147901380d832ce50e034751c11120d567592dafab16e257c45ad741c0446472

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_42d3712c5f259da1bc22953d17d6717f_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.5MB
Sample260715-pdcbdaft2y
SHA256 147901380d832ce50e034751c11120d567592dafab16e257c45ad741c0446472
MD5 42d3712c5f259da1bc22953d17d6717f
SHA1 9cfc143326378f73a1f8bd1ecd39b06c48ad8f67
SHA512 da5721f269ef3b5940768399cc715482745d05b17d4e45166b9e580de8e941908e6125b8c565bd67ed4f962e779c4e9af5158fed6a072e8038ffa95fa83fc091
SSDEEP 24576:eDxMBUtYy5T+v8zVW76r0KA3qHwg4xteLG:eVMBirXch/3qHiXeLG
TLSH
T14765F109B2A900F9E977C23C89928506E67278570371DAEF03A147673F776E0AD3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5008	alg.exe
2540	elevation_service.exe
4312	elevation_service.exe
4764	maintenanceservice.exe
5776	OSE.EXE
832	DiagnosticsHub.StandardCollector.Service.exe
836	fxssvc.exe
4336	msdtc.exe
3280	PerceptionSimulationService.exe
1396	perfhost.exe
4100	locator.exe
4316	SensorDataService.exe
4600	snmptrap.exe
1976	spectrum.exe
5156	ssh-agent.exe
512	TieringEngineService.exe
4856	AgentService.exe
4356	vds.exe
5784	vssvc.exe
1732	wbengine.exe
3048	WmiApSrv.exe
5844	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_42d3712c5f259da1bc22953d17d6717f_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\618ef81e5a3b5d25.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c37e5695314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a23976b5314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d84126a5314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4648	2026-07-15_42d3712c5f259da1bc22953d17d6717f_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5008	alg.exe
Token: SeDebugPrivilege	5008	alg.exe
Token: SeDebugPrivilege	5008	alg.exe
Token: SeTakeOwnershipPrivilege	2540	elevation_service.exe
Token: SeAuditPrivilege	836	fxssvc.exe
Token: SeRestorePrivilege	512	TieringEngineService.exe
Token: SeManageVolumePrivilege	512	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4856	AgentService.exe
Token: SeBackupPrivilege	5784	vssvc.exe
Token: SeRestorePrivilege	5784	vssvc.exe
Token: SeAuditPrivilege	5784	vssvc.exe
Token: SeBackupPrivilege	1732	wbengine.exe
Token: SeRestorePrivilege	1732	wbengine.exe
Token: SeSecurityPrivilege	1732	wbengine.exe
Token: 33	5844	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeDebugPrivilege	2540	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 4240	5844	SearchIndexer.exe	124
PID 5844 wrote to memory of 4092	5844	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-15_42d3712c5f259da1bc22953d17d6717f_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_42d3712c5f259da1bc22953d17d6717f_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4764

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5776

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3892

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4316

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1976

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4628

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4240
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8ea462fae286483dea83a45961065c36dc530dad6d1872c71ca6602fd7c2504a
