a3883d610f0599269ec86efc31a3c8762a7f6d7f31520139db01eee3c65ddada

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
Size 1.4MB
Sample260715-m87dwsav7m
SHA256 a3883d610f0599269ec86efc31a3c8762a7f6d7f31520139db01eee3c65ddada
MD5 ec233fa5d03fb41fd38d8374530dfe21
SHA1 9bc53d8ce7f4dd3bff5e1b6a4ee7d3e3ebbaf3c6
SHA512 15d9cb76385ffc584f1d5d43a3952c98b701f4a65de521a23679e85298db5cb676e2541be3c579d1cd1956c42359c99b7ba2b6fdbb01529428668fb43b64421f
SSDEEP 24576:C4wRy6AMwn83e1NeeCntzypjLwXgrcQBLKgK52VoN:mU6AMG83e14eCn9ypEbQNKoVo
TLSH
T1DB65124F63A931F1E0B39239C9A44685EB767C351621CBAF439623072F365D1CD6AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4860	elevation_service.exe
5700	elevation_service.exe
5708	maintenanceservice.exe
2760	OSE.EXE
4208	PerceptionSimulationService.exe
3508	perfhost.exe
5532	ReFsDedupSvc.exe
1460	SensorDataService.exe
2952	ssh-agent.exe
752	AgentService.exe
4240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be79814483806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\RepairConnect.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d15d36b4a14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7bb2e6b4a14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d8d3d6c4a14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1faaf6c4a14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c86646d4a14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c82576d4a14dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4188	2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	752	AgentService.exe
Token: 33	4240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4240	SearchIndexer.exe
Token: SeBackupPrivilege	5532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5532	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4860	elevation_service.exe
Token: SeDebugPrivilege	5700	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 2576	4240	SearchIndexer.exe	98
PID 4240 wrote to memory of 5284	4240	SearchIndexer.exe	99
PID 4240 wrote to memory of 5980	4240	SearchIndexer.exe	100
PID 4240 wrote to memory of 2740	4240	SearchIndexer.exe	101
PID 4240 wrote to memory of 5196	4240	SearchIndexer.exe	105
PID 4240 wrote to memory of 4348	4240	SearchIndexer.exe	106
PID 4240 wrote to memory of 3012	4240	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_ec233fa5d03fb41fd38d8374530dfe21_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1460

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2952

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7871c29cdba9e93397f51a82c57a72e8645ea869d5ae3e4185c7f4b7fce7e6a4
MD5 9af25784c71e0509e73aa0a3c8e6317c
SHA1 9677f92d1271387dd1986806133ebb2ad7b89749
SHA512 2e960e7f5382386a868b2012a9c539166167395e75156d7bfdfb15973de161e2ef8d49d4288797510319aef663d761b235bf46856c0b9c71ce077a68a17e27f3
SSDEEP 49152:Hb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn3Cn9ypEbQNKoVo:13q6tjB3n9mWQVVo
TLSH
T183D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 aa87a0e356339750e8a8b2f84bda634f179bbae6c91f5c97e29bdc3377c52b98
MD5 4eb3e71885d3b4702fbc79173fb4ae31
SHA1 c81121c1779e7ac614fb5f2bdd8c7e338cc0f7ce
SHA512 08f61a5d61a7b75c763971437ae33318c864483e4a7b39b1fde5b3271653aaaafd78d08dd989dca10fa80a8c8c4dddc4770f8dd638955c9b0d1b4fa695050772
SSDEEP 24576:oXYfDtczAuCntzypjLwXgrcQBLKgK52VoP:/tcdCn9ypEbQNKoVo
TLSH
T12565012CA3E509F5EDA7923DCDA2C101EA337C5147A0E6DB03A4A9261F336D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c38a7a21c8818337e0c95b79f0406be38a1a8575a0f9477115e96d89b9933dc8
MD5 ab441914ced130b618e60cd3a7311a1d
SHA1 ad4f700ffd60622a753dcff959c24873c9067350
SHA512 ca3f6352b26427f7fb8eae2e926a126f2d99de68f685451c917e961d79f81982fa14255043fa438c02bc346444cde5b193a8a3e43d9f2e3a5cfc771eaaccb7a8
SSDEEP 24576:k0Le5ji0hmxnrMvCntzypjLwXgrcQBLKgK52VoM:kPji0Ax4Cn9ypEbQNKoVo
TLSH
T11A859E1AF6748731D073C0B9C5D2A68AED7130865B3089CB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8985e9157c212c89cc4aaeed6167d8f7dd04b7003ad0c946426c55741a643f9
MD5 c9049188c16ebdb4b7ed5a8cb472d46a
SHA1 ca8b348710f92ed2728087256c5d1f29fc96b888
SHA512 c3b430c862fa91b247682fba094f789932417671648799ffe6ce981679996f5fc6cd322635170ea8011eea38a5fe62c0d7d11e0c543464efbf3c98b2214180db
SSDEEP 24576:Oa7/ezSC6vUyDZaqgrvWx6q8wyutCntzypjLwXgrcQBLKgK52Voo:J/ezSC6vURPvMHjyECn9ypEbQNKoVo
TLSH
T1B0756C15F5788323D0B3D0BAC5D6AA9AFE3230465B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 034bcd35493d90c2f59bf6102af63c8536125af88d55f14b21f5abd729877150
