1de9c16c6e51d08aa7a7feff4f1c14aae2
MD5 99e2bf1503cbe06d9afc281253aa02bb
SHA1 2438a212fd14d5432149aa88ebdeeae313a99a2d
SHA512 f040a6c6d59f367f0062fad7e7389dd5fb26d94d231950b2e84fb4c2a5f606b1d0316e9c697d78d391feb660f9528594cf10d93988b0fb90b404004b77194172
SSDEEP 12288:K5hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:KfoHjto1GFxlXutIs1WZX5AR
TLSH
T159652363ACF340C7E62551B029C77AA5ECBBB347594920BB8B50EE190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f183b39f9a425fcbb0e53677070e652fe09e88a59c5ad0db553ca02bf7621aad
MD5 46f03fb640a30b5c3d36ce361fcdcef7
SHA1 5c4c2954f0487ae25f78d89cc3bd1322b5526426
SHA512 989c14d29a815163fbc6421784586f7ea8d2aabcb95769fff653ce157c0681e7a1cb759f81b9b69a4242662b390a5bbdc1cfdab29784ba071be83ef8636908b1
SSDEEP 12288:NbhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:NloHjto1GFxlXutIs1WZX5AR
TLSH
T133652363ACF340C7E62551B029C77AA5ECBBB307194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f6e3bfebb752f01facd00ebfb0d83dcf4b438bcfeabd84544e6999ca0cce9c71
MD5 4fbf14a6ef607340f1573fb9eba1060b
SHA1 a73f05c59adf84e4f14d701f6fef0b343ee56a53
SHA512 a9bad4ad0142be3b92f99eb3315df5af51be26192b4d6015d0329d56e3753fc228b141d15f06794c07a16a53b8cf1be82b67dda2bcea1b164e96b761d5ec7b9b
SSDEEP 12288:8IhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:86oHjto1GFxlXutIs1WZX5AR
TLSH
T18E652363ACF340C7E62551B029C77AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b63374c9386bb3918907293c7f742929fafb81c8b86041846af252c8aa76cf0a
MD5 13e9fbb5ea8e11d21a851ab98aed9386
SHA1 625d66f37479bd6a48d9b33a7b12dca7f0bd62ea
SHA512 012ed6a0d1bd23fceaa6e99146a928b6e1e39d30199b5782ebab6fa83f55a17b475f7035dbd2120e94e75dab231b56eb6ed15b7bf51dfafd501839b6dfdbac28
SSDEEP 12288:MThKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:MdoHjto1GFxlXutIs1WZX5AR
TLSH
T1096523639CF340C7E62551B029C77AA1ECBBB347594920BB8B50EE190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 3f100340dc208231b323330e272fab7190b8fdce4fcd1e21093a9eb8bccb880a
MD5 5bc7c0a7ddbc9cb897fdc0321e166bf1
SHA1 b3dce07aebbf6f59a85b0d78bb720d6e2931b0a8
SHA512 0acc842e4a8645f994141869b8845d21a3b18ce8a6ecdf098819c97eb476b0693dea5ea4f131c1782ac22307de4a50ec6e46e12b2524aa8ac2de22134153f8fc
SSDEEP 12288:rlhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:rboHjto1GFxlXutIs1WZX5AR
TLSH
T15E652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 446759f7461decb00cb18ee45af2acd776f5e59167b949d10dbd9f82e487985f
MD5 0fbea0024aaf96ec696d682acff2fda3
SHA1 35fbb486b53ff178d81bba1f4fa340338b5ed04b
SHA512 93f3edbdd488e24d9a5fdf66889448b6f01040d9ae3e0a45f8f0202a4e9dc6ff08d7aa4ecd7f53ca3f354dfa616c14235112a4c8b2c0f7ab052f0f22bb88ce60
SSDEEP 24576:Hfwv+k9RX6wkyAIJoHjto1GFxlXutIs1WZX5AR:XMnYICT/M+w
TLSH
T11895D029EBD844E5E177913C9DB3460AF6B278591B31C2CF029A536D0E37ED46E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cbbb01a389b6d446ddfb4b46f66cb830c1749100b8c03951ae52f986249fa1f3
MD5 64917c9968946b3a1231d45d5eb58ad5
SHA1 90ccd82cde8673bef827362c4f14b2606983fc60
SHA512 740ea2f2a228490316067a3de3f742f5446942f803f8969b88b73fce1f44d48915d09ea5e88a54262ab514949dd03c2366e2b5ac3572b6acaf4531294d58df7e
SSDEEP 49152:4YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PT/M+w:GySzPbw
TLSH
T142066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cef590417b7cb71b13ec3a8caf4a1e8b50cd0411c79a93008e8619230cb09289
MD5 f3dad5042a13e42331387cdba2f1b2be
SHA1 699a23a822d7b33a579a11295f29d63b52a68a6a
SHA512 b72241e3eca7e88b51f994dbf65637bd43d7dea624713975eaf9ff111b194643cf78a5275f0daaa76f3a5e1ed00cb27e14e1990bb186be62e083fea51a50cbb9
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYIoHjto1GFxlXutIs1WZX5AR:h47JUQj1irIhCnDHUPfF/fT/M+w
TLSH
T19965AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f9f5a3b1710abe8a9f2ff62c2d5c87f368b7c71480558a0a433f049d6a4708d1
MD5 d3c2b3c59d23a66ec6612e6092261af4
SHA1 418a0f27737d7373b6dc42916366c8c0f62f1b30
SHA512 80589f95e90ebb383371773142e8dfad1c55e06e855bcbc6ec138645c5abe18a1a08a7261bd83197eeb19dd131701d350cfcd1a44509c269b38bafb387a5a2c8
SSDEEP 12288:3zsfLhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:y1oHjto1GFxlXutIs1WZX5AR
TLSH
T17F75F11AD2A401D9D06E6174CB865A41F7737D2647E193DB47C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0c443f357a7722269ea334e00094cc1676cb4cd469c61807177770433cba411c
MD5 861fc3f2ed65f10cfcdc6904cb37f3e3
SHA1 9ee98a07482a306053e8d3bc85623c0da5ce1a30
SHA512 ae42480c12fcdffd654d757123d1e04aeadba2c92a91860c031c9cb613c3a47a4c166a4da794dc81b41303913cb833402da195db64c221ad7a7b043ca0543548
SSDEEP 12288:WZCiU3fHcgzGND/CjDD52z0qaicbLhE4gmm1cZQtaZ:WZ9UPxzhDHbbWPb1cDZ
TLSH
T1BA451840766ACB4FC66980325E33D1CCAB707C11EE446F0773C99B3F9576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 ff36e2b1baa6052a6b05417c6f8aea264ff3225dc02d53415dfd9666b4ba872f
MD5 227c99c9a1233182358fd2adf1f38368
SHA1 38519d2205ec49daa2b5307aa948dd3ed03c46f3
SHA512 93bb86c50e38b4b9da6e837d131c2bb6ba62bbccc22eaa687a2d7ef08060a567dd4e808ab0d3755fa9e36bdc2550465bc3ef4aa6d0f483f2d91e4ded76476cb8