MD5 805940d84ad9908b8e64428802f16515
SHA1 3b8698b1018771347769325c29c78e7e6dfee35f
SHA512 8bd64fdb4feed6b505d94ba6067f2af718e18cfeddac61bc1e039d2a22f432d68814b127acd4eda96fd0f3a9a918ddfc9a9772d7c4f4b10b4e3f208d80d1e09c
SSDEEP 49152:7b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnEXch/3qHiXeLG:J3q6mjBhXA/6CIG
TLSH
T1EED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f7fc769fef9f44ee16c4e9c93481401b316a4816173c6f93acfc9cf6be06dbab
MD5 f6bd8974e8aa54cc765828314eca8523
SHA1 aa6045837163c26df954b3f829e21fcc402854ad
SHA512 820d2b92740c1495a4d4bbeb1dcc110f12dd47689d5b55256c420339296dcae91deb36e15bb185f13674f1b4fd5c6e66d6516658583c002de3793d58dcbfaa1d
SSDEEP 24576:sXYfDtczAX5T+v8zVW76r0KA3qHwg4xteLG:LtcmXch/3qHiXeLG
TLSH
T16B65F12877E908F9ED67823CCDA28511D633B8514360EB9B03E4D9261F736D46E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f7fe236b3efe224d0205cb3bdfa128f68b562adfd74b3d7557cb5a4bbbdf223a
MD5 7cd41b35d0cac276c5e54de879aa5546
SHA1 345a6067facbc62528070cd6dc09c1b14c31be06
SHA512 c1e710f2231c5efaccd258ec04de8aa2c9451538ef55359b2334c7fa66893f268e843eb3aed897b25681c03024564ebc176b951d6f886bc27d1847b5a81e2d62
SSDEEP 24576:Z0Le5ji0hmxhrMw5T+v8zVW76r0KA3qHwg4xteLG:ZPji0Az7Xch/3qHiXeLG
TLSH
T19A859E15F6788731D073C0B9C5D2A69EE972308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b221b1853c14437adae627503522b2f59a093d4fc03e4e8812fb815b38335d77
MD5 e10fcda1e4ade6db5dbb29eedf17476c
SHA1 fd9f9b6a3f469ed0b2f5b31fc54bae37559f81fd
SHA512 1d2e97a61d603568a2b8529f31e62e156a03cc14d9966b1385ba7dd9f1512f8cad145a045667246387f6b327ac84483efb141d043415f1c9adf777c3d1b0bbb1
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWj6q8wyuO5T+v8zVW76r0KA3qHwg4xteLG:5/ezSC6vUzPv+HjyXXch/3qHiXeLG
TLSH
T120755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aabe62c007f7e4204b5af0e6dd7b31845c587794a8aa4f6dfb49c97c19703fe1
MD5 9695553732aa1379a3f92b05a6b852e0
SHA1 2adefd03e0f5662e6fcdbb4de466ef7edb6ace44
SHA512 d24c27213b631c74740d5345d7ae48f957acb805fec668468c1909397f768911a8d61127b3a5fac862b00d84a64ead1b7584644205de1941f1eda316b54acbed
SSDEEP 24576:7VbqPb88hv/l+Bb5T+v8zVW76r0KA3qHwg4xteLG:7VO88hXl+bXch/3qHiXeLG
TLSH
T1E0559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 27d3952cfd91a3f8e455548951738af38b36fe824afb333e578159b42857756d
MD5 570744801a62d8b8a541dcca6ee72392
SHA1 349e25f09cb8cdb819f3f2d8b10715bfd0d2ea6b
SHA512 f34cd89c4e611e2df25e240303658e92c601153dfa9acab0c4312db31f468f200b9e3057444ac41fc1f34554c39fc2b1d39b43b35465db9b09e13ad6c9f6d729
SSDEEP 12288:8G05T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:8G05T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1604523485E6D2850D39B8A303FD79560C642AC7263859C175B8BFA237CF8CB0FC166E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0981dbee90a4473f59d1bdbff1077f7a37646088ac5c006ad68f1f18b9d4d084
MD5 cc5110747991003f653fceb01211f2a8
SHA1 2268c1a05623019d1a368d2122bf47c9fc120a9c
SHA512 860a5527f4572b1433ca1345edb12170824ed05759252871d2af38bfc966df58ab4755efa5fe70483e087ba6cd9ddf956e5d076c1081945cd1bc09a43f9bb1e1
SSDEEP 12288:ueBNUbTVO86UD5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:uJIUD5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1EC65CF3BAE28FCD2C27E8D795B918600D77278714B52A3CBD165C20EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 93efc3ad7c9841147661350e8c5c08c736e805156be2e564ef326e0e33cb0f80
