59bfbbd633d63e92da68ebb26d93facd0c40357e38908f14ee9ceac1e0755156

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
Size 1.5MB
Sample260711-mmxbssh171
SHA256 59bfbbd633d63e92da68ebb26d93facd0c40357e38908f14ee9ceac1e0755156
MD5 bc030dc29bd6327d65cc621ad8bcd831
SHA1 bea83194ad639e455b21e088707fe517430974ed
SHA512 961107674abbcd825962a7b3b8e71691e89c7c9ac2ac7385ef9e654c6fbeeeb363b72d29f2083cd4b14eda7edd2965ca1d4f9e2425d9e131bc5622fc8f8769cc
SSDEEP 12288:AuRtHkgVRyQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:Au7K+N0C8oYBonQsx0zXxOtk
TLSH
T16F75120F669430EBE3A74675C44209A0BB767CB91B6487AF07F506992F333D88C1EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1504	elevation_service.exe
5160	elevation_service.exe
4400	maintenanceservice.exe
4604	OSE.EXE
4656	PerceptionSimulationService.exe
2616	perfhost.exe
4564	ReFsDedupSvc.exe
5124	SensorDataService.exe
3232	ssh-agent.exe
4768	AgentService.exe
5116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7a0a7b2f8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\GrantUnpublish.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000957f6e102111dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dad4a0122111dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d19dc0f2111dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab5bfa4b2111dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3596	2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4768	AgentService.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: 33	5116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeDebugPrivilege	1504	elevation_service.exe
Token: SeDebugPrivilege	5160	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 984	5116	SearchIndexer.exe	98
PID 5116 wrote to memory of 5600	5116	SearchIndexer.exe	99
PID 5116 wrote to memory of 4776	5116	SearchIndexer.exe	100
PID 5116 wrote to memory of 3252	5116	SearchIndexer.exe	101
PID 5116 wrote to memory of 5648	5116	SearchIndexer.exe	103
PID 5116 wrote to memory of 1640	5116	SearchIndexer.exe	104
PID 5116 wrote to memory of 5728	5116	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_bc030dc29bd6327d65cc621ad8bcd831_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c319cf5366f5abb0a754c10dda7267762256a6d97ea103a249a0c69595d88fbc
MD5 59088c142b9727a636084abd3fab0c24
SHA1 0236cd83958551d2803aeb89dce5d4727c6ccf5b
SHA512 2d6f2c44644d21a4a6f3a119e21c44f8458dd124ec3ea33895cf596bec5b6f0569c5e48343aa033f3bb09926f14989a209153f11249a18567131cfc2f2c9192a
SSDEEP 49152:+b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrzyBxsx07xO2:A3q6mjBaCC07xO2
TLSH
T1F1D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 210a27cedf7f28e3e9f2ba3dd723757865148b517093563fa23c34a0c8b6fa71
MD5 d39f4c4c27b72b668146118b1d90641c
SHA1 c4533b9f9c1862085dd70785dcbb65c13bb4fb64
SHA512 0cfb2b34bb3a019209c2d06cc4c9c0c571319db64297913ff1e58ddbdcd6a5146d4eb65987a7d03ba2cdd23623f13a7c17484bb7fe6c0a7147d32ac6da743bd2
SSDEEP 12288:O1XLsswWkxy2lRq2czAlQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:8XYfDtczAv+N0C8oYBonQsx0zXxOtk
TLSH
T1C285F12877E408F9EDA7827DCDA28421E673B8914760E7DB03E49A251F233D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 39ac81d62049d0eb19f5afedc8b6fd4d519d34b5a162450e8fbd6e16285b222a
MD5 7c48d65e9dd5d7c15d864db2d5c4a633
SHA1 e98fd14b4612ca0122c1f2dd7b1dc56210c24a3e
SHA512 106e756616cde7216a5afeee2680b5bb00fda4d5d3ce56b28107178dc61cb55c5806e21bac009a30b9f3c4b36924a7652995116ff9650f93452ad48a31589de7
SSDEEP 24576:K0Le5ji0hmxhrMK+N0C8oYBonQsx0zXxOtk:KPji0AzczyBxsx07xO2
TLSH
T12C959E16F6748335D073C0B9C5D2A69AE97230865B308ACB4286D77C3F67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 00172ad33488fb37e1a87fb13cc6fcbd9b6416bf8171efbf6a973d4724bf6531
MD5 52b714e110b66f9be3ad19df126b104d
SHA1 65ac7ea59db685643e7ec8183b291bdf60d824ca
SHA512 6d6487f8f38bf8a00cc364e71d50884898a516135e96954ff6299ef5ebb696b00d2339934991b05a758eab35b9b24e29b5c96ddb03ebf973f0f4eaf758c9aa8e
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWj6q8wyuU+N0C8oYBonQsx0zXxOtk:i/ezSC6vUzPv+HjyIzyBxsx07xO2
TLSH
T153755C15F5788323D0B2D0BAC5D6AA99FE7230865B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 93f5b5ab88fd55fb3413cb950057168cd08b56d97ecb24f6c6fd3ebd0dae060d
MD5 fad1db636fd2b47c444919151ace3b71
SHA1 2531d6b53fb681e24b9da6afe9756e8e46c8e1e0
SHA512 3d59ab02f63b7d1ccf8d8d3bb98f932d6af734b043e81f41e3113cd99520c70adf39a8bd1ba1b6893e579eb85c4564c6602578dbfd2475df7ec80ee7855b2cd6
SSDEEP 24576:RVbqPb88hv/l+Bj+N0C8oYBonQsx0zXxOtk:RVO88hXl+8zyBxsx07xO2
