4b57c3980e0e46e1fdd66ec1ae5029e5c27b2dcb051ba6e1ffcd56e9547c34e7

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 957KB
Sample261104-24f4gaeh67
SHA256 4b57c3980e0e46e1fdd66ec1ae5029e5c27b2dcb051ba6e1ffcd56e9547c34e7
MD5 3d17bc038251adb381d4cb4a3b7eb135
SHA1 d0de622b226ba0c348d7b5d3c76c5112c5fee7dd
SHA512 2af85eecff78287f64b0c361fec323674123d82bbe50b084f867268844fa54eb53aa09528dee1615d9e57fc76e80ceae4452753791fdfcd40ff7c18532107cba
SSDEEP 24576:Gnx3QSV8LObcYaVRPWxNs298r3OCDIjG3gE9ow+8xA+:GnxrV8LOKR+ft983Dl3gEe8xA+
TLSH
T15225F01DE79955F6E6BBD17CC8924106E6723C468BB1D3CF03A209962E337D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4400	elevation_service.exe
6048	elevation_service.exe
4828	maintenanceservice.exe
5812	OSE.EXE
4888	PerceptionSimulationService.exe
3876	perfhost.exe
1912	ReFsDedupSvc.exe
252	SensorDataService.exe
4804	ssh-agent.exe
2672	AgentService.exe
5232	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\774919f9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebe3ad5fb16cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a5468a1b16cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abbfeaa0b16cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c4685a1b16cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e6b435fb16cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000632a61a1b16cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	940	2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2672	AgentService.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: 33	5232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeDebugPrivilege	4400	elevation_service.exe
Token: SeDebugPrivilege	6048	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 3024	5232	SearchIndexer.exe	100
PID 5232 wrote to memory of 5728	5232	SearchIndexer.exe	101
PID 5232 wrote to memory of 3120	5232	SearchIndexer.exe	102
PID 5232 wrote to memory of 5272	5232	SearchIndexer.exe	103
PID 5232 wrote to memory of 1964	5232	SearchIndexer.exe	105
PID 5232 wrote to memory of 3624	5232	SearchIndexer.exe	106
PID 5232 wrote to memory of 4720	5232	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_3d17bc038251adb381d4cb4a3b7eb135_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2398f2f78bb98d3591e52b256b598474047d36ab6d494c972afdc5b0b71b30fa
MD5 d06a798339e665acf5ee197238856e99
SHA1 35f58934eb634f776c0f08861c2e05ec2a076027
SHA512 6bd539834b635c57944b3f5862c77722ef6e126413243ae1bc478ba159d0ef36f3062264e4b92c2b8673355b7652096e41d02027680b162c18f19a80f74ec1e3
SSDEEP 49152:yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnOR+ft983Dl3gEe8xA+:U3q6sjB1R+l9EDl3VxA+
TLSH
T154D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d6395e38c75ebb2953df95e2c97f7d80ace6dd4dd9e81bb91ccf8f86beda335e
MD5 b02b70df42c022847c5d8758d7ba02ab
SHA1 cacf569e42c6d658cefcc3d5006a887235c5c32b
SHA512 f94023a22e74612954b0860386bd9a481f16fc4ef30e286bc7668195168d66cbbdec27254ccbb91a53cb432203493657ea7a4f29ca78b8efbf8443c128280b4a
SSDEEP 24576:TXYfDtczABRPWxNs298r3OCDIjG3gE9ow+8xA+:2tcwR+ft983Dl3gEe8xA+
TLSH
T11105F12877D808F5ED6B817DC9A28512E633BC4547A0E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d0c18e03d2ad30d591ee713cc7b10b5564b9aae2062d0c9f68f09377230ba795
MD5 a69999cdc80e2752b36f8b85e81cd28c
SHA1 21b09e4a4ca80ac5e8854593afb5cdbcf367b21a
SHA512 83e7aea487b591b244d159b586507c4b8dcbef2000e75d9dbd246edc76c0a747d3204de5d41ec1d0b92450e30d31614a6b960e97f0b2fad894a904ebefe95886
SSDEEP 24576:E0Le5ji0hmxxrM2RPWxNs298r3OCDIjG3gE9ow+8xA+:EPji0Aj/R+ft983Dl3gEe8xA+
TLSH
T19735AE15F6788331D073C0B9C5D2A69AE97230865B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6016bf81407b8a035a35a43d374dd28dda25cf91e5816b300a0cc7f9cd9ab688
MD5 61cce55c50d4a162fa4912cbb6b05913
SHA1 0822601c3a58c43de335fbae0fd212489415269a
SHA512 0a181de4dc32bc53ed49e65b1b172baf3cb717958c9acc22143b9dba13ec201cb17e7b51015f49073069e19437eabf86b9901d1efcab8621999ce260dbdae694
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWn6q8wyugRPWxNs298r3OCDIjG3gE9ow+8xA+:s/ezSC6vUzPveHjy7R+ft983Dl3gEe8H
TLSH
T195755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 24bc70bc4bcc9fc1332f0c75d66e9aad2fa3a9a04dbe36c6a8664e3ed5f7bc92
MD5 0e1197b69ab1c165b16c43a4ec869c29
SHA1 98ea88000ee14ab922a3e84dad6cc4d961d4864c
SHA512 7b862f212a7a338b7a5715b3a55cc491c5175009b08c9a9f8f9fadcc7ff9bf3bff2973918dc82758dffc1484dc4d020389ac5ba3f05b08a3a5f10d53705c1f41