MD5 40e38f5ede402e23942e497766f16694
SHA1 dbb418efa88102b7b70042f4842c4121d155a73f
SHA512 7aeb7b7a8cd9f95eca5a2aa9384cdc85f271d5c6104c853fa5fef3c7c29c06d35c000caaf5f0188459cd42bc945994aa04a5b674cd0c1359e851e0f5cec2e13b
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:5QvGAdlCEL8c/WRNw5CGXA/6CIG
TLSH
T1EE267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 96bf2ec94a3201142bac60510c7298f2933a3d0510064a068dd92e20b1d5cbf0
MD5 67666f0d3f7cbec11a53c90d4e16b1d3
SHA1 c90eadfb3e8ff91cb170d9d5649813330eb8c3ff
SHA512 febbbb307b487b1ec9776370468cc401c5b78ff7843290b2a384091c2e4fc99e7d4f9144f30a95e9372fb3b3bdc1dc4d60136e0bb53200a306780a012fb4532c
SSDEEP 24576:7fewsAjB5T+v8zVW76r0KA3qHwg4xteLG:7ljrXch/3qHiXeLG
TLSH
T10775E030FE79E432C3BF0DB21B66C716542DB9204B5219C3E3E88E9E59702D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 82d18294b91a030c628d2e6585585f9f3b1db9bc4e095cf08f2b3f6bba2caa10
MD5 15dda08518f81133d77d5b775958dd03
SHA1 75b561dd919c52a8d07de047de6d76281bb6f74a
SHA512 311000c9ca143d73f14e9577e5206b554d5429e891e1d441f98fd71f12e173241906c8009058e7c93bdd8290641b24c93016bd53cdfd12b6a8d158447a5c6436
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHnCIG:AUEtQevvqc2W1cpV20I32nCIG
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 15e12b8d4aefb3304dc675761e0d7b3916ece9ca9bd2eb33bf75f2e2705fa632
MD5 755379cd9d6c78a4a2329b464a605b97
SHA1 e83cfff53c8b8fad3590a820cd9c10e2359cf6a5
SHA512 cf66fe19bef1c4ea0720c014c8105261fb5af29e232847ffbb7cf293806636a7b51670498a6c9cd7686e1424501a1b3f495a97195fd7ba8dfd65684fd8b5c6d6
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/zLXch/3qHiXeLG:eoquVjnmyXA/6CIG
TLSH
T135D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 39ad992059d5e8ea3a3e08b65a153b38d4a67a682da60685e1125f64133bc041
MD5 b0ad2028f4314cd034c7f0aaa4668485
SHA1 3df77738871bd5f46d1dc1c534e0c2ab7367847d
SHA512 d6272855b0c2d091b20cca9d898f8b4ef821f7da598f155ad7c0605ce1287360d7849d816a27f487f168768e4556240a41126130f610c7a800738b44ef52e24a
SSDEEP 24576:lAhGL6IFoiwtA5l7S5365T+v8zVW76r0KA3qHwg4xteLG:lAM5Foiq5iXch/3qHiXeLG
TLSH
T11035AD80EBF955D4F5B39A7899B68170EA76BCAA5E31C20F2250D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 af2300ff4a82c4da92533753f5cd37d61e567e871ad201c90d507789aa4942de
MD5 42f9d45985d9553489cb443cafd180c3
SHA1 ebd50fea9255f3c1b576d64b48c7db8dd7469166
SHA512 97caeb0948abfa9cb4b8baa43d4453ddf6c060bbd9fce4c04e86aeb81bd9783f6860de1dfd06275054693bb2d9c4334b087ce5c3d864d3039c39d0fc5258ceb6
SSDEEP 24576:vwuROWd5T+v8zVW76r0KA3qHwg4xteLG:vwSOuXch/3qHiXeLG
TLSH
T1D565F14936A91CF9E96782388697C136E7F2BC122721DB1F1760C6176F37260BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c8634955091c7f5a00f015a63c88b0e9cbc97c5286a9b4c24278fbee06e36cf1
MD5 e4e45d01e55dfda63b3d3590a7c18581
SHA1 e18c2933fd4c6008a4d1db40f9a92754a25c6b71
SHA512 6bcf1a179227bd913d05b06d600a6b8124d1a226da17fb8b4de3117186d24e0e787876c3c358b6ba2d45f79f9ff7065a55d5ed33ed9ab5bcbbc8cdff26a11a4c