TLSH
T1C0559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 dff3a7214257cc45738dde8cd170dc3630613b9944d378b450a0c10a6f74c70f
MD5 8a815ef961b77260d867388d1853a848
SHA1 7014c324c9d21666b30238edc08d2ff3eed08f36
SHA512 a70ed151bcc953596812591e60370c76c5dc6ba11907a6cd41e073f930170aede79354115a3e9d3224f332899b63571ce321c189740426be1b0be6f1ae594318
SSDEEP 12288:8GgQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:8GO+N0C8oYBonQsx0zXxOtk
TLSH
T1E865230D19DC9087FBDB4AB17A8E4CF4269FBDD069A00358889A6F6933346EDC44B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 221652caadf37b29398ed21c39d152b3cce07ad6f10aa6fa149acfbfc183ffe3
MD5 98c128442a7f7aa736f373c708806177
SHA1 846a839098a2d208f35f043a60ad4face4ea9c25
SHA512 f2c3b97ef8db31e968a515f2a75f82a80ddb1a71b02ab0778fc2b742dd778381a5502c04ab312894fb8829cb0438fffc93a1a2e001847f556a9ba11e0bc50f49
SSDEEP 12288:WeBNUbTVO86U5QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:WJIU7+N0C8oYBonQsx0zXxOtk
TLSH
T1E185DF3BAE28FCD2C27E8DB85B918640A77278704F6193CBD165830EDE235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1410ad9e95219c52e61b2cd33c5f61131dc6033a98102d073940ea2bf42db6da
MD5 5f5e70c5913a23ec6d1e1b4eaf3da627
SHA1 e3afb8a492551d773e408235237b0df33761114d
SHA512 71371babf3933c8e7195d9c1e5c222780bd752c8e1bfeac09befa784638addbbb20ddd76fc65f9fcc88c02a00e9810cd17b0deb780480a7139abf374dbd43b1c
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH7:RQvGAdlCEL8c/WRNw5ChCC07xO2
TLSH
T1B2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 46153bcd8cd31ed9b9c0aa38548b9c74087cce2d1da3e470eb254a5c09745d0a
MD5 8ebd4b2c07b970c9cadce8b7606302d0
SHA1 66719e9d4bebe19fe7660715dfab25610856b385
SHA512 694781a463ccd38e4cad42c3d925269070f62bdd4f8eb37f2ad2806426a0ac8e27870e1e3de458b9a8a796c206293453b44b805abb366b675eae7d651be43b9c
SSDEEP 12288:HAwSfxL/2Dc3mDLLmt0LDQewsAjPQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2l:gfewsAjd+N0C8oYBonQsx0zXxOtk
TLSH
T13E85E031FE74E036C7BB0DB21B26C716146DB9604B611AC3E3E88E9D5A302D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cb74bdafc3767c14add4d17676fe969efe9b4dfd5ab77e3371b01dd0a65a0fca
MD5 2f91379bbe43fbe4ba4c29478620adbc
SHA1 ca04aafd2620081c6f5a17b02f3e604398e13869
SHA512 e3311708e6ac7f95166c48cb15bb96f6a11c04b5c3c5d9fe17d2dee8a9d2a0381a79cab1f9d9d2961b3b82240ea2de9c82d20a83d2b16ee90bf80a8dd10ec10f
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH1C0E2:2UEtQevvqc2W1cpV20I32o09
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c32ab5bbc737708e605edb9173392b68bf3cdfae0694c32b2b49ed848137cd7c
MD5 13171bd843373cfe586627774402fbb8
SHA1 cad5daa1476297670213e4fdba347a10f4a2d5d0
SHA512 422037b5959c97e5ff95a9b6e01861b6f98b735a2de22c8ee6f2a82fc7e605c715f786b8b2fdeb5f8a5fc8ca7a4b7916e09e890c550f2f07d6a75103e8e06768
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zMzyBxsx07xO2:+oqtVjnmlCC07xO2
TLSH
T140D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3b8d373e67e7514359da05f83d100589d1d44c994a83990e72caee65ca880f18
MD5 d9ed9ef7bb7ef6fd1c418eb08a24e9b7
SHA1 5e8c4378eb9c6f864a9fe3d8cef80f1d14b72a96
SHA512 528e5179b2eb9b7752b6a3b2892243198f23c2f2858cf86307129e34fb74a3d7a3e76038a3b3bf9595534a04bd0c6219f63a6afbee3956b5333cd452689b4fb7
SSDEEP 24576:LAhGL6IFoiwtA5l7S53g+N0C8oYBonQsx0zXxOtk:LAM5Foiq5pzyBxsx07xO2
TLSH
T10C359D81EBF955D4F5F39AB8A9B68570EA76BCA55E30C20F2150C21F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b17b890573bd95e3d3df975cd1ce9bba1a465fed6213c8288fde86694aa7c2f0
MD5 26d1b4c48b8b5763ebd1e0fa7159a67c
SHA1 02a6bac470d1a7f07fc6316682b6938dad811a4f
SHA512 56602c80d02395d25325337d5b0b4793a3c1ad98a48e4a0ee2e0d876c108fd808fa3cf08d737a8b04dc402d3557c8dc4b58391784c61c278a2ff3aeb9d16f3d8
SSDEEP 12288:hmw5HEjsChNEBFgl0WDm+C6QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:8wuROWp+N0C8oYBonQsx0zXxOtk
TLSH
T16885F14936E81CF9EAA7863985578435F7F2BC512A21C71F0760C65B6F33361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 aa0196ccb44eef408de6b0a5d66d77f221ac63e3b9bbfd151c0ec286356dbeaf
MD5 0c5c6403aa0668ebb4e9024d2844cb87
SHA1 048c6648e2c010a6f07f75d1d51677e94c9f767e
SHA512 46c77d36c81e81db57d169706c747f23ecece0c54022c9c622e81ae7e055be1e88b49f8add518a293e6f31b48ac2f314016beea775de97fd82bd1ef53c0b7754
SSDEEP 12288:fyZ1IyfQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:aZuC+N0C8oYBonQsx0zXxOtk
TLSH
T12875124D32E860FAE2D74278DDE549A4E7B278D1237103CF0559476A2F32BD99C3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4611f77b83e368b266fe0af6607c0d8a2e58f185ac9fde3f4e2d65e1f37908fb