SSDEEP 24576:7VbqPb88hv/l+YlRPWxNs298r3OCDIjG3gE9ow+8xA+:7VO88hXl+YR+ft983Dl3gEe8xA+
TLSH
T1CF55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c93a4c86ba4e25dc686d2e51fa1958a0eb263136f240ee294b07c80fc849c093
MD5 41952a4c453575456626897622301e5e
SHA1 7986a882f74c5f657bdb377c2023046b4a75c59e
SHA512 59cb23d9e6fddb5e3b637ada421a9d867afcddbd9d979a37aba709123574065dd03c10f277fca34d38eb3acfd39ef5bceea260128c4d1e9a1f49455d503b1eb2
SSDEEP 12288:kLaRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:kLaRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T19DC423002D4C34D2DB2F85F599CAF0F2A0339D4D68F939F2D461AAA2AD7D25ED980177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7f5d49f2431510df14e6254c2ea71d19b6eaa977c01bea6e8d6e3e9b38c42940
MD5 244eb3aac9743e7b64816e8d5837c020
SHA1 625a8feb4dfbd8de4b176a0ce1ef289e72dd2408
SHA512 d472f40be1ba8e05555f336c62c65354cbbc726314edb98531ddbd61f92fd72fe613a74ddae883c93fe83d5e7faf3104e3f266e9232c25638bc95afd776b63f8
SSDEEP 24576:ZJIUNRPWxNs298r3OCDIjG3gE9ow+8xA+:ZJIUNR+ft983Dl3gEe8xA+
TLSH
T18C05CF3BAE28FCD2C27E8DB95A91C240E77278304F61A3CBD165820EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c528921b5c74d826d5251fabb0194fc7f2d5f155056bef44ac7052a9a2181c5b
MD5 53c048ee986bb2015681bea5ee296044
SHA1 667222ac2c11376112f658faf4150fb40f00ebdb
SHA512 2394021e6d5c95e67062ca01f8ac093f6790485a8f112c19ae1d98a3723931c4dd202521e73e675c2c971ab391b7b00fb9015b7876e09fc45b7359b96c6443a4
SSDEEP 98304:cQvGAdlCEL8c/DRNw5CQR+l9EDl3VxA+:BvyEYc/D3w8Q4sDlF
TLSH
T128267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 dd5ae777198ad107296552a069bc2dc7c4a2960bf4dfdde003561193f70a51c4
MD5 0b03faba94726048b435fc740df626aa
SHA1 b511b5cc74df20c8232c92bf52ba9e10bdd57455
SHA512 7101e1ed650f13b0cc6ca7e7b0813f5b68c967d63c2ca09c4fc217e3a8e3eb949e9bcf7b43b127d128350737f6d42996d15097c436513cc223586b3a21252218
SSDEEP 24576:K0ewsAjvRPWxNs298r3OCDIjG3gE9ow+8xA+:LljvR+ft983Dl3gEe8xA+
TLSH
T1D415E030FE74E032C77F0DB61B26D716543D79204BA129C3E3A88E9E59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bfdb319be99a3939bd226c0394dc230c60996d2d89ebf05c35207861f5c409bb
MD5 bfd3819651e5a6d0a5b1004fbff888a1
SHA1 ee3242b49635033d2b3a216de0214c3ebe5deec3
SHA512 12bc61446f0d340a97e84dde76fe19e92a10f70163c4e29095e3336590b5b393821f127f6d6cbc344157b651ef9d15a51382c4c5af3bbbb96551b08f217899d2
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHH4sDlF:VUEtQevvqc2W1cpV2tI32r
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 679cdee8aac5cc5917a24d50576a44dd3b7fde8acf88fb22c354c708ee06a2c0
MD5 7db5226227ddc306c1df565efd415e04
SHA1 8212be71be421696ae9eb3c66b019580b491edb6
SHA512 ef4b8d38db58a06e221db63c3bcb5a3767da84798aaefe691265db01e5f3cb15a29f4a5be4954d656a7d529ee3b8c64be66656d775753eba8d616ffd0e006308
SSDEEP 49152:PCbRquA/m2yL5zTfFiV+XenmE3/zPR+ft983Dl3gEe8xA+:IoquVjnmcR+l9EDl3VxA+
TLSH
T157D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d68996d839864fc04dbf2622c7566a660ed31e42a6f73cd5f24425b913b2068
MD5 9af59466196265afcb6706e9095265cf
SHA1 e4343cccc594a76a983c569ea386cd1f4e3209c2
SHA512 6c352095a3e0fd1e28df85b557ca70fa93f1c3fce104ea46526fc35b1731fe429d176c2c35b8f885b99c6f1971b3cf060cc26ef1e4e8118805e56dcb954315bb
SSDEEP 24576:vAhGL3IFoiwtA5l7S538RPWxNs298r3OCDIjG3gE9ow+8xA+:vAMUFoiq5MR+ft983Dl3gEe8xA+
TLSH
T1A835AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 05adaf40619ff4612c001564b9d6a3f9e94f8fe39a04e9f5f91fc8e20df3188c
MD5 02ca6ed897a5addc6fbd31f634a87608
SHA1 cc33587dc1638c2ea322c876fa9d2fab782c02e7
SHA512 3f447194ff69b1ca7acdaac97f2db588afacaa256a05347be13498e7d162db87470ce9b595b54d6f79fd33e977db177bb8ab054f87559d9fa7dc9298e6bacab1
SSDEEP 24576:dwu4OWbRPWxNs298r3OCDIjG3gE9ow+8xA+:dwvOoR+ft983Dl3gEe8xA+
TLSH
T18705F14536A81CF5EA6B81788587D132F7B3BC022A75DB2F4760C65B6F37321AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3f05a849081f9f55e5f1f3bc2f97dcc94449e8b742abddd4b0b8ebde7dd551ec
MD5 10e61d333650c3da41adb4f71c8e11a7
SHA1 067f7fd1002acd130013829d9626022c8977f75e
SHA512 a9991188f2c150960f2021d1c8323870ef782ba6a041675ea7652dd6807adfc07cb3f900f1f095cce814c610a767e68b3d23271574ac29368e121e052eb28e64
SSDEEP 12288:OeZ1IyfRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:TZu+RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T103E412493A9C30F2E66B82BCCDD59141E3327C4627B513DF552186A66F37ACA9E34332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6d9d032edbd0a614542c78d55c8db4773b54ed80cca23649bd4c284e8d4daa5a