SSDEEP 12288:NyZ1Iyx5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:UZuY5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1DB5512493AAC30F5D29782389EE28605C7727463237247CF165582672FB3EE16D39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 05aba8db8a7688abfb723373c556a60dd33158021c68ac8e07911a4811c02faa
MD5 45f844f40995f6a810a7a1abaf3e270c
SHA1 6d97fc161a564b19bf725283e9d6b2b65f864d7c
SHA512 a751c71297b18b88e4c4c9a504936eca5defb595ea6d5b619a8e4f6262bfd32a50dea0e183f0cb652c922d42c2b005f994b54c2db465a9e6159eead3fc58bc28
SSDEEP 98304:FQRQyi36YOcPDLvw2gAf+PN31XA/6CIG:8QyiKanX+PNpCIG
TLSH
T1C0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b20273e70f8c9a6286149c1b44eb9398928810a6fae1cbd01d2cb826bb07c93a
MD5 414e80b050819fc8fffa697f14fe859a
SHA1 48b41dba6f23a38fc0c99cd7375b651481f27669
SHA512 cb7bfe02fc5e1715603f816cb5dbdf3a052255512e0f7a21a6960c3204184ee11cae9e70d00393549dbae273c6a16dc0f053d316877425b95765c794c3955a97
SSDEEP 98304:FQRQyi36YOcPDLvw2gAf+PN31XA/6CIG:8QyiKanX+PNpCIG
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 959e6072b7917165088f9ccceecc189a8c457d85c22d29b264e9a56329278193
MD5 e098bce48dc30c5d9f2b1df2bfde354a
SHA1 3aa461bfcd68018d16d9444e36aa4eca1ed70e13
SHA512 4367ebbe906dc8b5dc6cccba9aa74676f06ac89a1765e473e05fb81620fd19e2c82f9fdd9b768bc0ed9c6b2e0c5f01474dd8719c47aacec3b6949c84659fbcc4
SSDEEP 49152:B68Qg55nhkeWu7PNU3/7Xch/3qHiXeLG:/thTRc/7XA/6CIG
TLSH
T1CEB54933B2F600A9C44DD1769F4A872196D27C758FE0E3DB860572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7f59b81784a0c877d03330350ccf0a9c938c57a2d6096a8bca348ae90c70b0e1
MD5 e6ac9c98bdc57a139d38993620a06a54
SHA1 22d780fef3046214a58335e1160d5f78789e54a3
SHA512 099f21b98b48724e0713aa786aed3f354b82c8603ae003503ef408ef7199ac73cf7a54423a94b0607d9ac3c377cbf03f447ae31bb4e97a8c3c68a473f1c11508
SSDEEP 98304:1y5112gYy5azzVvU69nLKnhZgXA/6CIG:YLIHRWhACIG
TLSH
T117167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ce5e6075da5832b1cd4a1872697f7974b36d7e5414415f6d84ad708a2ba5d9ea
MD5 701311ab8b0ba729be0c4f06ec4157d6
SHA1 40ddf6f29d6be6417044ad9e371a099e65c91a1c
SHA512 6efaf4a2c79cd71e71f5e26e99eeece41567a51920a940c052d2d6396ef3236e1dcecd14a0d07c8602030c74d6337738688d370535533adc36add38a098927bf
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNXch/3qHiXeLG:5u6JmIxd2dNXA/6CIG
TLSH
T16FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5fc22faad37a5c9a70da03f2dc6bd4fdb0acab33735d12c56e827233a3a39b20
MD5 0ffe05b3e99cc401dbf0093af7c46138
SHA1 4d8516291c30dc870436a6ee1e9da4e299f6d3f4
SHA512 60a6c6cad0719cdc8cce0b48370a0ba8093360ef999deb9dbd4cab2c45fc4b1fe61c937d5aa1300e68e0d85f287c29afdd65f9e2f9146b5b3144fe3208a1530c
SSDEEP 49152:N1hpsNoJpF1A67U44CwH7R4xpXch/3qHiXeLG:NmifPqRyXA/6CIG
TLSH
T1B4B5AE13F2D900E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cbcab3fc4c872e601c1d9cf3464a20f24171ee90ec9f495c5f222df4c682e96e
MD5 cd843ddf0d4bf4e0557a40d7bda3d4d3
SHA1 5d78dc5b85033513b6f64fcb2082abfd1bf0aa35
SHA512 c0129213a7add717778141a9c72d0dbbc4e6961f4560afc3f65e31b78917b43c0a978230f27f2eddcf7e33cfb731bf66811b729c801d2a8165cc7ff889a34ed5
SSDEEP 49152:gSuZQIY0Be2KkRVtOnks6NMHq0Xch/3qHiXeLG:65dKqi610XA/6CIG
TLSH
T164C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b62560214c99558a2b046652c03f401759108fbbe64aeec65f7ee8fc8fb75933
MD5 0115ff8874200def2b808ce66e587410
SHA1 fe5eb599ec112afe2d99283d0f8fee5d326910c5