MD5 38a2c4b895fdfcd621a5a52a16e6c1cb
SHA1 abb51983448b6db3710ff118348634d0cde852c7
SHA512 5a27d13e6be3311c17545df9c6a0e4da6505127f7921e86fe6894d14c285a2a0126f5f8f88d130252a64355fe7c45a37c238bb5dda3e2587cbf72483ba54f284
SSDEEP 98304:IQRQyi36YOcPDLvw2gAf+PN3GCC07xO2:fQyiKanX+PNbC0E2
TLSH
T182667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 05f62471f2e3ea51a4dc1dd8356f379d7945e35d8619674916a4cf5523954a6a
MD5 dbe07889c52e0f14ab1bc716583f6253
SHA1 9ad0ec05f67894b0830750086afef2ef5245488b
SHA512 ce5cf34d20e8dd9fe23754e4918f5400ce03f0bcd8b2d3cb55f7a0ffe7e927ccbd98583d8f8beae181002d9ec7cb1ea1b415052d44d4e4cd5ffc8c00c024c299
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3GCC07xO2:dQyiKanX+PNbC0E2
TLSH
T1EA667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f84dde08839bca55f81e61e42909239603a7cbadd072fa19bfa78cc1062c68b9
MD5 4c3c5b681cd2164a14cd9a0f79f9cd42
SHA1 1f4f86391529f27533b248beff09b9e013be6c60
SHA512 1bf6fef557e7e085744c1ee88e69b81b905eeb94778f8f3ea94abf63a38d3cb52dadc00fa4998f1f13f7b1f7434bfde7ed63e9ae31bcb9bb6f8511a60b4cedcc
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0S+N0C8oYBonQsx4:l68Qg55nhkeWu7PNU3/czyBxsx07xO2
TLSH
T192B55933B2F600A9C44DD1769F4A873196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 98ce2230dbc32a7b95fa14183128d4b5256a05cad38732d3c6bdb181b2b3994b
MD5 c80f806db34b8714fb5dd850e294f64f
SHA1 70c21c679e36a1ba17aa4876a5519a43b1b7cd6b
SHA512 a5bf3ad65abe6c42c002ca4725d7701bbeb406a26a2790a58683e20200060fdcc8380527a40151809ed8f841f629b105296cea93e411d1eb873e32afb9a8557b
SSDEEP 98304:Ky5112gYy5azzVvU69nLKnhZzCC07xO2:zLIHRWhcC0E2
TLSH
T1CF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 242e0132a438416b63f791c9ed4483d2e32c2453e7d81e6c8265faf87153c50c
MD5 eea31247f2513a4ac30f64ac731d9109
SHA1 a5646b9602eb1d5efa13fa098ffbfcb70580dd05
SHA512 e99d04becd88ed328006f726405d824ef7b503ea2df857da70d7ac664faa5fc7cf921244891129a2a0225fc516af34a72a1e514849b4266d9ce7a248398b8070
SSDEEP 49152:9B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glGzyBxsx07xO2:ju6JmIxd2duCC07xO2
TLSH
T1F0D59D13F1D901E8D05ED578974A9233FA62BC490B34B6EF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a1dc0401b94c0d286cbffbc2637e821ed1e752060e1e26442bf67dc9019cbab8
MD5 5990e1b0aa31653feef5582a3ea24e27
SHA1 18316e469f08916f23a1f7747959c8ba9f0efb0e
SHA512 0ade8c0801d6cc63ddab880f94eb38f416de83d6d1c24a09c61aaaa879fa8058e954dd12ffa8552278f8905bd7e9f873b1af8e21ca56cf0537fb3903e807d2c6
SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4xyzyBxsx07xO2:QmifPqRlCC07xO2
TLSH
T17CB5BE13F2D901E8D05EC17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 171078854cb2ce5e247714e7e272be9a9d6ae35ae24693d42c55c7aa2de1c12e
MD5 7e858705d480c6ab106e5d6765e6bc0e
SHA1 9094eb869ee1ddf307331daf963d849cdff64d1c
SHA512 695e92e3579b703eebb7474762c3dab843cb8248d5a8dfe13d96738f0da6d0f755b3f3a5b31a2f91af6254754cce1e4b6e13c2a7236b5cd8ad20299b8c43bca1
SSDEEP 49152:SSuZQIY0Be2KkRVtOnks6NMHq7zyBxsx07xO2:M5dKqi61PCC07xO2
TLSH
T1F3C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0ec5d40034e82a95f192afcc6288119acd2d3b72c4de8948f9ff86f6a82ca41e
MD5 28162a113fc91a7833302d8f31b768fc
SHA1 593da33ecfde480995b4159749c5fd714b1b3b7d
SHA512 439b99d98c219590e4452ccf74f9d5651661dfdc5e7db84c6fdc3aa53604d19be10de48646a828990b527d5fd4793174572410c100feccc674af634239de75eb
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5wWzyBxsx07xO2:JX2iWph5CC07xO2
TLSH
T16C95BE13F2D900E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d053d781fe96bd3d9adf440283acc7f655a804cd796a03e778f20fb3a1cb4052
MD5 7f1b0511e4cb3cb2543dcdd1d36ed587
SHA1 54c783b9b62d64c220768f827f5fea9225567c00
SHA512 eac08418a46b3d8eb9a30108691271e530a090fa1d4c1c59e7b42acb314500adf745a249807988d6388f5523a4a6c6f8175ea8e1089ac0ccd34a7d113e3a5ef2
SSDEEP 12288:6IQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:6m+N0C8oYBonQsx0zXxOtk
TLSH
T1F365230D28DC9187F7C946F1BA8A48F4369E7DD5B6A003A9958E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 624082f65ded603289351181b42ec7b4690c8f1eecda71a47ddebbc737cb08b6
MD5 4b0c0444abd685e9c86d49875e5881ec
SHA1 55a41d8ad1595d8229a3e2ac684e0ea757da9f11
SHA512 a326f6764a2e1a0556cbc6b8b14a3a32418e89b2e2a139fe807f2d3aed7ba67e3c88619ca526e24558e19ab392ffa64d409c4fbebec2f47f03af8723b27eb038
SSDEEP 12288:fbQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:fR+N0C8oYBonQsx0zXxOtk
TLSH
T1A165230D28DC9187F7C946F17A4A48F4369EBDD5B6A003A9A98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 eebcf0fa4819751823c79b47ec77c9c386c3bf8d2d5f943e084b6e92956a0b8f