MD5 b350453abd3580df702902ae33678fd2
SHA1 55423ce4656c05cb0acc569cc35becd5353ac8bf
SHA512 fead670bb4e4807753646946f6da4d34a21c9b16d099176cf06f4b86b71b9e980fac41df5f5ad95600c83fe7ceb1e7460b7713cd6d863025aa659d1eacbdf692
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3pR+l9EDl3VxA+:1QyiKa/X+PN54sDlF
TLSH
T141667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4b1cc6b1c119484297a4405175e64400c532363aa607b9e3ead08b09ab25e562
MD5 d4c37fe8d0775db1024fdde32a98ad59
SHA1 4bc746d6843bb1b742e29fab2b72f85de91182be
SHA512 e0367ed145340b0a096b3fb3bc1fdaa7a92d9c8d7e6c4f3192e21d08835e178972a8b99c739a4a2e1c774d6e6bc80c611ccf01823c236873c8f92badf8e6ca64
SSDEEP 98304:9QRQyi36YOcPbLvw2gAf+PN3pR+l9EDl3VxA+:0QyiKa/X+PN54sDlF
TLSH
T1CD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 06271d77d436fec596aec7d5cb38c3cf6268c71916837f94cd71d621cfd89572
MD5 85df8f302e24daefd3dbeb38b13f8308
SHA1 4fe84c10bdac33c8464c604fca1d9dd7639060ee
SHA512 c37655f421d600049a77088821305a83e37046bcd797cc98824ba5f7015fbfd4d816c89be10600304d67f1ffe7f9e0b280940c0c8a747334289439eaf2a1d432
SSDEEP 49152:G68Qg55nhceWu7PNU3//R+ft983Dl3gEe8xA+:kthLRc//R+l9EDl3VxA+
TLSH
T1CBB55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4942e45c3e95b9a7ab6e91c7bc42f6a05f9ca7c184b37d9c673034beb04e8f97
MD5 23e357860c17f41f78f6f2720b6bd7a1
SHA1 dd5e415a26a5a53bd2952849eeb99833b68a8f8a
SHA512 7049ee1893487276306c5b80220e00b758bd811dfd66fe5617b86161613f25d328b0c01f4dee8ce39c92bfc14b3cfe34ecbc39d6802568a7f47c83c640055fe9
SSDEEP 98304:Fy5112gYy5azzVvt69nLKnhZaR+l9EDl3VxA+:oLIHEWh04sDlF
TLSH
T1A7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 080cbcdac7dd43b4987197e28afed3bfda6bca67367c61a390ea32544387de98
MD5 980af523ee645694f0bc6ff2858a35db
SHA1 e6e9346fa5e99b663ab4790706e5d7b78133c96f
SHA512 5b7c740cc4f244717e6462c96de6a5184d2fac6f0461f3604b4be16a5650ec957370514744f2392268dabee9f4b6d96f3ed4111604612a835193d6e032817309
SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRR+ft983Dl3gEe8xA+:pu6Jmdxd2dRR+l9EDl3VxA+
TLSH
T121D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ae870880f19299097578b1a3c8d981dfc0fd05c26046f5fb9c5e31027692d2fa
MD5 9904748ecd3ac19ac31148cfabb4a881
SHA1 ef40e8d4b089cce751e3593f71aa5e1263553506
SHA512 ce40a5f347e46ed3d9267e06c0438f2a2082dbc9585eca9345143bd038c2a62d9df706533fb8e686bd62243f76e84ab79e7580141135cec8499a74415201816c
SSDEEP 49152:71hpsNoJpF1A63U44CwH7R4xtR+ft983Dl3gEe8xA+:7mifPWRcR+l9EDl3VxA+
TLSH
T154B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 af3fb946b8f129925113b90359b5a12150ca1250587d91467fc3b34a6a5992ab
MD5 b1d178bcda73345eb48e88958042e06c
SHA1 ffe1c22fd391fc03b4f6f096973c748c3ad29433
SHA512 1c46083960c6b1458e6a4a49ff30d60806abdc601bf48acd7e554d4297f8b2d3d42a0d1573c6d90335c985e3cd3c5cf6a4102cc2410b46abc5824c9b33f59035
SSDEEP 49152:FSuZQIY0Be2KcRVtOnks6NMHq+R+ft983Dl3gEe8xA+:L5dKii61+R+l9EDl3VxA+
TLSH
T1F2C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8c947a49d8c8bcdc49eaddbf6c5c22a18aaabc53318a58e8cbd1289893108215
MD5 cb5a60315530b5d576cf53a8ffff61f3
SHA1 76c680729315fb81538b04af7b3996184e84dceb
SHA512 71392958706dd32e1f8c40924df8c8757205fb2e093bf9a662d7a4ede415a4d2070b26cb51c2db1f0136b67b0d873f836e646b54e20bbf4f2cc71242c42ee1b6
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5wBR+ft983Dl3gEe8xA+:uX2imphIR+l9EDl3VxA+
TLSH
T1AD95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c303765f500a5f7a4e6422115eda8d50e8dbc66739d23dd1f4e5fbc1d3d05453
MD5 97e953aef0c7d035cce0bb083544ecc4
SHA1 2756d17bffe0985d21a17413def5e2127b67f988
SHA512 3318b360ca8e6a31b0fd9a3d05126e837ea0e65b7da302a9de4314070ead3ad99c5437c830a20ddc3882354258698a98d08d92d2d72a1c6cdecd26c80613c38c
SSDEEP 12288:RiRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:RiRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T18EC423043C4D25C3DB1F81F59A86F0E1F0376D4F78F935F2E4628561AE7A65EA98007A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 14e3af0e0dd5f17a36d7b452bffee04d373822f3479092d7b53a19547e3d4065
MD5 a01f91ffbf74cca827e99935111be3d7
SHA1 0a41eca86d6d011c954d28901581b135a9858a04
SHA512 b532293adda4108bf3e9acc13d106d4835699538793b5985824c39b10b203a0c246320230117794fbed81b08083172b6e1d364aa796835fcbf0bdbfcb796558e
SSDEEP 12288:RTRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:RTRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1F2C423043C4D25C3DB1F81F59A86F0E1E0376D4F78F935F2E4628561AE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 40e5e65cebd1db66467e3124405391352e6dd0d122ca1fd846c723f82ac5d818