SHA512 208b59dde7303d64aca94bcfbd0eff7a5ec77821e88c9f2f861c8981703ffd9f262b1cc16f74b133bc0fc68b6119c96b042bd05d8557c1e6969c24a64bb67905
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5w9Xch/3qHiXeLG:QX2iWphOXA/6CIG
TLSH
T15295BE13F2D900E8D05EC178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 820f81f55f423557628a7f67332d56d77e824192757b4f70cfcb67cb85a33288
MD5 3526086a79d73ae21e055b3f8f30b823
SHA1 69b87b4c5c91e082ef0464c7834bc3fa10c1b166
SHA512 e63a9b80bc2f9d18e2111996333f1216c90cc15cf3ed490e70a0729793aba2ef2d4391b4cfdca58a3a2ec5e097ff5305cc2f3352b96b3b597ac986d5a0dc2f0d
SSDEEP 12288:Tc5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Tc5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1334523482C6F2854D34BCA312FD39164C64668B77386581B6B8FE1237EF5CB03C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e29f79ccc13384cf218002f3068895f57abb6f98331ecc2e6a6904411dc49988
MD5 0c9ecab4089ac3bb796abdcdc72bede1
SHA1 e97600cd1912d33f96174f63e7ad86419723d462
SHA512 969ff2469efda3682e7ddab010590686b010bd894a9e6729722a787a7c4b3f7bdc8281a423daabcdf67fc37cdd0ac79ec0b3f63dd4d1ecb43798257db69eba3d
SSDEEP 12288:7V5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:7V5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E64523482C6F1851D34BCA312FD39164C646A8777386581B6B8FE5237EF5CB07C06AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5ed51fad300883e9b804ef92c67fd1302eac7bf8da8839a448ea217a40cc0cde
MD5 cac011d598233954159d39d5ead55066
SHA1 aa30d01bece455c062396b1ec478ada8f06e84aa
SHA512 097289da461bb54a380cb0cd385f16f0c3245afbd7f1c91dac46a91fdcd454bba93870495aee1c5939cade7afaa3c7a23d1347661ef43efb459161fbcf4c3f7d
SSDEEP 12288:3r5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:3r5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D84523482C6F2850D34BCA352FD39164C64668B77386581B6B8FE1237EF5CB07C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 daa06f32bfdf24b8a954f9d8ae7cfcee5c7c2322604962259477ddeda3edbcc3
MD5 a8ed38df7e2a37ae062c8c07964448df
SHA1 dc576856af99fa2215c317c8ff5b966d95d14151
SHA512 6fd814f8b7fcd289e934f2d9163c03212af8c333268cec84d6f33598317487ae14a599f7853374b85e75bd0272eeb580c9ff785ec9167bdc14695ed64ce2eba3
SSDEEP 12288:fVa5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:05T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1424523482E6E14D0D697C6349FE39120C3A2BCB7B322995F5B4685132EF1AF07C25BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cab8bb6a722b23e602bb327205630435e6e5cc5036cbf166d250f40d025f8f49
MD5 0582d174631642b3879e6316a53ca223
SHA1 14a41ea07255ff6289d7a9a861601b6d971cee18
SHA512 43c87c2e6b6579a5fab11fc21bf16a51f8d341ba81dfbe64874065caa68e845bd74696fa17b2e7e62f6b2ac056ce7ce4b8eeedf0fe0ee1d360f2bb9226bfc355
SSDEEP 12288:jy5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:jy5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1CB4523482C6F2850D34BCA302FD391A4C64668777386581B6B8FE1237EF5CB07C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bf9971cb6f5e604ea7bdabf2f73eba1e9aeb6f416b51bdfcce4bce6c8e7f89aa
MD5 c5eb10f5e5877edbc8d9139223be090d
SHA1 e0c012e2c60f734f33e89d61a0f2ff13923a26ef
SHA512 d2331c035c70d4bfcf973ccccfa18031e10633b65590710be77a9db56235a54d23487f88c28a78782f9af44b18113fd9c4b1cc1d5fbddec22b712e85a7c5fbf3