MD5 d5e367d3cc3dff74aab8b9816f14ee4e
SHA1 a41d861fb4d7b1af92a9835402f607ca48d7f728
SHA512 f37103d03433ccc0a66accf63e160a60b004bd7b2caf8fc10adae9756ceb07de2de57de398642bc71484413ef91d5d41ecd83fd0c4b9a3b2cec39d829d2e4284
SSDEEP 12288:eBQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:ez+N0C8oYBonQsx0zXxOtk
TLSH
T16665230D28DC9187F7C946F17A4A48F4269EBDD5BAA003A9D98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 76e9f0332eac1c607a78dca76985ee08e05b135ac2903c4c29bf927bce410875
MD5 26e451b1aa76714a4e4ae74fd0777483
SHA1 54c94138d66f6a6c1b012d8a5c9644f0a71ce6e1
SHA512 b757210050e343dc046d03640ea8086caab556d1a66df3d60835e6c9b4464700e5725afa5aebb4ba6a7a7eb435e7eff8d7cd82915137cfe5939f0eeee16412a8
SSDEEP 12288:0V+QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:H+N0C8oYBonQsx0zXxOtk
TLSH
T16A65230D26EC40C7EAD686B5DA5644F4B3FABCD4B77003EF9A450A2927307ECD826E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b6dbac54177ac257081ffa804921a40e03c6297cc3ce506fd72f4b44fb058ab6
MD5 18c9aa172cab1863d9b5191b7411c510
SHA1 51445bc425fbf3aad3b8a5d60bcaae7f82c0b32e
SHA512 6b9fdaa824e7ce88fc901111d78c6f6f4dda718c91025c4b8ab00b04b35d2d0e3036701ccab1eabdba556dae3c11db524312462cc9ffb42fd45d80367e7f5954
SSDEEP 12288:k2QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:ko+N0C8oYBonQsx0zXxOtk
TLSH
T15A65230D28DC9187F7C946F17A4A48F4269E7DD5BAA003A9E98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 567118da6788f7922a1e1724bbe9e53825a39715a5529b493f363b17d0a4c3c4
MD5 ff9a7687778242237192fc2de02e4b60
SHA1 60fb789f96fa6b6dde3e96783a4baffa5c0f770a
SHA512 61e13b71620575b2ba33cebe741c68e088ee4cfc8b07e983c39b770ba072195a68f5a47682b0ddbd7499755a2a1e717856ccb5263fd5777d31c5c74ae4619fab
SSDEEP 12288:T3QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:T1+N0C8oYBonQsx0zXxOtk
TLSH
T16865230D28DC9187F7CA46F17A4A48F4269EBDD5B6A003AD998E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 945ac16d80bd036083f29f06bd14df62d19515cbfa524c4b7e358e6df1e39f52
MD5 a9dbb508262721b05a5b6e12046ed4ac
SHA1 ce7e19761d91b466029ccb2f306bd581362ec125
SHA512 c1beab79796e4f0e7aa3e7ac126e52eb6bbc1a5a0ee8eb1551c8f8bad6f18c107b13205be25adfb91f278e6e3243f4e2d6fbc92ba492661ac7d844b3ca488438
SSDEEP 12288:wTQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:w5+N0C8oYBonQsx0zXxOtk
TLSH
T1EC65230D28DC9187F7CA46F17B4A48F4269E7DD5B6A003A9E98E4B2533307EDD40BC99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a832c2cff570411c574bdb02f88eb53100a72c75a13d11ff14cf1ffc4d462b9a
MD5 22b9fb6bf3522c8288386320f1595191
SHA1 840e0fc3af6aa9cc3d0c436fd678d8c3c42a14c2
SHA512 64e6ea9a332d0080ba924df875aa255e5a34e6c7ab89e8074822642e162b75013fb718d64be0427a6eaa9ddde7d2281748e0e6c0c20f1f3d9668baca92c7169e
SSDEEP 12288:giZwbDzzFEoS2cPvy7QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:jZM3zFVSOx+N0C8oYBonQsx0zXxOtk
TLSH
T193850199739018F9EDA7823EC9558855D6B27C991B70C31F03E836262F333A15C2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 eec1fccba07b79f25485f6658e893a0d9bc5be11eeed7a3ba6c3117a1c209649
MD5 835f2266ca68620f7ba432e0ffa137f2
SHA1 fa45c766e2b68a48c8bb28f41ab42b37d44c0acf
SHA512 938dd9087d1a10f4e96bdda993e62f7b5ba3c327e8b1f513f54e6ba289e01103e52e8cd729b463d323240540b668e29900a43fc101d26c8b13dcd99e4d3a4eed
SSDEEP 12288:scQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:sy+N0C8oYBonQsx0zXxOtk
TLSH
T11F65230D28DC9187F7CA46F17A4A48F4269EBDD5B6A003A9D98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f1b4437983accf55cea0ffbe63bc8cec20dfd79c6e78d95085de485dcb9c1367
MD5 25c0a853f4a936109b11077b24318fab
SHA1 e588c433a441dd7cd59b042043eefee06437b62d
SHA512 63e89e620cce36ca68afb28f631a9a40bc27d35240ad42eb793cdd8fbc9252048e0528400d4750c390c8dab9b57ca038e3feb9e9c59eb352a27ae65f80f998ae
SSDEEP 12288:FwQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:F++N0C8oYBonQsx0zXxOtk
TLSH
T1E365230D28DC9187F7CA46F17B4A48F4269EBDD5B6A003A9D98E4B2533307EDD40BC99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 743dd21122b96edbcf7c10ca0d8857a15705d6c0ec64912c192f78ded66e4a8c
MD5 aaf109488306ea570c2c131901aee12f
SHA1 a7e68fa16ba7ebdef04084bcc3892aee621746d5
SHA512 21a8d5c0aedc7ed5a997dca4ddf367aa9a445a4546020940ceda88e02f9d86c36d55448a736b82b1cdcca9516db728698eb5bc75e1c9dfbb115b218eef40e597
SSDEEP 12288:eyPz5L8fQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:DzyN+N0C8oYBonQsx0zXxOtk
TLSH