MD5 3bbdd1f4d6c0441382d4e18114b3080b
SHA1 5cafaa899d7d0db2986e529044c63f1fd0e98d89
SHA512 8bc0d0f730f4c8e68bb1c261320eb4496b118af3bacf68e40a797057d42617a18282811d1233c02ceb11b20e8499461bf30a2a318979303fc74083d70777f230
SSDEEP 12288:S1RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:S1RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T154C423043C4D25C3DB1F81F59A86F0E1E0376D4F78F935F2E4628561AE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 17c5f7de5e51b8579ba77751f7b301e6d56b325c0742c940d8520df43d725c6e
MD5 ba5a4d6486fdf0dba85e251870cb1a05
SHA1 f326079718e65433f24187e3a98de381d2bc296f
SHA512 430e0eed93ff7f86779184caaeeb750d2da7ef932a47bb9b5dd5739601f0479bfee92f8119dd1e9acb21f0403e7695a539d55b9800c1be6dd93bff47c28e59e7
SSDEEP 12288:RVcRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:ARPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1A8D423003E4D21C2D92FC2F9CD86E0A1F133BC8E79B626FBD41149625E7639DAD60676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0577672653312e75377cf4112dafe0268155cab8fd0c53f7a9564ce9ce372372
MD5 aa852e0cc8bd8ed7570ba83d9b00755d
SHA1 d21147a2942fbf13134bb2b759d482b2d224bdde
SHA512 a7868874a1eefc1f7e8b9d40efd844a4bd725e7464fdef7f7cba27fe90acca666361f86353318c8159e7c16c3378012985a2c76cc6c47867248f5199a3593541
SSDEEP 12288:eURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:eURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1ABC423043C4D25C3DB1F81F59A86F0E1F0376D4F78F935F2E4628561AE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ba63d49a41754b35c643a472fcfd846e54ca537c1d7f9534a399ae4b09ef60ba
MD5 fc14a5eaad9026bf1042098aa97d54a9
SHA1 4c28b60d47bd6ef9f4fc9d0b36a81b173e949599
SHA512 9a445ed07dd1bcdfaf16929e848f8d999eb65ea6f89447b00ceba30fb54e6f72ce19a7ec91df58f84da6eb70a6afe24277dcb2ce862f6187914b1b7190f3b393
SSDEEP 12288:63RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:63RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1C2C423043C4D25C3DB1F81F59A86F0E1E0376D4F78F931F2E4628562AE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3f0b7700f4d8692f2ca1e4767f143af5553008ed3cfa21136ecda70c4e75f509
MD5 b71d02052e983d50e578662d770689e3
SHA1 8eec4e3effdffbc1c04b49e9936c9e45babc78e8
SHA512 c71737de57cbd0599da67071ec4e12541f06e9df4fe03f51e7f210502b59757dba477a28e17ee8f7e88ce91b34bc20e5b4cdc2ad85896381aafe48019f6bb391
SSDEEP 12288:FrRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:FrRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T135C423042C4D25C3DB1F81F59A86F0E1E0376D4F78F925F2E462C561BE7A25EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4faa1f13bcd219a0410bb11b1f79abbd1146d7083eca82d9e1ccf99e4a6a83e6
MD5 3a06d3a0a6d797f25991778abdab9199
SHA1 066acbdb62102fe3d589829319b812dbb0b04181
SHA512 23a57be18cd177162ac4281bc329b6f277cdf3cbe1ece46641138756c96a7a8ad9bccef87cd660be79f563c40fd077e718288e92577e6469c646663dce2d61eb
SSDEEP 24576:0ZMRzFVSOzRPWxNs298r3OCDIjG3gE9ow+8xA+:0ZMRzfnR+ft983Dl3gEe8xA+
TLSH
T1E5050194779418F0EC6B817ECD559912E2B27C4A1AB0C65F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 30218f4ee373156c0916a87fc904f38dcff6bd06c31657fae4522f9af9affaac
MD5 84a887c0bfe170a7a86462c9678bb244
SHA1 c0cf8e9c150b82af2f85659af4d35ca396dd8ae1
SHA512 90e672e0cb58a2322d90cfd2a14707b0505bcaced347e7fabc817019b3e6f90190f1a5b83afdd7f8e767c761459b523022568c45220b2abd52ac81a81096053d
SSDEEP 12288:0uRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:0uRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T19CC423043C4D25C3DB1F81F59A86F1E1E0376D4F78F931F2E4628561AE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d956899b84022384c963d00ffb29865fce2e3b750c35abdbc579f6c020958742
MD5 d0b0de501cb03091311bfff243554cbd
SHA1 40ce9e62707ba37bd9d6278d9211aabaa9c0c7ed
SHA512 1da03d287cc2ed9d879d00f79ac70c8578e1a6c54bacb3aadd63283983c7b6e9e0bb8a4a52ad6289a5fcda42da09617be331c732248b2fa972de17db228404d2
SSDEEP 12288:KKRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:KKRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1B4C423043C4D25C3DB1F81F59A86F1E1E0366E4F78F931F2E4628561BE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 da94844b3b383ff0ffd8b7cca84cae264cedeb626f184df05c32a0ebf3e33358
MD5 4260c5f6d16545ffdd00f0949c9408f3
SHA1 5461738502934e3b98c692bab82f9c2721a56601