MD5 f907f9c94a01096f1bf16b902368ee1f
SHA1 012b89f4e6a84f990cf7fecfad5e9a41628ba262
SHA512 92ce50fe7ae8601b827deff7c630ee9811d67ccc07a1f37f5a2c12369bab536eec7224ab5f64c81884ce9efd8d70233db484ac7fce55aa990360c4c2ce081724
SSDEEP 24576:RVbqPb88hv/lV7SCntzypjLwXgrcQBLKgK52VoL:RVO88hXlVWCn9ypEbQNKoVo
TLSH
T11B559E6AF5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c1bf2b07c5b3f73f3eeba626b921aa0b0965cac01fffd813839eb701aa05de72
MD5 2c31f6e25e31b9164907642da6c43c70
SHA1 9ce80c024967a5267fff01f5d100475d08b92648
SHA512 d2897c9145e0beffc44b8d2240ccd23785c5d092e8f98325c52eeeef423a4f2abf8ecfd82de0150658b64a22cca17f7871393432c7fd77a4bfe29c45686245f9
SSDEEP 12288:nGs+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofx:nGDCntzypjLwXgrcQBLKgK52Vo5
TLSH
T1F845230D856D0772EAFBB67A9EE9C2C5BC757C906889C0BB845B3A43273C4D1CEC6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ce7b6f87e058c48701c32f9d06e616808b4e7a810a4602941d129e5fcb81c1ab
MD5 dcb5a3771992e336f025e98aaffc0581
SHA1 d96bb4ecce2b7d450a5f523a933442c30389bcee
SHA512 610be00d9d705bf8aaffe379d94ee335cd65cd902233af07d19b8ea3344f4d9e9fde0134e8e2094fce82b125150b5a9db3fecb950c0da605631ef3a6d02db015
SSDEEP 12288:9eBNUbTVO86Ub+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVof2:9JIUqCntzypjLwXgrcQBLKgK52Vo+
TLSH
T15E65CF3BEE28FCE2C27B9D795A91C240E77278304F5293CBD165820E9E235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8b77d5d4afbafbfb980e5cba9515ec25879be6c52550fce890d870aae9bfb759
MD5 49576408699a3d0eb8d5375ce50feea4
SHA1 4413f809a8789173bac1bdb61bc39bddc87f90a4
SHA512 f25a390563ac20de8e89d7fe728a92585ab2602da49e3598e1bdbfb9b50e7e57d3f8ffd0ed43cd2a8fa8a1dbb34c6e911d16e3089bb3a0ed58feb7cbdfb0cf14
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THh:yQvGAdlCEL8c/pRNw5C4n9mWQVVo
TLSH
T159266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 eba3b544e77e142b13de3756fb0f4e195af4bee46bedc6730b97319ea95f037e
MD5 8edfa6a9acd5af774a37c9cad8a79990
SHA1 a76bb657cf208f0bc27617b72e35db028f15dde5
SHA512 98cc9d0341e386f404f26e66d3c85c1e56ac35f8846dc342f9ba77f7c95c221ed89d5c8e3b666738d488d48d70a4e90676ed8807e0bdee9a2a9a31a2010f4643
SSDEEP 24576:fwewsAjICntzypjLwXgrcQBLKgK52VoH:YljICn9ypEbQNKoVo
TLSH
T16775E031FA74E032C6BF0DB61B76C706683D79204F9219C3E3A85E8E5A341D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d251242aaadc294e7e1df8a40d12b771fd813cca58201a77c4dd7930664bfc10
MD5 26abb1671a92c179d9c6c956556a6d0a
SHA1 923df04ad700719069e882016677a24294b0289b
SHA512 98a91213a2983b805ab59ddc4aa507eb4e7d07184aa241d8a7dbccc7190323d36cf011db55990f29f2b7d80d1a776f3286d5b49c2bb6340fbda051b963888768
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH3mWQf:wUEtQevvqc2W1cpV29I323mH
TLSH
T115474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fcd5a0b9ca39bfb8c8195c92f8fd84767d7b8121901c8a91cf86e4724047bdc9
MD5 53fb4fe5240d969bd890a3646da6996a
SHA1 34dc68c6bd7e5bf19df2bf5430aaacc1c2916928
SHA512 8885e87c45999c7b54e1ee55e41e75990e96911a9ed5c3268daa0a9884b8ad38b93ca3faa57ccfc2ccdbda05ee4f6348cbb2efbf1001507222c78c5762c3d331
SSDEEP 49152:tCbRquA/m2yL5zTfFiV+XenmE3/zoCn9ypEbQNKoVo:KoquVjnmUn9mWQVVo
TLSH
T112D58D0976B8C2E4D1F6C77886A2C647F37178154B3597EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a4b34d9b5d30ab71df901615d26baa0ea32e1d1e93706c061a96e59187ff91aa
MD5 a0af04214aa4d531fc67368a8c39ad50
SHA1 f4a3ae2e6c0148a46ef2a0a4df5781a16284564f
SHA512 c5fe1046631fbd14194fc61cac0893ba2bff2fc54a90eeee2b16ecbd5f76071b0d98d3dcd2007369e0d16aa7ec0958fd7a4377e88f690b8a3759ec4215f2b31a
SSDEEP 24576:4AhGLmIFoiwtA5l7S53JCntzypjLwXgrcQBLKgK52Vor:4AM1Foiq55Cn9ypEbQNKoVo
TLSH
T17E359D84E7F955D4F5F3AAB899B68170E976BCA65E31C21F2160D10F1E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4c1f0ad86aef6f73382e13ca778c1d37faf66d4b82c9cb6cf2eac9a4083f5c4e
MD5 e605571cf2616fcbc982a3c12a64feb9
SHA1 e06726120261660c580266136a4cba1a4a5dd250
SHA512 fb56fe199285e89db0b99fcaa51b31949a6974eeb110869dfbc4c1d3279c55ccd4de16fa7bcabfc35bd64b5aed86393668eb647cf57ce62367edbf63540642dd
SSDEEP 12288:Qmw5HEjsChNOBFgl0WDm+Cm+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAH:NwuXOWkCntzypjLwXgrcQBLKgK52Voi
TLSH
T10065F14972A90CF5E9A79239C597C136F7F2BC012A25C72F0760C65B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2aa91a85f7a62a51bca7cf0929839919c8f6dfd290a0d7ffba50452a1358a717
MD5 34bb12045817b96d6652359fecc57e1d
SHA1 337f79f84d0a458cc6a4eb630960bfb5bfa26410
SHA512 e385df223670b4c83b94aa3b439d9196770b49962577a952ba1357cf20b418606dc53a75180607a8cddb4a9b9b1efcccd20f5973e83d93fb76414701311177ea