T13175120B32A430F9D2A68274C9920961F7B6B871576087AF57A407762F337E49D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 1fd2b228a3f699ca96ae62429486a497d7a643c507702702a137a0296a6854e6
MD5 ac8ba69ca2750541e5d21941efea59f8
SHA1 d7be6d9a0b555881f8e675686c4d3c9f65337cf9
SHA512 9c5ece2d57ef7e82a3072b884d05b72d48865ccaaf35a7457c3e00cb3af35880bc13c505d9ec45b897aa026d4e46d94594be5dfbf9120f0fd54f6a049a67cad4
SSDEEP 12288:YcQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:Yy+N0C8oYBonQsx0zXxOtk
TLSH
T19965230D28DC9187F7CA46F17A4A48F4269EBDD5B6A003A9D98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 2c19d545db290851946577052b033c289c68fdf74ef646bca718f7a6bde25655
MD5 fbfbd2dfd864cbbb0aeeada40448bf05
SHA1 af2990ffa15cf2527926073d74bc9fc844f62425
SHA512 ff6c595c60277328bb610592ff3394ad8ac9cb8e7508d541b58d5743241d2845e690e0dfe701119686559064a41a39d1af537efcd2ed355a576f789d9f621f87
SSDEEP 12288:DcQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:Dy+N0C8oYBonQsx0zXxOtk
TLSH
T19365230D28DC9187F7C946F17A4A48F4269EBDD5B6A003A9D98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c7ec5c948cf8e6e4c244bab9759e9f91caa87671c17c8640aa10fcd67bce7987
MD5 8e282aa216819c8a73fa2fa0e563e844
SHA1 e69cab969c8cfbaaac4e8dfa812e5d229ec2779f
SHA512 9920a30e6d4d52471f3ba71e258046f10a28879b767dff2a39cdbafd5c2b9eade7067f3ec8acf1b02cb2593b4c0e2e0214f4a12f7076d7ae1275eb3c6a28b93a
SSDEEP 12288:2yPz5L8fQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:LzyN+N0C8oYBonQsx0zXxOtk
TLSH
T1B375120B32A430F9D2A68274C9920961F7B6B871576087AF57A407762F337E49D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 5a819042fdb8de1681a943dbe595f297a74d3e7a1a07a82917811a519eb8b1a0
MD5 3c7f8f12a3ad1f65da1069d86a92fe6d
SHA1 cd5b572f36f4d697cc14f7a02f16304face35456
SHA512 34e48773c0c17864199b27179a398cf0d253ccdca89cc5416ed2eb0935aef12e79e1934073a4f7a16e39f91a744f031982fc2f28fc2ec0341f2cef5f1f3881c0
SSDEEP 24576:jT8aLl3z0zDD+N0C8oYBonQsx0zXxOtk:jT7LljtzyBxsx07xO2
TLSH
T18E850199739018F9EDA7813ECD558855D2B27C9A0770C75F03A8362A2F333A15C2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 4b8527f1ad3a5da5fdc5b41a0a92d95b94721aeb83500dd0779333c8791658ae
MD5 2c2d00247cf3cf66c39dd7bbbd531c69
SHA1 513c808450f2302b14f461222676aa6da0fefa5f
SHA512 a48e7a13bc08d1e61e895a66c758215da7c37c1df4365853c09c0c15a7a7bc013f6966464a3d33cc154c06ebc7c0081460d56e08f6629e31b0e1d203a91adf3d
SSDEEP 24576:m3rd9CHKy7GZn+N0C8oYBonQsx0zXxOtk:Ird9CHKyaEzyBxsx07xO2
TLSH
T13395CF94F3E410E9F1B78A358D764511DAB67C991B71CA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e30e786fd624c9c6d3c9639f03942b2ea8a2d50d2916a1480b5c06695b62172c
MD5 7a44f383b7d1c987fba6451e65866dc3
SHA1 32c36614c5d87cf7f6985238fe0976caad3eaf9c
SHA512 e88c9c681dabeac8b60d427c58446b45fecf501f926cb69abd399816693487e8fed06bdbd1bc80b9344fba3fce06c332c9d74da66dc897e561653eee06a12eb2
SSDEEP 12288:QhQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:QT+N0C8oYBonQsx0zXxOtk
TLSH
T1C065230D28DC9187F7C946F1BA4A48F4269E7DD5BAA003A9D98E5B2533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 504f5a1cb902534be60748d5923675124f5684cb39eeee73657818b0a8a51e1d
MD5 203c406703744cfeafd6e2a345a8df3d
SHA1 4af6d39a9f7d273576aabc01365f58ebaa035cec
SHA512 f21068855f4ad969c9794cc6a1d72d719aea89b1d9a09476ddf13445ebbc300188200fa87c8019a33c8948b197991ef1b5cae0804b7bc95324cf27e37aec6218
SSDEEP 12288:P/QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:Pt+N0C8oYBonQsx0zXxOtk
TLSH
T1F465230D29DC9197F7CA46F17A8A48F4369EBDD4B6B003A9E98E4B2533306EDC407C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 edde730fffa1d16b36992fc0f46ded725b86a07498f24e2d79693091e5ceaa08
MD5 4ecf7dfb5fd3b0c9687d51c25cf6e750
SHA1 01399cf17a4f84af9705dbc0a0fda5eab73da9d9
SHA512 d281ecee116607134ac9ee48489da27b97960be23c19f4be16e78234576b58e56888f3e1541b70c016c006fd94705b0f44b4da968a24ad262a876916ed34e57b
SSDEEP 12288:SSQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:S8+N0C8oYBonQsx0zXxOtk
TLSH
T17065230D28DC9187F7C946F17B4A48F4269EBDD5B6A003A9E98E5B2533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 347282735bb702f5acbca52821ceaa389411574240e14298121cd1127a5c5fc0
MD5 27ef87c9e6ef2db7dc484ff899c8f613
SHA1 0e0acc5377dbd90222623c96dca015969949146d
SHA512 c091fdaffbd74a84f7cfe1e4caa4b0152c06c257c6acff5893f4bc0f7b59ae89a2d8cab7885886066f1d1b2b15944b6340f2c451a57e7a7fd4104d7317dde8b5
SSDEEP 12288:8cQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:8y+N0C8oYBonQsx0zXxOtk
TLSH
T1A965230D28DC9187F7CA46F17A4A48F4269EBDD5B6A003A9D98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a9232166930506697c56c09ca650a96c7cabdca642d5ab532f9b9432fa140075