SHA512 6fe5c5c794dbf97637e9b2549f626de4c54038475189ebacbb2d3d106fc82625424f0db0f85f83b1896971e677dc8c2028b16e81967915e667606f28ce3963d9
SSDEEP 12288:dyPz5L8fRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:UzyfRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T12FF412073A9930F5D13B8278C8925952F332BC361B709AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f0f28e66da9b2df8d8f02eabc9378db1ef07ce5db3cc99243276500ba0fba6e1
MD5 7e1fb7a8e91556ef833b8141b1b5e42f
SHA1 61ef2223b14e2adbce1394f48cd7647c95a9cf88
SHA512 0bdef1621bdfb0ece319b7baa5e0c3e1d8d25d840460d615bccfdf2b1c65e017a9193c65afa696c097df07fd40b89298aadd2e4fea9a0b598875ab53f38031d1
SSDEEP 12288:cuRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:cuRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T11EC423043C4D25C3DB1F81F59A86F0E1E0376D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 21a72c96d65c4b6445220f9b4d7a2605f06429982f3b7803cea9dec11345fd16
MD5 c85cdc4099576d7ab5683083188040bb
SHA1 cf8b83ed8c4cd16f9c20d22b98e18471be942e7e
SHA512 a834a975628a7baa6283b189d712ac68b5b1bd5f664bd14a0fe7cf05c1b80fcd4485105356d1dc65e7aabd504c1d21e6a89531062a5ac129627b88d08f9100e2
SSDEEP 12288:vuRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:vuRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T19DC423043C4D25C3DB1F81F59A86F0E1E0376D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 996d84179826f774db897b431054a92d9e1fff09dfa7058f504cc50ddf1db650
MD5 5d3656ef4e88c108b58ad97d63ee2aa9
SHA1 f89dd3b2f28f9482b692546467054fa7ca184a62
SHA512 2d295d0ccad8e7a706e338f4457a97314b9f030f7d6828ecb4f6493848a584df309095b12a205ddb49958250347d8bc572caebd859318469737e8909524175c8
SSDEEP 12288:+yPz5L8fRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:jzyfRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T10BF412073A9930F5D13B8278C8925952F332BC361B749AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3984a17f174c959806f9632f4b64fc0d7c9f1e7b0cc5ed4fb0e31d34dca7bfae
MD5 b7b21f7b8dfda0582b951b1186a0f9f4
SHA1 3da4dc78d9e950cf9bf3ba4a8ec0eca49d3c786a
SHA512 44e637cc3f392985b0aa612544708bc5b648c221a70069ae865c0c2ac2bddca3b2b52f279e802e0c8bba64e9297a7a84d34d3e2b0a4b8223800fc679e48e5b44
SSDEEP 24576:FTDaLl3z0zDFRPWxNs298r3OCDIjG3gE9ow+8xA+:FTuLljgR+ft983Dl3gEe8xA+
TLSH
T195050294779418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1cc8049265281eb3e6387798a6c169544d51a0f8e27174f606c924887d4e9657
MD5 082061bd884bc1393eac6e97bacb73e8
SHA1 59ee7a57ee58822f6eb38be40bfe52d5f5fff5b0
SHA512 3604703d10dd4de8766d82dfcd73e22946bb1b7754c57c0da541f3ce4120833661d3fa86bfda783a50dec2f4f6234219093706fdeca81e07f00991f61d36bc10
SSDEEP 24576:F3vd9CHKy7GZJRPWxNs298r3OCDIjG3gE9ow+8xA+:lvd9CHKyanR+ft983Dl3gEe8xA+
TLSH
T18525CF90F7E810E4F0B78A75CD669512DA767C5A1B71DA8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 cd8a461fe4b3b91abe3238333b841e9a923e71d07e0cce1035c1c29ab4a12f9a
MD5 799268ef46e95d8645a3a7cab9d8ea46
SHA1 cb4fae80b218faf67b1bfb80cda8fb2576697e40
SHA512 678f1b23c643b5f61a49a6b82705d0fca8090441d59e7fa9b1ba465a4a2eb4c1b19c180ab8485296ae96d683ddeec7297b1b0ba7c794f70e79df69f6958868e2
SSDEEP 12288:OVRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:OVRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T148C423043C4D25C3DB1F81F59A86F0E1E0376D4F78F935F2E4628561AE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 83217db68e6919db0dd6b1ac444e08fc44e85b17c1057154c417d427dc559c63
MD5 df52d1d4d976b21f260e3ae4b48b3e41
SHA1 0d1f4c579809dcba571729ed6dadc993cc12a52b
SHA512 56dc68b5460fe749fee155554b7efe9c4788618b542c6ff45ab9dfbf01e94e69e81d6977091fb39c4c190711609899aaabfdf7d7068b1933b8230b2b5676e771
SSDEEP 12288:d/RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:d/RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1C7C423043C4D25D3DB1F81F59AC6E1E1E0336E4F78F935F2E4628561AE7A64EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a8cf5aec2f4e7699a362047497f8ff2085f34c8df3a0669b529a73265b96a2ac
MD5 cc3b36c09d51ea231349ad69ef2ddc66
SHA1 eb74fa36434d49cc6c92b171991fbf490c199fe0
SHA512 3811230a400d97a7b504ad5bb548f3027c04a8abf176e3aec4f9824f32abe0e748fc07169332e20c7dc580d27a172bad205f7c8badedf9cb1b673e7cc7b74466
SSDEEP 12288:F4RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:F4RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T146C423043C4D25C3DB1F81F58A86F1E1E0376D4F78F931F2E4628561AE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 f9ec4a6d383b654ed16b4e3a81787b2d8e6a66d36956e0c781a8e1bb88b0b3b9