SSDEEP 12288:WnBCXQi1hzhoPvmPpZyQnRuQQnQBW7Q1QnQBWKIAfKBS:WnNnmBcQnZQnQBW7Q1QnQBWKEBS
TLSH
T148750A415536E78FC1B76032073B6B8DA778AC13B7446F267389593AD86BB01A1F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 450cd164bbd2093bfdf4ba6bb63c2f4dfb7e7a8783f960b6440f8673d0372310
MD5 5811ccd9454407e53d0b47a1c7196edf
SHA1 a7908c9796476b48663ec693b50ff237decd1bd6
SHA512 ba337ff7df8ee14761e07723a05dde17002214e0cdf89cb68ee2f7ce538c0dea04ef01ab2161af56b6d3386984df9ca2c2b1c812c414b0c75f3db25c26673d0d
SSDEEP 12288:U+7DhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY3N:jtoHjto1GFxlXutIs1WZX5AReN
TLSH
T12C65236399F254C7F57961B029DBAA31BC7FB3160B4410FB9A40EE190E3D0E0AE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 088e200ee365ed93febe90760edfbd9711365bd7c84e4073504b20f38c5da9cb
MD5 4a1269c819598df2893c4467f8fc6a00
SHA1 afe53d3ccbd27e8b752a05bc78adae976fdc7bab
SHA512 f16fba16d11e35331204b917277083b044046e5c5deca0768e4cc7e15d76b67e482aead9809cac2b91129c85cfb8613e6015bfac4657a6e70fd20cae8cace849
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYnoHjto1GFxlXutIs1WZX5AR:Ugb4mBIBhGFpT/M+w
TLSH
T1F7659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e18c62cd65f11a6a65b44922ab38e04383aa2c0abd8b5fd1a82615a50a95eca7
MD5 8e0499124ebf2328eebb70bf3455cacb
SHA1 0004962897470f271351bf20b66a420568a876b5
SHA512 2620def315312a5c5d29d3e72990c3206af0a1fc8ea4bd37c3d62c7fc1064f64f445683b6addd4d8e4d8b2441f28e8a8fa13146d3d19cba15a38bb175d162438
SSDEEP 24576:9G88u8FpJqH1xzria7/mYoHjto1GFxlXutIs1WZX5AR:Q7ZFPqV4a7/gT/M+w
TLSH
T1B995F16676E101F1D47BD13889874663F6B2B4250364EBEF0BA88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 88f075c3a1008682a783aaa46f6442d0cde703a8b09aad0b06bbdf556a6350cc
MD5 371d0cde1aa8dfe1849db972c7668bf4
SHA1 62f7340d881d8f760d98694ad0701fd6a017a0ee
SHA512 a7de9e41cd0e9053db5dfd06d8c5b5652d3f48aef63e8491930616199f8d302b87614ed66f1db21528930a0c78c81b0affc0ff52fadabeee7961ecede012eb63
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtT/M+w:QG05lO43bsw
TLSH
T1FCD5CF6A62EC11F9D1BBC17CD9C74A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca5d5e4835f414e56ba6faaf6f8fdb200e6648a306095956f5fd841944285c46
MD5 7cf8e27762611cd6f01e88f4909d3b3b
SHA1 4c9ab22ccb71a2bb73786353a4dd3698d06d0abe
SHA512 3341a2810a13a8c1878612556efe5e1e135424a98efb4939e2188c9ee42a18654a27001b23d2d6fb6cacb7c01654dd2312725b058e2f8f3e0aa7fc5f3f8cc35a
SSDEEP 24576:Ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuoHjto1GFxlXutIs1WZX5AR:Wa5POZ3+Jt2pasx2+m1T/M+w
TLSH
T1A465AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 328db6831cf12fee5f289104a9416400ce015c673246b319a3e4efb7fee6138e
MD5 ad2525caefa7c00da53cc5d86c28a5d0
SHA1 0a1b4b951194665ae1f74b5ff2afa816986dbc15
SHA512 4db0bdf6fe82b602c8db299a99a5b24df847ea73c7995bcb2fa6cf18261ffc07941a3828584940ba8bf20bcc3c638bea0326c0f3221982310eba749a056b6d8b
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkAoHjto1GFxlXutIs1WZX5AR:2Nc/zEOVHFAT/M+w
TLSH
T1F0858C2622E901E4F5BBE1BE89779546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2ac0ceb2eb3550dd7436ca8a14c5b759bfcb5e1aa2a7430cb0d0a010fcf03d97
MD5 3303612adbdfae455588f4658b9fa779
SHA1 f5371a1dd87d08f5c37c3beb71cc8fc6805f93e6
SHA512 de06f40911b04bf81137b187a39cf61390a5ee763580fb95404af3ecfacb209e6e39a9b4b66c25743185d015fd66db3e4ed56ed6ab7eac8256b7351757ace321
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBmioHjto1GFxlXutIs1WZX5AR:Y8MwBtOmbT/M+w
TLSH
T13455AF6EBAF845E4D1FEC6B49D238512EA727461073252CB5390C13F0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 2d820aa65138615571dbc8e117e2ae601f6c9e2c0119753b6443a6dc73f4f19c
MD5 701877f62a9079e2ca14ab7abc350179
SHA1 2557aceda2752ff1028e8ea73e5841d401ce7fce
SHA512 827d4fa54734243ea886f422988cd24b847410fafda40daef8c4df92bf0e7506b9199a876dc00802cf2618751b4c4ed531d97279238d9d2ff55e507a7cb0e2df
SSDEEP 12288:RHvUrBFrEjwaQ+hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:RPUr+NQkoHjto1GFxlXutIs1WZX5AR
TLSH
T1BC85E12F66E918E5E676A17C89838719F772B462071192DF02D0813E4F379E8BD3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 47a83523dd04a83519a033d2703a1cfffdb2290b53b09fc566d4536b0c5a4e7a
MD5 53726edefaf2a24914f4b47be2fabf8d
SHA1 b12a093c3d5a2d407da742ba63db99c49576e7de
SHA512 20d6df8d3e48db08411aaeebaef8bdd1716770558cd00e680f7143c93457790be6237cd1c082e171e991171c809d12a769bae7c3f3f52ad1a02c9ae2af86af15
SSDEEP 24576:oD3FHshBIYQgARoHjto1GFxlXutIs1WZX5AR:oDVHeBIAAKT/M+w
TLSH
T1A295F23EEAA900E4E57BD1BCDA538A06E77234A9032165DB06D0C1791F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/120-404-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/120-405-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/120-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/120-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/120-100-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/492-222-0x0000000002950000-0x00000000029D3000-memory.dmp