SSDEEP 12288:5bZ1IyR+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofa:lZuHCntzypjLwXgrcQBLKgK52VoS
TLSH
T12055124D22E821F2E1E7A23DCDF58245EB727C52277683DF012626572F369C19E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6cd27d069ca4162c2bf680bce36056b050f37ea51dcbc6ab7687fe577651d3e1
MD5 3a5da73f1beca3ac96bd068f83765747
SHA1 6169e18d3e112a82b48a51bacc6fbd3399f7bec1
SHA512 ae2c56ae5bfa755f89ef60c1d71e71b808ab4a4bf80c5f0d1159c486a37348d80658b1b88d3448b73f085f777029fa8b2b0229e1f4ce2de5dce8a6171f105433
SSDEEP 98304:wQRQyi36YOcPuLvw2gAf+PN37n9mWQVVo:nQyiKakX+PNZmWQf
TLSH
T1AC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d263beedeca63808389eae33106ff9611393609c453cc758d80ee2de026744b1
MD5 51d3f827b31ea00bc57758711239b509
SHA1 cc871c1a7d800226e3097b09f6ddcfa0dcca4a19
SHA512 a8a6dcb4f15116b403f4ef14dde0c3f463ee7d16d645b75fe5efecf8586d793f37e3eaee38e69b866ed070d2d3367c176584d3e36c763a9887b2ce61ed5b699e
SSDEEP 98304:PQRQyi36YOcPuLvw2gAf+PN37n9mWQVVo:+QyiKakX+PNZmWQf
TLSH
T1F9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 481f1efb29c706ee52f30bb5e96b46aed765a7227c7ed0f5837c38795955381f
MD5 287e882a8a454d709a4ab591eaa8da79
SHA1 37429f9ef48c1c17271d17b5eddae9c8fd3ef17b
SHA512 654cb79aa98070f7b1f73a5636ba0ce009a6e8f1b6f318df044a9879e01f7d4215a6fb7128d23a24a4580a627a68bfb8713369ca639fac4fb8abb49db69e85d0
SSDEEP 49152:R68Qg55nhxeWu7PNU3/4Cn9ypEbQNKoVo:PthGRc/Vn9mWQVVo
TLSH
T19DB55A33B2F600A9C44DE1769F4A873196E17C758FE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6e6723144e2179fc49a9af61be0b5a3d6acc5fe933b87d22badc49b5ee75f05c
MD5 b6471bcf26391a696469bb87bcd2918a
SHA1 3a7e32cb40174918b81f8e88a46faf4935e20c8a
SHA512 627a5388179a578d6f27ef98b61bb365a36f629e1041c9672cfc4958efa48ad2adba6fd45ed7cf4c9a74473530b93b4a1b0f970d6be8c6f7ea2f8a17f96a7c73
SSDEEP 98304:Qy5112gYy5azzVvD69nLKnhZOn9mWQVVo:pLIH+Wh0mWQf
TLSH
T111168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ea3156a1753c0e31438b31ee490a9a5eb88dff32f7a0d75de2ab5c8e64c500e8
MD5 cb3fe2249a5ff2dfe6d0c8c99411282b
SHA1 69b985b36e6d755a6614dfcb7c80d3e68bd758ae
SHA512 a6b08f3fa3b8e73da7e3523b566736560a8f2f33489c5f1108634a01c44acc80e9d95871ee68921f66dc1bc274446ddf32ec954a3baf63b28b30b5d56220f511
SSDEEP 49152:5B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gleCn9ypEbQNKoVo:vu6JmQxd2dDn9mWQVVo
TLSH
T181D59D13F1DA01E8D06ED478974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7e17d5ca9309180936d65ef4513fb81caabb588d6209d449a0befa921de698dd
MD5 682175b70536420a7e937e66997c9452
SHA1 fec46ea2a5f2e7d874d8e00d9ac073c3f6ec2129
SHA512 6d432b1490e19f6572eac4da244d1a455fef7572c25b9fbde90add89a8a5f232a6eabd0d808ac389db315cee12743b658b1dfd36a2627252e0fd1f4aa5f90300
SSDEEP 49152:i1hpsNoJpF1A6yU44CwH7R4xKCn9ypEbQNKoVo:imifPVRUn9mWQVVo
TLSH
T1A8B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 28ea94411125aee8222f848656679f268737504beee70d1ea44b638ba6b249c4
MD5 79cf87d7e7062715ec72cd4627656b17
SHA1 cea6b89f465ee9bccbf1cc6589bae2d22d4edc9a
SHA512 5fc34f5f02fc71f70db2f0d5ac5f83f680eec2b3321650d08792d23d13244625cccd9a896afc1bdcf8e837bbc81e8765cdc935ff086324eee6980211cf4bb6d1
SSDEEP 49152:aSuZQIY0Be2KIRVtOnks6NMHqHCn9ypEbQNKoVo:E5dKOi61in9mWQVVo
TLSH
T105C5BE03F2E941E8E0BEE6748B659232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 23f21b967b363d9ecb4a6917b9c1b9713f2d73ec9393be03e5ac546d62bc6bc0
MD5 2ec276dcae1aac54e1767b455834ea80
SHA1 327cb5ce73b973cc6206147d277d3575dd62f6f4
SHA512 5d809a248c6ca75437f3591b5c9eeefd01b5730c1f846e2a29cf3a68db21087da23dcc934ea6a6560007420281fe8b026bf3258d273be6a838b8d617897d3fbf
SSDEEP 49152:0htSn8EApI0figGgiDn0AP5wuCn9ypEbQNKoVo:VX2i/phwn9mWQVVo
TLSH
T1C295BE13F2D901E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a466b92e3d9820cc00086e217dcea3c654836d141a5f37aea3bfe99fe73a24c9
MD5 4c36186c768b31ebff41f2aebbfd074f
SHA1 939d1a8a0066c6bdeddbdc313c0caa5e494bf583
SHA512 f41eaf702b028843a1d6fcbb2b1fdd4bea81ea6fe1d869f43c856a6c1d6877b953234489c360bc5bf8c4505c5041c724dead51abc2538bd02cad4e611edf1b31
SSDEEP 12288:r0+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofV:r7CntzypjLwXgrcQBLKgK52VoN
TLSH
T1F245230D84AE0762E5E7B77A9EE4C2C5AC793D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fb1c30199330d0ef96f260f1d3bdfb2939d2e200c1b15507366da2fbcaa4d4ce
MD5 90ad1164afa184bb3e4ad0d97fc879a6
SHA1 9417afc9e16677249003575fba526784e1a2d472
SHA512 47f3b7a8ef3be7cc989e9819731005783f7e4a09f3e01f59e6be620467af4d65108dc3334991b84adf1330cd18518a180a811d21ca9089fced0178fc790f560b