MD5 d3c76aebc7770f4901d0621ceff9a99c
SHA1 b21f7fba6b58dbd5d87cf042d4f4c8771520e512
SHA512 3723c028db9208256820e9e671d23883e346ac3021c398ab7501c7ea12a7489015f9032e5f8676a855262e0a236194444b140be165d9ff39fe25d2ce5b348b37
SSDEEP 12288:4uRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:4uRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T12CC423043C4D25C3DB1F81F59A86F0E1E0376D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d008527795a08d1cb767ea82d5323d03ea0948558af42c3e36faddb4a3da8106
MD5 8325271eacb5673d5c62c2a4d4211332
SHA1 a1468126250828023b10178069fe0e4889427ac5
SHA512 2676b8d967d9e610b504e0760e86505f791bde5bdc476f536ba7238de492700d7e7a5a0579f59604f4174bd4e8f5ea70ddc7e8d50d180fab94b3ab87d0a20cea
SSDEEP 12288:/VRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:/VRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T15BC423043C4D25C3DB1F81F59A86F1E1F0376D4F78F935F2E4628561AE7A25EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 72db083e1c7d665017357d7f5295c8d19ed1aaff624d5b85e51afef7105b7d2d
MD5 9e175f0928c1274abccadd352cdb8759
SHA1 c845609da23ba75817f471a268bd27eeb4f25585
SHA512 d953f63c0297fee4c9d3aeb42efd41b8babe358266edf16e3fc92ddae4fd1810b4d8493bcceeb460c312bd4f261e08200aa20b0b998ebec608a28c70b479ae5a
SSDEEP 12288:DGRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:DGRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T111C423043C4D25C3DB1F81F59A86F1E1E0376D4F78FA31F2E4628561AE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 1bb01d6fdbcda50b52a3c9ab87f7fbbd01f303b0dd45b1ca9d8add7bc5036ed3
MD5 cadd8c3f4cfa5cf3fbafe0401b4e68ca
SHA1 7b3e27c6d9258291d2bf222336b737a17b701118
SHA512 dc60d0210ec248447d183ded0043aa5409f5e5188cd42f0fcb0787c5a51d8982ef358bba6753c41a0d95c94446114edee909c6046138e1fd0e265edd0c3f6995
SSDEEP 12288:vURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:vURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1E4C423043C4D25C3DB1F81F59A86F1E1F0376D4F78F931F2E4628561AE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 a1e42f2662d871aaf08e86ae125910c667e885a857909852f835819ab5700d60
MD5 0d34916a382e417bfffd5a383a956589
SHA1 a01edc5b4f111736faaf1e58526d7a0e7442c76a
SHA512 1287701ca47b76f990465a92346c9dc35b843bc96180c9a1293b6c697780f0be1aae7bdcbba1b0bd65392a440b2da401f7f33c875e35da6151fd0190450b197f
SSDEEP 12288:R9RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:R9RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T14AC423043C4D25C3DB1F81F59A86F1E1E0376D4F78FA31F2E4628561AE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a88bd0ddb0ec41ae6bdbb96b9a4ece878076d677bc39d8ab25b84637651c2d1e
MD5 3c1f8164b2b418ac80a79ed81548ffb4
SHA1 929d70d200b9592f4464157160eaac45a173b9a7
SHA512 42997492591b7e4e7cd57e2ccf59cd4bcbe8edd19c99eaa972d792b126528144dc5cb7dc38f2d7c19a75d0a8061f59e27c00c6f2c12487dd00c12b3d1a5dc247
SSDEEP 24576:GfwvUk9RX6wkyAI6RPWxNs298r3OCDIjG3gE9ow+8xA+:uMnYI6R+ft983Dl3gEe8xA+
TLSH
T1DD35DF29EFDC04E1E177927C89A7460AF2B178591B71C2CF029653AD0E37ED4AE39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 04fb6930c94179f644df02163f6cbf6b4fcae4b95f1df7f1d044ae165862cb4e
MD5 12f37fb9e350c1a1e0493a4b90d834fd
SHA1 c80c16731555d58628793c285b2fa2b438c090fb
SHA512 b57237902b7f1c0e9a67e309800c17407a5a3f6f74019e1f06600108bb85bc9b6132a1b0f0e177918e21478d94ae4a11445739306ef3b72a6b3b0bf502585d3d
SSDEEP 49152:tYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hR+ft983Dl3gI:gySzPJR+l9EDl3VxA+
TLSH
T1BD066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 959594a61d8fb8ec976c5676e68d0a9a38ef9793e36e875b0af24f24dd31ab8a
MD5 d00059833532d01ab100bed2b80e4bcf
SHA1 34fc37cd54c610fcb351369680f4c50f9d9a4de0
SHA512 c31ae0cfe67c4e31618c0a8ebf6576767d797f00cd4581c650624f7df87581a94fe13c2a44d71b6f5b19271c193c10a96bf045b0f843e02d97cd2bf0323f1b94
SSDEEP 24576:s47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYjRPWxNs298r3OCDIjG3gE9ow+8xA+:s47JUQjTirIhCnDHUPfF/RR+ft983Dl1
TLSH
T1BD65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 9943fcd151027cd2aec17fd51a003ee903d6e4b3be04ae43b22d8930d1f05b34
MD5 d94ffd60dea744217a678309cb97c433
SHA1 067ae2a4eb564c20c37091a32b79af8436197a6c
SHA512 caca665c0d34a9b274e26c554fd7c9abe94709a21139903a504754997f182e2db43fb217d6041400f786acc00212bc7c475845b1085c2cf8937dc7d622fbfb8c