Download

memory/492-19-0x0000000002950000-0x00000000029D3000-memory.dmp

Download

memory/492-189-0x00000000030F0000-0x0000000003150000-memory.dmp

Download

memory/492-228-0x0000000140000000-0x00000001402F1000-memory.dmp

Download

memory/492-220-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/492-7-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/492-0-0x0000000140000000-0x00000001402F1000-memory.dmp

Download

memory/492-1-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/492-9-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/492-223-0x00000000030F0000-0x0000000003150000-memory.dmp

Download

memory/492-75-0x0000000140000000-0x00000001402F1000-memory.dmp

Download

memory/492-184-0x00000000030F0000-0x0000000003150000-memory.dmp

Download

memory/492-12-0x0000000002950000-0x00000000029D3000-memory.dmp

Download

memory/2020-125-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2020-131-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2020-391-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2020-123-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2268-390-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-118-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2268-389-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-387-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2268-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-112-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2900-64-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2900-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2900-71-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2900-341-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/3244-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3244-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3244-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3244-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3244-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3492-84-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3492-78-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3492-357-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3492-76-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3880-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3880-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3880-392-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3880-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4144-48-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4144-60-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4144-56-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4144-62-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4144-49-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4144-55-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4368-372-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4368-94-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4368-89-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4368-88-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5460-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5460-31-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5460-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-30-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5620-138-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5620-146-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5620-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5620-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5620-144-0x0000000000800000-0x0000000000860000-memory.dmp

Download