SSDEEP 12288:jN+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofJ:jsCntzypjLwXgrcQBLKgK52VoR
TLSH
T1D645230D84AE0763E5E7B67A9EE4C2C4AC797D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8865f4d94847f3e71ce2eea49ecbf4a86683b3d64f1feb70e6303b31335a9c48
MD5 3ba3ab12f3f5c0659d01d1f02c7be1d4
SHA1 3bcbfb6f83bc4ea1335f331bfbfe1c7f741c67ac
SHA512 a701d7e4d1e83764847127c4170141d8d7f5527f14c7d8af8fd63c7a293be6e28d5f4dc7ee0da0401c6413e7c42e93b3a39226e70f5d9cbe336239670dce23e2
SSDEEP 12288:dj+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofJ:dCCntzypjLwXgrcQBLKgK52VoR
TLSH
T1FF45230C84AE0763E5E7B67A9EE5C2C4AC797D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 98a856e3f89d7b81b72373c6d150649816d6cf6f9a6f3ac93372c50554dd7023
MD5 caee9dc86586e0478ff698e23796aea1
SHA1 2a3a01d0b8354f81bcf624ee1979d33b762424e7
SHA512 48cc1b6f37ffe099db89d4c0bbbe57a097171f520cf110d1c79017faac9e26f32bb7d364148e1dcb7f20059af1b4c31766201e2c797f6467077405df4157f24e
SSDEEP 12288:bVa+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofa:HCntzypjLwXgrcQBLKgK52Voy
TLSH
T1B645230D56AE02E2E8F7E279CEE5C284F8B57C91AA6681FF850739071B385D0DE95B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f8991f890292f2698699e96e48d015e1cd5575bbcbdf3d3353d610d05c3dcbed
MD5 0833394234abbf20ae2acbc6ca7998a0
SHA1 ff2596c690b3863efd722e0c75432bda1550f1fb
SHA512 48288c95681ba77f2a8a040874f27df84a7cc75d1006fbe9da76f76833f2dcf9fbc0f9bf25c40bf725a6c039e374cefcd1359fa7d98d7ae0951a27f0bf35fbed
SSDEEP 12288:Uy+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofQ:UxCntzypjLwXgrcQBLKgK52Vo4
TLSH
T12D45230D84AE0762E5E7B77A9EE5C2C4AC793D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 529ab784bb3856abe7233ae97cf9cbf5084df1572598c479e8b4f3d65d290bfb
MD5 2efcdda4a1ab04f16526571580854f04
SHA1 d1f1af1b0393cba1314c5f99ab25a261b330ea4e
SHA512 aac5e26d142209addb9f593bcd6cc149ddff84ae966a0c6e6e2addb83643232b29a1b53293b098027d14752a68429d833176e2c0318e9e49cabad4676658786b
SSDEEP 12288:RJ+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofQ:RACntzypjLwXgrcQBLKgK52Vo4
TLSH
T11545230D84AE0762E5E7B67A9EE4C2C4AC797D96788A80FB845B3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c11b1e07c84a67a7bb962d3de10a54f1b5ae91c5afd9cd8a996bf23001f6c7b7
MD5 a7694a0563c80fdfcc1633e584551698
SHA1 1143a91ab15b96c8f0b21ecd61bb9d76ef8488ec
SHA512 629b4ebe59b696a6835fd9ac39ef77d77f8bfad931d1c368e7dadf00a226471dfd5b87ad404aa78aec72ca426a2d0a209f273c396b0f9d372c73d6af7f7d3c01
SSDEEP 12288:4F+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofG:4UCntzypjLwXgrcQBLKgK52Vo+
TLSH
T12745230D84AE0762E5E7B67A9EE4C2C4AC793D96788AC0FB845B3503373C8D1DAC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6b5d2224ac08c1207fc82aba721a4e96ed271874248bf958eb619ba42601b98b
MD5 ff996d0f4af48544459fbf34a39838ee
SHA1 1f11138831a9a8f69c9186ef61fb82ce83835076
SHA512 28196729a79d43918896d63eb7ccfb43bf3fcb7d2f0957f31ed3b13ab625b4af9bf97107d8908916b9e66995d3d537bf46ce606b4e5c555e3260f93e9e0920f5
SSDEEP 24576:AZMJzFVSOMCntzypjLwXgrcQBLKgK52Vog:AZMJzfQCn9ypEbQNKoVo
TLSH
T1A1650298B3A018F0ECB7823ECD658906E5B27C5A1B60C65F03A936171F373A15D2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b5498f4cdf625405a223bdb880fa6f30e7843bd527542ad55b07dfaccae5bcaf
MD5 be44c0585c5641717dc83c8bdbece4c1
SHA1 5b6dbe43c34265b0c2059eed3f882b12adcfd9eb
SHA512 2849b8f511b7b6f554ebe174c2e8614d3caa6420c685717d2646761194fe0c5dbfeaa0f513103bc854b813a7ed14a3943856ee1e9cbf7bb3cd6875c2716e5b96
SSDEEP 12288:II+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofK:IXCntzypjLwXgrcQBLKgK52Voy
TLSH
T11245230D84AE0762E5E7B67A9EE5C2C4AC787D96788A80FB845F3503373C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 415f0a8c4f4f67b19c51b51ba8c47501e68aa4bd8a451cab70fff31870e33692
MD5 25b81ca1b3b2a671df634ae3edba3558
SHA1 5157291c3c14857b8369d065b1e12079a3340d54
SHA512 b35f537641885387bf7dfc095accbfd28ac9df1a57e88f8f44f51a3ad473e53b913f655db066b870ac2b631fc8bdd17288856b40d2149164a8cf60a2b8e81fb5
SSDEEP 12288:nc+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofx:nTCntzypjLwXgrcQBLKgK52VoZ
TLSH
T10745230D84AE0762E5E7B67A9EE4C2C4AC787D96788A90FB845F3503373C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c4fd6cc9c7d7f5433fdf364fe3b3e0d67fe83ac1588c6464949457f4ccf9a793
MD5 fed088a14299d740ac097eb1b39c9bf0
SHA1 190bce17b73828002157765b6d0d8c33ab03204f
SHA512 bfa6cfe9f448398675b88dabc0bb50b9019cdd211dbd8ce80bba67f77c166ce07094fc6cb352cf220f66ccb548cbfcec158a8d810345fb8900ed4349ddab31eb