SSDEEP 12288:4p5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:4p5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T14F4523482C6F1851D34BCA302FD39164C646A8777386581B6B8FE123BEF5CB07C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 45fc8be0fb0b584b6fe512f103e9bbd72c3dc74028583380dff4646dab9d22ea
MD5 2f2c0f82f9963d40ab7122e73c47136f
SHA1 8c16203caf548e2c2859cf3017dd4b7107d80707
SHA512 84dde695e14567d13b085e7af6dd46af7d0388fbe03ca2467653b5a9a77ccfed8cda7b0bbf2d3e5b8662d5d5060a0439210ba50cd8a77826047fd6aa436829be
SSDEEP 12288:9t5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:9t5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1884523486C6F1811D34BCA302FD39564C64668B7B386581B6B8FD1237EF5CB07C06AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 72a58050bfa4b78c92d94e59b88ccf813e79562d9d80d706bdada2114ab0c61e
MD5 77009c5d9e7ccb4490ba351df1279ff8
SHA1 d33a4d38fa115802ac07099a32041f43df378bf4
SHA512 26d44d71b9cf693213efa772341025286656d14b9cfd2ff91f94938f82447f23a6e959e6262a9f55e146a0c6823f937933c9fdd21e3b06c24c3f2a022e645fb8
SSDEEP 24576:XZM3zFVSO15T+v8zVW76r0KA3qHwg4xteLG:XZM3zfTXch/3qHiXeLG
TLSH
T134650194739418F4ED67813ECD568915C6B27C6A0760CA1F13E836276F737A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f28e6369bbb3027c74e42e0bf477a579c2e394dafbdd1f91b45e3eb5b9e9200e
MD5 4eceb052f01ff70802b63540ae316bac
SHA1 112af9dc79823b93a8ed610b04c5393f634657bc
SHA512 ff5385f36963f4a0996efaf16d2a62e7bfc2510172c157263cd13b12fdb19345c17775bc494d1354a89fe20823da5cfe7c70ca8a25a46e010353d4c80bf3e149
SSDEEP 12288:+I5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:+I5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1444523482C6F2850D34B8A342FD39564C646A8B773865C1B6B8FE5237EF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 480c18a41d1888cee0389200b0f5cd1eacc1888102047a57233b6dbd972833b2
MD5 99d24d99cdc507ce608dba2e9e4f2a5b
SHA1 63bdd310fde56e0b19c32b83b37ade729552b35a
SHA512 f84c4b09161ef4ec29eb0748be85826b46ef0b1949fc2cc4808a5429ca57a3d24bbcd1c851def6e4acfc2649bb9f92a5077c1740603bb416492d4c9ae45bff7b
SSDEEP 12288:Kk5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Kk5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1244523482C6F1850D34BCA342FD39564C646A8777386581B6B8FD5237EF5CB07C06AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 11710820bb4a64c826ae18a429f9698234b064f4f4ed07c9978292e99392216d
MD5 cf91a0835d9d12c9b7f9937550e7b6db
SHA1 2be9cc1b69fab6ac9a1592d5f9003b00acf6dbfa
SHA512 5027f906a9672bb572939ea933e64177e813afb8a7ea5777a78a5ed4903df65e2fc597eabb28f4c087765dc7b1c9dc2b4e5853f788e991638439aceb527e96fc
SSDEEP 12288:/yPz5L8x5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:yzyx5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T18855024777A930F8D16782388D921A11E772B83253218EAF179447772F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d49011e35e4e96dbacb2c62c4af2e5db2d5012580f1cb006edb7eaf5728c36c1
MD5 df8692ef01dddef1ca5e5ffc0ce364ef
SHA1 1f0a02b1ca2706a21f146b989e65788a0e848b92
SHA512 76e96f6f053862c1fe509ed0a6dcb87970c0583070296316c53c61f7552890e409b1da1f609c049ef1a5a4ac7bef933a658a71c7cd999b419f911486af373f0d