MD5 ac5410463b93d05dec64ee74eb59d513
SHA1 038ba9bb70a6232d1c75019f8dfa589bb64a2fb4
SHA512 fe3340e3b497df4f1f7e93158ee3a7f52430655ecfe284242bae8c56a2bcc54a44749611ef17658008cbbe41a51a1e456d09f23835593f1adc55a5cb3e2b08e8
SSDEEP 12288:jhQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:jT+N0C8oYBonQsx0zXxOtk
TLSH
T18F65230D28DC9187F7C94AF17A4A48F426DE7DD5BAA003A9D98E5B2533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 367c1286e3ce108b8fb5385dfc96716d957c2e808ef406a1af9f46b858d738b4
MD5 118f8746e676d1b939115748c5bf4a74
SHA1 b83711e218df78ade250a3e747845f49e38d1646
SHA512 b1aaf3c6ad1e1ee2b3cfc9156c6cef9978b3e2e21f8153588d0d34efb8a3b9439ed5802c408bff63bd8eba9f37fa6c962e13b491814fdbcc418164811c134735
SSDEEP 12288:M0QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:Ma+N0C8oYBonQsx0zXxOtk
TLSH
T18A65230D28DC918BF7C946F17A8A48F426DEBDD5B6A003A9D98E5B2533307EDD40BC58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 4de2f34c09919ee80e49727ccb05f73182718a32eb3e6a6348201d363f494070
MD5 4dc4f630eeb3b7f2dd218adab044fc19
SHA1 8ec7b759d027a5bf96416348cc89a07075f0eaac
SHA512 b76a0c47c7d709a8cbd8a6402a7e0b106888019a7516e9a926b4d4a6641b5f707e6641a7b82d6d019ca8f67212caaf9f926a827a69fbcc5eb7463595e9ccfdd4
SSDEEP 12288:R2QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:Ro+N0C8oYBonQsx0zXxOtk
TLSH
T1CC65230D28DC9187F7C946F17A4A48F4369E7DD5BAA003A9E98E5B2533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 3677fcc3a0021028b9975f1de1ce2aebe66c4ff0291e7074407beb0d76691d76
MD5 a118f98b48fea39f72caf391a94be8af
SHA1 cfc49f976ec82eefca02ca81f15354e71caf16d7
SHA512 56f1b7de839b9d3f44cebb0b9fef59974ac56d06e0a98dc21ae465ce8c1b47b005c95ff906757a2a805a4d30a684607833cabbc87570d9e3a568540f581389f1
SSDEEP 12288:XJQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:Xr+N0C8oYBonQsx0zXxOtk
TLSH
T1DB65230D28DC918BF7C946F17B8A48F4269EBDD5B6A003A9D98E5B2533307EDD40BC58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 7ecb574d124e7d2307d022bcaa6d0b0f9d2a3352580c0b46910fb631d8118f90
MD5 444afb3f14e7b96ceeb33a914cf4d27e
SHA1 e71d893ddb150aa8e482d690102398393272e51e
SHA512 1da87411086a0a6b965f8ceb528947b63d7b570ed6ed5a988838489e23d1307b42671494567419c48da97fab30e0488b5c8ecc3a8d3c34297b0e2b1f31458b51
SSDEEP 12288:p2QY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:po+N0C8oYBonQsx0zXxOtk
TLSH
T13865230D28DC9187F7C94AF16A4A48F4369E7DD5BAA003A9D98E5B3533307EDD40BC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 d2a0c44eeb5f6cf827a863fe5d4a19d8252c12f9efb3475a8299a5eaa475cc8a
MD5 509024abb890ad53414912b95f889540
SHA1 f7f6bab1dac64fc0c794490c69e3810acc8b9d66
SHA512 531d4acb0186fd4bae5794e8a326028cecb4c00a6aa8dd58d9b8871be35a87100f631ac920da771d4a0f266b42f57065e04dec7192508e44e4aac43be8045bf1
SSDEEP 24576:rfwvzk9RX6wkyAIu+N0C8oYBonQsx0zXxOtk:+MnYIHzyBxsx07xO2
TLSH
T1BA95D02DEBDC44E5E1B7823C99A7464AF6B178591B31C2CF029A536D0E33ED49D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6b6ccf96a4b3ec59a5a79028249cebd45aa0c016c29af8cc8f33e0be7d5d97cb
MD5 ea131f9e22f5237cec50e17318722d1d
SHA1 7a0fd2ea542147edadb70cb0441f2d43683c8c60
SHA512 79376f79d22eff0654c0d2ed6bd99834dfcbc0475d38c9a369f06cccc968e1fd3a532da2e9f4d091ab849e71eccd5e665d9ca519315387b3ed693132651c23f3
SSDEEP 49152:sYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02zyBxsx07xO2:jySzPmCC07xO2
TLSH
T115066C56A1A801D5C1B9C1B98F0BCC1BFBB134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 93e3ab39fbff0622282b587f1ef4bad0611c12d95be60a865adbe0a82b36ce84
MD5 86ff6fa8867efcadd52fb2a7d2dab081
SHA1 acb69737e6b9fa2f41cea390fbc4f0c65eb82a08
SHA512 6619bc3b4985ff0da0aa52fc037aaa9111416adaa7dc3c3aeda8fae0ca53c9a96f10c48b768d69537f0ee4ee76612669a44513584d83207ef99eadc5f4179746
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYh+N0C8oYBonQsx0zXxOtk:n47JUQjqirIhCnDHUPfF/GzyBxsx07xb
TLSH
T1C565AE1EA3EC01E5E1BA827885154A5AEA71782D5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 4168fecc8a0be742817b0c54bc80595fa6d75e1bbadc03b021ff71f7bda0ed4d
MD5 4f7924eded406a7a30351c4b03b1411a
SHA1 597f30f5bfb1c48fdcc0ad8a55cb26093950ccfc
SHA512 3d6bce9d7467426a60851d73dd6d02b0fb81e02d3a74dac21e5d9cf5ef237c12557026e9412aed3fc343aeb03a774c04171809a4328fd9fd12927576f12de4d6
SSDEEP 12288:OpsfMQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:HC+N0C8oYBonQsx0zXxOtk
TLSH
T11775010DD29802D9D1AE4275CB464990B3777CA597E0D3CB56C0FA3E2F356D89CEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 54c05c46af685429d8658432029020432878882e219064619fd0c88e5e93c99d