SSDEEP 12288:Kbsf+RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:h+RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T18FE40109D68812D1C02FA1B9CB869681F3337C1997F1A3CB92D0F53E1F7A6949DE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 972KB
SHA256 1d38e2336de6bfb34ea414e07e4ff1a2cc558dabbb30bac128403977ae01491b
MD5 5082c464808168238accc480ae972b1a
SHA1 5fc087adf5eae9a435e26416a06c6660a0b03d5d
SHA512 c56f63653a7c4c6f4923fee5e16940fc32d331d86bbd1c90cfffdd17a8b3c8c96d251852a46341ee3e34a80a1371f3c522633dd68f8741317af2f515b13d11fe
SSDEEP 6144:0usBC2naQ6qMD+nZB/4otMxvm2bU3fvkreu/NIzbNSEEUubrzFyEGOUd28T7Iclr:07NMkuU3f+eJbNN+k5fTsckSyMVz2u+S
TLSH
T1A52507007626DB4FC6AA54322E76C6CCA770BD01FE099B1372C9473FC576658BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5f8358602c22a429b68a660d1ca8d7762b5dfdaaee2ea5f17ad46dff38d79943
MD5 22ef157bbf6125b7956f2b38cf5c6a52
SHA1 0bf84278b8d6f5c0c2b6aed08f99d2c2264fef2d
SHA512 02d74a29a7692ad93ae76646fdfc7d5a8d9714417ef1b72358d1332d5590a0f7f1c13eb1ce7cd6bc7dcea97a1c51d7c05dcd55c87f7ce40381001be25c5ace4c
SSDEEP 12288:0Qsn3ZMpMVBhXjEH1tm0SCaamBMTx13WpqARLmO4KXuOebGramteY:0Qsn3ZkAhXjEVM5LmbGj
TLSH
T14C652A005577EB4FCABF5033133689CC6BA4AC02B7892F156345893A947BA6EB1F53D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 050f8957ba50b1a0085c9d71f3f36796e5b0c82383c7255639ae02b2e81ef70e
MD5 a3996c92550b7aa128bcd010c885ac5c
SHA1 35abab923b773be03d8d75ebaa114ee7d0d38b59
SHA512 939fa9cd18d57fec1296c9a851df7a51d46b486edf0bd9da6ca6e77ef348ee8050de8bd8ee726dd5066cd2c82a2f974270d12d32a18ff55f89afb7a8ab520ac2
SSDEEP 12288:R07WRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:SWRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T177D423002D4C29C2EA3F91F4598AE071B12BBD4E6FF460F3E41196A1AD756CDDDB052B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0832b5e40f90f44f84edbd0c4dfbad5fb8c21dc4fa0c9587ce3798154b187bd2
MD5 c7e7ba401c20669c173bacdcd8d20633
SHA1 cd218f66ee5d9cc33e243b52b0fc2390a73f827b
SHA512 69f871d130bce1d59022d6e04e93655ece0f805ae5d53ff07a395de26e89b19b819b17e80e96dea564fe0168dfeaba9fd7a2d3ae75771ecc9b100be4103ce3bb
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYgRPWxNs298r3OCDIjG3gE9ow+8xA+:ogb4mBIBhGFjR+ft983Dl3gEe8xA+
TLSH
T1A865AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7a8c6095917fce9ccf636bc298e61886fc6e5ffd7aa9bcf29ec33d63337f9172
MD5 be6b9fce8687bd1a94f4776f483c74cc
SHA1 c4119c4fc41a54a7b1331b5f63a9fb394005ce23
SHA512 73b283c469e434b93c62c0cbe39654ef598441306a56489a1114dedcf6c868d6878f0124ce57b2ccfdb82f3f0c46bde0c018cf8ad6ea2f206704d06c92a543f5
SSDEEP 24576:HG88u8FpJqH1bzria7/mzRPWxNs298r3OCDIjG3gE9ow+8xA+:m7ZFPqVea7/YR+ft983Dl3gEe8xA+
TLSH
T1EC35012576E401F1D47BD1388A824663F6B2B8151374FFEF06A88B511F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7d7e37fe6a09efde87c53d985ae66f0c4f3b2f334e71385a9c395c3c0de45979
MD5 794275f8214217d57db3686a472b058a
SHA1 3f53f230f0803926c47c601281a304792f389479
SHA512 2af549a9c128b5e831ba5bfbe7a24f4a88ef45433289ae527df3ae874d4a0c03e547152bc5d6f93713ba87c718ce788a85e78fe485dd6171002051514e2289ee
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3R+ft983Dl3gEe8xF:GG05lO43bSR+l9EDl3VxA+
TLSH
T149D5C06E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 618fe199c6a631b42ac27a161f7fc502764a2667c4c1f87ee0f911e0ab2ea292
MD5 c1dbf875195dd1a9e2bdd220079a7434
SHA1 dc6054c9daa8d826e1c9e5bef266ea636441870f
SHA512 ee1adc85f2a2dfc241fdaf163871507bbeb64ed9724b90287113c633f2b5fd5f15b7893ef697a2b0a31fa5d95340d12844e0e9d82827037a8a27e0d7ea76f8a6
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhRPWxNs298r3OCDIjG3gE9ow+8xF:xa5POZ3BJt2pasx2+m/R+ft983Dl3gE9
TLSH
T1FF65BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 14cba19161c5982ab4c778740f81e0032d8bc512d73dcda1cccd86da3f8ff382
MD5 e7fa1c8aa1d8472b5bc9170baa3f59cd
SHA1 c94d778950f97e5b249c701a334d76735086ef43
SHA512 bda90f9d7978f4077d2c13df275d60aec6972ad601fd60b4b26bec8f3b8403edc1ba48a7dda27384a4c0ef2aa242e6f0ad05319f4ab8b95cdea134d62e9e61b9
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fk7RPWxNs298r3OCDIjG3gE9ow+8xA+:hNc/zEOVHF4R+ft983Dl3gEe8xA+
TLSH
T186858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 34095f5ed13a88ef412fdc2ec13f3b16b56f253d5af01ed8ff215aac3246f6e2
MD5 29d6513e61fdb14580096397ee5ba73e
SHA1 762f3a468298278d6b361af8c3a1d8d6397a212a
SHA512 de90014a6e138336f4fdf859d8bc1ae489e4ec945e45085d5db8f08e9ee841a0f63929bfacd96a683ac7f7b2e299929ddf1f6c4d10292a3436dd8e47eea02e0f