SSDEEP 12288:1yPz5L8R+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofH:czyYCntzypjLwXgrcQBLKgK52Vof
TLSH
T17955120F62A521F5E1B79239CDA24641F7717C321B208AFF436526772F366D09E7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b0ea6b32b2a89c4736a83dae0ac599e26e68e0f22359db54fe37cd9cdd7dee85
MD5 05dd0274029fb8f72fbe02803c7b36fa
SHA1 ba4ca930e2397c81b6bea5c03345c80ac8e6baca
SHA512 123372062022129bb9b76e2fab5b121f9dd9d4c46734107463f93d170486c2640e50fae1416b04e5e4c193d89afe56425d3306b302fe475de96ddd9fa990beda
SSDEEP 12288:kI+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofT:kXCntzypjLwXgrcQBLKgK52Vor
TLSH
T1DE45230D84AE0762E5E7B67A9EE5C2C4AC787D96788A80FB845F3503373C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 26bfb6ebf03e5badfb4d0fff2805ac4b4368bde2cceabeb8bd79b2b71882eaf9
MD5 f1f14624241cc88cc1e434120cd27259
SHA1 7eab18a4f5e5e01522bbd4a29d9a979c9a7536ec
SHA512 015e9ff29e76b4d0841f2d8d84cabb9e060093d011c986a277d71e94ce5902eaf96e271041d596b7abeb5f0516c53c0add223e0031e3b57520ce70e0454bba99
SSDEEP 12288:3I+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofT:3XCntzypjLwXgrcQBLKgK52Vor
TLSH
T12445230D84AE0762E5E7B67A9EE4C2C4AC787D96788A80FB845F3503373C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fb120b83d6f0b643a6398496a71012410a48136c0f2638a70583938133eb0655
MD5 d74476231a8476ce1e7b50be8405d05d
SHA1 7c702c0b0b2ec484555efe50a17c463ebfb44e24
SHA512 67a5e7899d8ff716e4315fb39eb077e559153d3a9074f78c375e88f79211ce1787021c7fd58205b63b3e8be7917be2b4b01fe3da53df186c755c132ea9284af4
SSDEEP 12288:XyPz5L8R+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVof1:azyYCntzypjLwXgrcQBLKgK52Vo9
TLSH
T18055120F62A521F5E1B79239CDA24641F7717C321B208AEF436526772F366D09E7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 02230ebcc5a2a48e3d22c78e5d3c24fd4ede7a378223195572647e22a9b0c023
MD5 e79d8a3697f6e6de3c6b1ea49f859c68
SHA1 4aa5a8f3264d6d5082a5be0a45af81a71645dcfd
SHA512 031b58e18e93bda97d2b0581721285462d508e29707ed79da446d653fde24725075541f4cf525002355d695db255b4c9d079a25fa2ce1e57c34fa66fac492d17
SSDEEP 24576:DTuaLl3z0zDyCntzypjLwXgrcQBLKgK52VoT:DTdLljtCn9ypEbQNKoVo
TLSH
T108650298B3A01CF4ECB7823ECD658906D5B27C5A0B60C66F03A936171F373A15D2EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 87fcc4945cdfbb20a1a1ad816ad71b9d899785850d44e2a9cca148f7f8120b7c
MD5 8b006bbda7500162b270dd29e6edccfd
SHA1 e6fd50b6a34dbe52d749ba5ef38c65d24b4962e8
SHA512 7c9cf430a32ce485de0705a117c9a0500450bc4442062ba9c9416c6650e1dff90935c18a2c9c7a82a95b7898623f164c620a0a95938c523f52a05cdb6c6a3fc5
SSDEEP 24576:n3xd9CHKy7GZmCntzypjLwXgrcQBLKgK52Vo8:3xd9CHKyaQCn9ypEbQNKoVo
TLSH
T1E875CF94F3E815E4F0B7DA35CD768511D9B67C5A1B21CA8F03A8261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0bc1b5bbaa7655243582652bfcbf072b4eaa921708863d4d1dfa6a0e0e9df782
MD5 15d2a1bcfed0dd0917d8fc9fe8fb5d15
SHA1 05cebef0ef7345a9e6d3faee8c985ed40cb9f726
SHA512 09b062409c101f5378c5da1e6587f93a61e83de507fbae0d8696db098e5c5537251dcada4a6dd429718340e627fef20ed653ff1d111e9f15147c4bd44e61dfe0
SSDEEP 12288:XD+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofo:XiCntzypjLwXgrcQBLKgK52VoQ
TLSH
T1FE45230D84AE0762E5E7B67A9EE5C2C4AC793C96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e997bb268dc7783beb3a5ff8ffc14ab9e70eaf90c3a78c278f75a70b01de5fa4
MD5 585b822431132059360785567e99975b
SHA1 afa3b8b07e3db4ea8473ba7ab0f93bb2e66ccd34
SHA512 1202e41dcf1431fe1e5082eba684d41ee0e4d8054c87a1d7be890de1bb78572e935c74ddd643ac1d1a19dc82a749f0ce4f706ce3779c3aa5c242aab2dada7fc7
SSDEEP 12288:ix+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofw:i4CntzypjLwXgrcQBLKgK52VoI
TLSH
T1FB45230C84AE0773E5E7B67A9EE5C2C4AC787D95788A80FB855B3903273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f8d5b344d024790d3ef33b901f2b83048a9b454629696214039a0d56b1c94a45
MD5 9533b6673d0942ba2db8cd073f346b67
SHA1 182463b72dcb78c4ce9e92caef26c229b3c9c579
SHA512 c1ae2834da70c7e6d1048eca8d87b6332260e05413aeda1105e016c468f31268761622750a37ef8caabf49b25cb35709f7b9af5682e955db85fc256074493be9
SSDEEP 12288:ce+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofc:cVCntzypjLwXgrcQBLKgK52Vok
TLSH
T1ED45230D84AE0762E5E7B67A9EE5C2C4AC787D96788A80FB845F3503373C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b0b69a07652339703e7ceaf6a46f294e2ecf73fd33d9ef7c06a98779375384f8
MD5 44fd7511f676263b65be9d1c8a7fa689
SHA1 49c8b7634f0b8ef94c1c7c3d2bac2793a21b5093
SHA512 1aeab54f705c63aa9f81a6d1e72200e54e35f7a675df0114f5c1bb7db63e4e37002150da9970671d51f2df4d78c40baa6e398b04e57e50eb5f78db29b026dc7d