MD5 92ec833ebb7f98c0161ba93d4fb321e2
SHA1 99a09a51bd6e60d10cdf3b777f01912da72b6860
SHA512 2e2e89ca99da8bd58ef6306748e667c53b5e365e9507cdbec880b01b786a860745db88d51b374ae4f6a74eb66f4626036150a78a1c54f3213bd2e849f8ffe760
SSDEEP 12288:B00iU3fissstYYIjdNbEEAd1GIx167aUYGLYGeuue7rSaTJRMNB6CNg:B0rUP1ZIG7x1hhGeDe7rXTJRMNB6Cq
TLSH
T1ED3528007626C74FC66940325E36D2CCABB07D42EE456B0373C8873FD576A58BAF6692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 0c94dc8728bd1d1d7642ae22d30e6374f3458b538712baa47562b4326d132c2d
MD5 55eb77dc9f090d7c7d0cd09fd6b31321
SHA1 047873379445054d2ba7dfebeb44f72917ac052e
SHA512 6732bb2f19aa90338bcf2d65cee61ff3779c35eadcbe667b1aea56797e05b618bcc7a3b6a5a07e4a82e10b41c3faece2216169d40f28c9b7d91cbc23bb6e0c71
SSDEEP 12288:KdNbEEAdSkdNbEEAdl0dNbEEAdp0dNbEEAdXMA82ZK1Y1Tvoc7/2EErQuqF:iH3eWLzSJy
TLSH
T1FA75D9419137A38FD1BA20320B2A5B4C77A4EC16B7056F27B7C9453AD86AB11B0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d812ca263abdf939efdbb35d604730abcff907fd2523ec2f495f81de17839683
MD5 6471a181e1a324ed5dff5875834143cb
SHA1 a2e83bfea6c09e8940e72c638aa26e4eb09e8936
SHA512 4f5ae09e4659e5fe4e424f62a0ac2810705728ee685159c20393e1547d101ce646d7934bfdc65cec34ad24b6bf03d316911ea76c4d8b6b9accd611cefe9c8820
SSDEEP 12288:7M7kQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:gq+N0C8oYBonQsx0zXxOtk
TLSH
T11965230D16DC9547FBEA4AB06A4E44B0365FBDE46B6043DBE8495B293330ADCCC36D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7ba30816bcf09d57b56816173641a55112a2f83923441ceb3d4b2da44d3ede0c
MD5 65a740fb442d9455e088747c4b2443f5
SHA1 cad1193885124519e19a1c39aed1bac8ffdeb9f4
SHA512 7db8bef13d3b096d96c4f9611e9ff6e98776cc234178848475ec61a0cf7ea7a9586e1558810f2ff598145407f52e8ce131feee3ed94fca9df3fb111ccba1eeb7
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYU+N0C8oYBonQsx0zXxOtk:3gb4mBIBhGFQzyBxsx07xO2
TLSH
T1F165AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 222ba7561bef6d8fb7697e13e0a38a163f4bfe7c49b3f28cace0ee393fcfb6ef
MD5 4d0c5b0b60aa529f659d85bbd11a6f0a
SHA1 170dbc0d311fc29e1ca04be9e7a1433c5b3637a9
SHA512 97f69fab0a62aba54ceda2a6d8445215158437f97060567025bbe4d20644cdca0f5d4eaca1411ab76ee14b5da48a6d13e05139c385d45dae7c96af1f6f2ae064
SSDEEP 24576:0G88u8FpJqH1vzria7/mx+N0C8oYBonQsx0zXxOtk:H7ZFPqVya7/FzyBxsx07xO2
TLSH
T1D995F16576E001F1D47BC138898646A3F6B2B8251364EBDF06AC8B551F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e5c8ceb7ab70a663591746c2aa63941ce95e4ff9fc6d3da8928dd8f79b379c92
MD5 55e3b7241c8fdb5c87784057f1075180
SHA1 5591b960f5df53ba0e4e2415c49a416ab97da195
SHA512 b872a303ae34211af664bd9a077a42378a6a428332fa4825ac0d470cc83e4032f4ce974b56a552d91f9d833a9b63bd22b26de622ea87e0832cee3e3f9c7741f2
SSDEEP 12288:RHvUrBFrEjwaQHQY+NFq0f8YhHTQhBTMZnnQpltCx0GwXxLK2bgk:RPUr+NQl+N0C8oYBonQsx0zXxOtk
TLSH
T17A85E11F26EC18E5E67A917D89864659F772B862171193CF02D1817E1B23EECBC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a482b2beac601b1a991a638277dcdbf1d7b4b9a9c2755246cfc5107f627e652b
MD5 9a5fa8895f4bb4464ef20fcc745cedd1
SHA1 6312fcdde787328645813781d6638fc0f7db788c
SHA512 3885321421b7d8a506524feb00aba6d2e5396d43958daf7944576bbf4a07e6e8537b31432372b82b9ddad13e76034db3cac808faeaf6ce8bce2c39dc7dd6bf0a
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0zyBxsx07xO2:OG05lO43brCC07xO2
TLSH
T10FD5BF6E62EC11F9D1BBC17CDAC64A0BEBB23815033556CB02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 29df1426bda2c0ec9a97dbb06a7e38564287742d34f1d14297252c637fe6a8ba
MD5 479eeff2b950c46a33def1f28fdfd423
SHA1 570a38e33ed3d5924ef2cb56aeb409778a9e6698
SHA512 904e699e316f1fcd30444807f637751d7eb7691169397cd63e5a8337b569005ad7bfe60eb999dd4de39efe442ea692c562ae31ceab686a98797d14e3a0b6c214
SSDEEP 24576:Ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidnP+N0C8oYBonQsx0zXxOtk:Fa5POZ3lJt2pasx2+mczyBxsx07xO2
TLSH
T1A465BF5EA6FC01D5E1B9D17DC5838A1AF5B1346153319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4e6b3e705982dbd83fe9d33666e5569d952d42763720357f518c600400e1b6e9
MD5 29b3e8cff54bbd31721deab72cd96655
SHA1 b0adc2b6def40f3f4f3c086f5814b5a9ee293f6d
SHA512 2ffbdf2dbef06172dc6a4da897a2b6518f8f62f59c1107515b5c95603357913556d811adc3bc021d6b79c42587c32663cfb7c8751bde170490012580171189e3
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkJ+N0C8oYBonQsx0zXxOtk:6Nc/zEOVHFlzyBxsx07xO2
TLSH
T155857B1A23E901E4F5BBE1BE89679546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f56cd8ef136fa55f2a99979382c233811c11257c8bfeb44d1bab7fb90e5d3f3a