SSDEEP 24576:7TkNvNnaFeYhJNtmZBm9RPWxNs298r3OCDIjG3gE9ow+8xA+:7TMwBtOm9R+ft983Dl3gEe8xA+
TLSH
T10955AF2EBAB806E0D1FEC6B5CD238512E6727851173293CB9290C13F4E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a2b5fe168b3761b9925e07f8867e77dfdba4378a2694b6a4ebc52150d8249459
MD5 98c468adf104ad91c4a1f1f46913cc10
SHA1 fd1eb8343914ea69901cf4a3ea44053733033639
SHA512 f1efafeb82ab8b279b7f80913ea6acaa492e6bf86151aed21ac6ebac3b7f605cc95e17af681e5d1ff824c57a39fb44f15bf43d9d482903257d531944c1ddb5ac
SSDEEP 24576:QPUr+NQnRPWxNs298r3OCDIjG3gE9ow+8xA+:QJQnR+ft983Dl3gEe8xA+
TLSH
T14405F11F269C18E1E67BE17D89828219F372B8521711A2DF01E0817E5F77ED8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4c9d1603a73879f32c3042468c6e40d1ab460338303a4a6639377600e048605a
MD5 a12e6b871d3b4e55ad222aa617b67f65
SHA1 c394cbd792de66fde74b8c776304ae8335e33736
SHA512 6f6578f9b5c256ed3415be4061875a27c01229e67a1295770dffa1c47cf5c7f7550c254b8559bcfe71a430d11f5f1448464cd62f5aee7427d361fc364630dd70
SSDEEP 24576:uD3FHshBIYQgACRPWxNs298r3OCDIjG3gE9ow+8xA+:uDVHeBIAACR+ft983Dl3gEe8xA+
TLSH
T15925E13DEA9C04E1E57BD1BCDA538606E67238AD033266DB0190C1B65F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-306-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/252-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/940-310-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/940-313-0x0000000140000000-0x00000001400FD000-memory.dmp

Download

memory/940-0-0x0000000140000000-0x00000001400FD000-memory.dmp

Download

memory/940-1-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/940-80-0x0000000140000000-0x00000001400FD000-memory.dmp

Download

memory/940-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/940-7-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1912-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1912-82-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1912-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1912-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1912-372-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1912-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2672-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2672-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2672-125-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2672-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2672-119-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3624-391-0x0000018F72A30000-0x0000018F72BFA000-memory.dmp

Download

memory/3876-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3876-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4400-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4400-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4400-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4400-23-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4804-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4804-114-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4804-305-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4804-108-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4828-40-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4828-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4828-50-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4828-46-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4828-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4888-73-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4888-301-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4888-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4888-67-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5232-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5232-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5232-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5232-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5812-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5812-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5812-286-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5812-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/6048-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6048-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6048-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6048-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6048-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download