SSDEEP 12288:rI+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofq:rXCntzypjLwXgrcQBLKgK52VoS
TLSH
T17345230D84AE0772E5E7B67A9EE5C2C4AC787D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 312d81d1de88a04b5e15a3c23ff127fd28bf402e00ab1b99a5cd99c72a6f173d
MD5 8980f24a828ef98b53873414b918bfd7
SHA1 70f0bb1c1ef00dfd60e8de772e1855b94af614eb
SHA512 e319cfc3e9b9d43ec875c5dbf54edb84ecce31ee55ae6ffa43ef5a29bc58c933d809d7fed6158fc6dbdff3c4df2da267db7f0b389ef0b907112b92da4fa44dd7
SSDEEP 12288:1D+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofm:1iCntzypjLwXgrcQBLKgK52VoO
TLSH
T15845230D84AE0763E5E7B67A9EE5C2C4AC793D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b93e4e09b14eeb94f417801f5e2d0e312224c2424235495797b37acc5a697b1b
MD5 fa0d8ab32743e16a3193514b105284aa
SHA1 59d77a693be7c8f75aaceab66f79d4fad49f0936
SHA512 414c49d0b0de398f421b2ccec16e90d937188ac299262f083c55b9128c0cf72f5d8554c644d6d9e49391d032794a2d0c7795f0abd27451a45be4888d23d8d0d4
SSDEEP 12288:KA+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofu:KfCntzypjLwXgrcQBLKgK52Vom
TLSH
T17745230D84AE0762E5E7B77A9EE5C2C5AC787D96788AC0FB845F3503273C8D1CAC6614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b726542c13a5896f719542ed2e079a957a4f3181906e594486f17ed165318f4f
MD5 1e91228590c5ec3ac2f67f8be1b91d31
SHA1 57a17c7a1310abd753e5fbb2b28fdfc1ee57c3a4
SHA512 d059838a5997adfe0f90e3d2dbb6350db302c5e85149b50d926ccde9ecc552a32b6f8d936d01f2ffe90e51e7af206dcb8ffa40eac9dd514c64c8f50764009538
SSDEEP 12288:+y+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofq:+xCntzypjLwXgrcQBLKgK52Voi
TLSH
T16545230D84AE0762E5E7B67A9EE5C2C4BC793D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 d4598062f7c9f709bd7779f666ade6b1b82b16c459b1bc769faf33283506b4a1
MD5 c0a65693d83b0e1140358d1930e7c515
SHA1 badd7a58bfaf5023b289bc6e856d0ac9f2c07e1e
SHA512 cbe89f8352568205592aa91f629bd6f9ab6fa9b4ce449c5327a782d93367e01d407e4b71db1bf82c24b69e7377181a2d8d19c3576e17676949e1ec517cd4a0a6
SSDEEP 12288:TL+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofu:T6CntzypjLwXgrcQBLKgK52Vom
TLSH
T1A745230D84AE0762E5E7B77A9EE4C2C5AC787D95788AC0FB855F3903273C8D1CAC6614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 329ab94fe9b411c781e1c554c4d6930c0d19535856696378ef6555a87aff56f6
MD5 fd3fd415dbda67d72bd6ed3f4f291881
SHA1 eab6419cf65b76aa55880c9eac2f80b0855d3a1a
SHA512 fe173fb7455368166c90a55c4f369c2aebceb70a3dd6221d708ae6d12762f72c040644ac3d7edc3ef627ef763670b7a68a17a4b27d2860a67bacad6ced65d296
SSDEEP 12288:Ny+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVof+:NxCntzypjLwXgrcQBLKgK52VoW
TLSH
T10E45230D84AE0763E5E7B67A9EE5C2C4AC793D96788A80FB845F3503273C8D1CEC6654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0b4cd61a944bd7099056389ea6d0b51f131ebc3daf35cd4428c6439ca92e6376
MD5 12bf5f9e5b5a139d4b6a5410e1d1d241
SHA1 73c2f764e2095f2e7456f1ed00d477a3ff22db25
SHA512 0eb01c72c4998109af82f7ef848a4bcc313724ac4d266747c30742bb4a0158ed566119eb325af859c0c18194e5aa0931992cbbe2c1a10537516e738a7988fd2c
SSDEEP 24576:EfwvOk9RX6wkyAIjCntzypjLwXgrcQBLKgK52Vod:qMnYIjCn9ypEbQNKoVo
TLSH
T19185CF2DEADC44E1E1B7923C99B7460AF6B178591B31C2CF025A536E0E37ED49E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 307a3c8561e4f376407958726c9885318e4a4cd9cef64e96ab4a45158ecc9be2
MD5 81377e1b8fb889bb5a769f8557c49935
SHA1 a509ba7250f6a5eea4f25a51ee1428db7e711e2f
SHA512 2987bfc780359089c89edc40366dc2ed6d6942a75948573d90a78bfd8266d367a7290e14ee43f7aed6377ce89ec9a63d351e4030df6c726da0980bc2488f73b6
SSDEEP 49152:bYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OCn9ypEbQNKoa:lySzPbn9mWQVVo
TLSH
T1D8067C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f6268248af803555c79a91ce0b2c5d683ae3f992bfcf4e7ae6e46beb1087f4f8
MD5 ef3140131e9c7c33270e3a982e08757a
SHA1 17c4a5490cc66c998f0d5b41d513453641bf0cf8
SHA512 0b3c4f3922d6145ff968c138248d40303a570dea9141212bdf5dda15bfbca0af5a6b708524ed0121a5b3cbf9f900add92b3717558e970f9e85702b7b6c16df5f
SSDEEP 24576:l47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYcCntzypjLwXgrcQBLKgK52VoO:l47JUQjairIhCnDHUPfF/eCn9ypEbQNe
TLSH
T1AF65AE1DA3EC01E5E1BA927885558A5AEA71782E1F31CACF1270437D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e2229a57e82a43d32d60a92f29c3d07134d4beebba79df00a17e43ee4829c42a
MD5 10361b8d7e59f8eb217af5b12e49b22d
SHA1 a314f7075d2fb2d7ad3a2cca068258b0f3fb3c8a
SHA512 d53628b66c4bc2b0123ad27efdc69b6227d377d3b2d6a30eaaaae9137cd1a181ffcb46130fc9652412e97c7f640943726ab9d18dd103616c9236ae6b2b831dfb