MD5 977f6d7d16dbc3aeb600cebc8b70639d
SHA1 3ccb14aeb0c985161fd793d37e9576066345359e
SHA512 94e8511bfb4441cce0e5b026b3224ee26b5d296ebc4fafc6b5c363a06f34c99c6aa89a642532cf1fee1b48c3d9d112d81ebb84271563f849f5193f1a2e03275e
SSDEEP 24576:wzkNvNnaFeYhJNtmZBmr+N0C8oYBonQsx0zXxOtk:wzMwBtOmizyBxsx07xO2
TLSH
T18355AF2EBAF846E4D1FEC6B58D238512E6727861173253CB5290C13F1E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 222f113353f6af1b43152864807938602e4dcd667c2518bffa8731a81c258747
MD5 cbd570ece08fbf8cc12466165ffa0859
SHA1 3f4a10ea761ecde2de213cfa8414c9f138f33f21
SHA512 53de4e52f5e9db73506b75f1606b8ee6c6e724712f4a880046f6e9a54c010d61f0de198bc00b118fa25a6b694b4a840400bf983eb174e05c1b3bad0acf39353c
SSDEEP 24576:3D3FHshBIYQgAG+N0C8oYBonQsx0zXxOtk:3DVHeBIAAvzyBxsx07xO2
TLSH
T11E95E13DEA9C04E5E57BC1BCDA538906E77138A9033156DB02D481BA1F6BEE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1504-79-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1504-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1504-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1504-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2616-80-0x0000000000400000-0x000000000064C000-memory.dmp

Download

memory/2616-86-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/2616-299-0x0000000000400000-0x000000000064C000-memory.dmp

Download

memory/2616-81-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/3232-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3232-116-0x0000000140000000-0x00000001402F3000-memory.dmp

Download

memory/3232-368-0x0000000140000000-0x00000001402F3000-memory.dmp

Download

memory/3232-123-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3596-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3596-66-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3596-0-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3596-298-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3596-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3596-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3596-295-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4400-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4400-53-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/4400-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4400-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4400-39-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/4400-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4564-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4564-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4564-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4564-380-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4564-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4564-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4604-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4604-252-0x0000000140000000-0x0000000140284000-memory.dmp

Download

memory/4604-63-0x0000000140000000-0x0000000140284000-memory.dmp

Download

memory/4604-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4656-74-0x0000000140000000-0x0000000140280000-memory.dmp

Download

memory/4656-284-0x0000000140000000-0x0000000140280000-memory.dmp

Download

memory/4656-68-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4656-75-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4768-128-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4768-140-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4768-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4768-134-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4768-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5116-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5116-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5116-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5124-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5124-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5124-365-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5124-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5124-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5124-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5160-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5160-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5160-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5160-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5160-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download