SSDEEP 12288:WksfY+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofP:sHCntzypjLwXgrcQBLKgK52Vo3
TLSH
T16355F00DC29802E5D0AFA279CB958640B6333C6197E1D2DB52D2F53E1F395909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 74b985fc7d4b5843b3902c15400bcee0972a7d240b6b4f7ad769303ff42b125d
MD5 f19d2a6d9e8053f5fc8fef266a8b6d44
SHA1 7021f947435742e27f7557cecf2350b94621b318
SHA512 f99a660f83c922b94d678cb7fe795d979616ce9a75fce8b47297dcd3dec291e70919812d89494eb80aa2b4437f679fc9228692a7e62064540e20f28e6beca690
SSDEEP 12288:ttqqU3fQHOKxP/UWRaE0jueORObP3s9l:ttVUPdOaEMufWP87
TLSH
T1A6352950766AC75FC6AD50322E32D5CCA7707D01EE05AB0372C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d2e1f0fb0bf7338e21599d2fc8d8f90be0f4a0716d84b575d2189c34822ced0c
MD5 92491fe18a8a764221283188fe8c38af
SHA1 fc463f1c0a7e0ddfe9f2f1e165c476fcba669829
SHA512 541f188045d1ba0f87e64a971ebb1755549e43a76ab9d4d6e44c3c14018e83f19b6e0909ce7433a8abfe2f20f86ea9f3b24fa5c1ad552c791eceb5fb1756677e
SSDEEP 6144:H5vlBSz3/6oDxWeWtq+LhjJYcbVtMxqwSMWqFZ7ZMcbVtMxy+sWnHgttnBfpFEf:exWeWN+rBfHEf
TLSH
T1D355C7819537A3CFD1F77031071A6F4CAB64EC57B2096F26B3C8453AD82AB6164B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3182c924d4a9376930108b5470a68dec6d72fe1be8bf3bbdc862b939ec738170
MD5 3f8709b66431961f6a3bb4bea4e5dfcc
SHA1 0187384100a278a3d5691c15b09c81d045c3425e
SHA512 6a586d8a4bc6a594f7e123e53b5f7e351a575f05de6efdfde8583233e76631f5c8ae9cd0cf2235cb19b47905858d4d5ab7fc5e6119b249d1d33a287cb7e13f0a
SSDEEP 12288:l07Q+ILcsvnjzdwWypRFlxcrXgrc6bL3Ry6TKGPDK5RAVofp:uPCntzypjLwXgrcQBLKgK52VoR
TLSH
T1F945230D82AD0B22F9FBB6795EE9C25478297DA16F45C0FBD40B364327388D1CEE6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 74bae913c0492f95f541a5197c3350a815dcf0dc4b31b9c5f7d2e881c7a11eff
MD5 023ccefd0ea053f4bf37abb18cc1b19c
SHA1 7c2643917f3a2efe1c42c671f5e48aebd97a2d08
SHA512 6ecdb52618057b3d24852ad83a5e0aef028efeaddb2bddf223484ecb72cd6188ed3402a2a9439e23b45f0f33e643a58cfea2bc32d467ecdc580f9233e395bef3
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYtCntzypjLwXgrcQBLKgK52Vod:Dgb4mBIBhGFcCn9ypEbQNKoVo
TLSH
T16965AF1E22EC02F5E0FAE2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 488fece63c6c9e2e4aa32449412cd1f43b37c837c346a788cd38d8fbb23321e8
MD5 3b461bf0098dc03d651b6fcd0e3fa82c
SHA1 60f0996eb62bdd23f7b62934183eea1f2346c95a
SHA512 500a1efc19ecde4006da954b85bb1b6c73bfebf1d0e7d2e3cdc342b13c577e716822e1298ea02af762aed62faab90b60694365e4025686d5244edce57a916803
SSDEEP 24576:DG88u8FpJqH1nzria7/mMCntzypjLwXgrcQBLKgK52VoB:y7ZFPqV6a7/1Cn9ypEbQNKoVo
TLSH
T10585026966E102F1D4B7D1388A864663F5B1B8211364EBDF06AC8B521F33AD14B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d9e5009e41521ae8ee1d43c549d648e7553d943f01f4498bed99a6eb73c86b82
MD5 2570ff916f861f7e864dafe3a9c52c9a
SHA1 ba091c52c8ccf24c6b0493e71527da0878af945d
SHA512 c50d02fd5c95c2eb42a438f0bd8952fbd9332b25d065ea454009d3e27030be3ea76f405490888b3132bff1a2f9359c61e75a74e096dec93df4e4b6664cd1c136
SSDEEP 24576:fPUr+NQQCntzypjLwXgrcQBLKgK52VoW:fJQQCn9ypEbQNKoVo
TLSH
T14865E11E62AD18E1E677E17D89828309F67178621712D2DF02A1917F1F37DE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f8c3fdd6a91216b07b881f1ade7dcd3123cd2c6c4c2fea3dd7d6eed42540570
MD5 90ef156564ddb5f9f7c462c56f979b03
SHA1 016df38e66c59115dff2f47fdddaff4b5bd1bcae
SHA512 caf071af35a92ec6881b68d00994d5d3a5e63f75f3ce57c795700105ef74a9629920fad9935074da945fb58b94155e43f581a53bb1fb2bf75284c357045db65f
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjACn9ypEbQNKoVo:SG05lO43bGn9mWQVVo
TLSH
T159D5CF6E62EC11F5D0BBD17CDAC6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 614337132bc8cde41b272ce1155fb8f7eee85bdb16e79f13528e4aeb7acced1b
MD5 85aa803a22231192ad75018e8972aab5
SHA1 c307e0e2424c477dbe5d884d8707fbdcd72c0a79
SHA512 7818b6ac3c5dde996576e8eada4e52a94eafd4deceada2db5f6f89deb4f10a766128a22cffde00d0a6ea1426117d3e7a7553e96b4b492f9f60d22304bb156fe6
SSDEEP 24576:xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnOCntzypjLwXgrcQBLKgK52VoL:Ra5POZ3hJt2pasx2+m4Cn9ypEbQNKoVo
TLSH
T18265AF5EA6FC01D5D5BAD17DC583861AF5B1342153329ACF012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bb0fcd4db57b315c19a279e775a4db20a7fd9550ac8b78bf33286394c7516fdd
MD5 eed106ec9360414fae7a24cb6ee771e1
SHA1 2e3a6ffd7382e14bb0ce175420915e831485a51f
SHA512 c7b5908472901132021ce85d699b3234212cea474da0fabb3398792c417b76ae23fb32b5acdfce0f5246d96baec3ff3e346a455009085ed5e0507a7dcf025f7a
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkECntzypjLwXgrcQBLKgK52VoW:GNc/zEOVHFVCn9ypEbQNKoVo
TLSH
T172858B1A23E901E4F5BBE1BE89779546FA717865133086CF0292851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2162c1c14a94b7204adfdc21d349b5b3387bc399e24f720d3a02ee0761014273
MD5 c8ffbd867b584cb94b8a0f99891d1376
SHA1 ab82a64a24c4aadaa3622e61828aee56df64346e
SHA512 b5a51b129928b63eae09e162732e4c4dcdbef4b9c2c0175ab4dc580b4275ee57093699cb08f52e0a954cdceea02a4620aee5055299f1f942726ba4e0544fca2d
SSDEEP 24576:f3kNvNnaFeYhJNtmZBm6CntzypjLwXgrcQBLKgK52VoT:f3MwBtOm6Cn9ypEbQNKoVo
TLSH
T1D055AF2EA6F846E0D1FEC6B5CD238512FA727461173292CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 16e87a793d714cfe47b7952e0ecdb7f8c1709b6655a35123f455e37750d6391d
MD5 b7109e37f88728c06b1fd79b3aed0fd1
SHA1 5f42f765b4d6a779f01be88b2277e1532d8ade91
SHA512 0e330cab0c21c683d2345a4fdb82159e65669a5a083c910b1abcadcc4c641a078516f3336975ab607b767da3887437a120d1a5b172fdc42cfee49112c8cd972d
SSDEEP 24576:qD3FHshBIYQgAbCntzypjLwXgrcQBLKgK52VoF:qDVHeBIAAbCn9ypEbQNKoVo
TLSH
T13075E13DE69C04E0E57BD2BCDAA38606E67138A9032255DB01D591B61F3BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/752-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/752-126-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/752-120-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/752-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1460-359-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1460-361-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1460-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1460-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1460-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1460-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2740-394-0x00000270ADEC0000-0x00000270AE540000-memory.dmp

Download

memory/2740-374-0x00000270ADEC0000-0x00000270AE540000-memory.dmp

Download

memory/2760-286-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2760-61-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2760-55-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2760-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2952-362-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2952-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2952-114-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3508-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3508-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4188-303-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4188-308-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4188-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4188-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4188-77-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4188-0-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4188-8-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4208-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4208-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4208-301-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4208-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4240-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4240-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4240-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4240-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4860-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4860-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4860-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4860-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5532-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5532-375-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5532-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5532-82-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5532-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5532-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5700-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5700-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5700-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5700-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5708-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5708-50-0x0000000001610000-0x0000000001670000-memory.dmp

Download

memory/5708-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5708-46-0x0000000001610000-0x0000000001670000-memory.dmp

Download

memory/5708-40-0x0000000001610000-0x0000000001670000-memory.dmp

Download