SSDEEP 12288:XI5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:XI5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E94523486C6F2850D34B8A342FC39564C646A8B773865C1B6B8FE1237EF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d9de1b1cb933991650945c65c0758f0960a37bf04cb5af946964c469a4047567
MD5 f90a86e01ad9e39a22a9da760fea8ca0
SHA1 eaf73f557322086ec56e48bfd6d02b8004025c20
SHA512 4276a002b078aba12a6408f3feffd98da2d57ef92f62842f4a16a4adbc37a54f9ad46f15bb4c6ecdd38c63720b835e3d7af688d3994628e5e379c997867cc4d9
SSDEEP 12288:HI5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:HI5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A44523486C6F2850D34B8A342FC39564C646A8B773865C1B6B8FE5237EF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3193cc1f0a1bc244b70a88b33fc875de22a0551346c4a25b84642de291b0446e
MD5 de318a3a62399678bcc145a50d53cf8c
SHA1 451bc835504515d8e2dab0568853168cdd6b877c
SHA512 99ef428ffea0981b2892f66b8a2e5222c3b778a25b5fc7fbe61625738b168943906842a7542a47eaab91553536be61e97b827e31e67e82f34a6b79d73921367f
SSDEEP 12288:ByPz5L8x5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Qzyx5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1DC55024777A930F8D16782388D921A11E772B83253218EAF179447772F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2ab2a0ff4d2bf4c51efc0c5bfc8b25c7403a3d9521b72498147556bc396e3bab
MD5 b652da78bd434af3bef3dcfeac909a33
SHA1 08569c758423fb6ce6c58c1b9d737877cb3b6fa0
SHA512 9d4c7edc741d9d1a61d68d96c82de25bd076a09065252017eb1e5a0808ea2a5fb2d899f0a454614e218f91a514c2906b8ab0a22debc891547e7825199650ef18
SSDEEP 24576:XT8aLl3z0zD75T+v8zVW76r0KA3qHwg4xteLG:XT7LljWXch/3qHiXeLG
TLSH
T14D650294B3541CF8DD67813ECD568916C2B27C6A0760CA1F17E836275F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9c2a739a854d9acfae9eaa0296419c6da8bfcbfc33607cddce86e3a24ffd9d9e
MD5 04963b54633c7dc1cbd1b4965b5ffb92
SHA1 ac7ef246b3f0eb589807cfd7f1a5301329e58970
SHA512 9e16c754e02515e529ec61a540cd6513a2c7dbcd5299cf4ed062c7c9ab2a772db5b0d9e31feac50e8d8ec4fa889146287823d17efbec07a963033ce216073d05
SSDEEP 24576:63rd9CHKy7GZ/5T+v8zVW76r0KA3qHwg4xteLG:crd9CHKyaTXch/3qHiXeLG
TLSH
T10275CF90F7E814E4F1B7CA358D764511CA767C5A1B21DE8F03A8661A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7bfc2db4cb530ceb252cfab8d1f128c122ea839213807e09214bbb9b2a93d120
MD5 b014852806727472f71fb312e23cc5d4
SHA1 980d729bebb60f32cc42dfb75cc36ed34bfb6597
SHA512 9cf178baa6de94e2b91a5a6e30a2654c40e1e11aaed17a19cb221170ddb3845fd4626a237efbf4451eed45aab0a3c93ffabaa0350c3c1861dd3e744b2a505398
SSDEEP 12288:IL5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:IL5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1214523486C6F2850D34BCA302FD39164C64668B77386581B6B8FE1237EF5CB07C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bb16f4b1a5c3b0016c7e511253f536243a467be355b6823fb1aa06a5d30dc75b
MD5 442b29114c7c7bb7a83ff2c7b8479e94
SHA1 8c8f7d971a260fa1612d377c6ee7d8a91dd17953
SHA512 ff1aac386bc330fb17f4bdcdc7c122a7e10c540a192eeb7be627e693692cfe5ec08897290e596ad5b5ddfdf487c0f4a381aa815b68c9dcb1158878e4ad0a9d05
SSDEEP 12288:JR5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:JR5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1CD4523482D6E2860D34BCA712FD39560C6466877B3465C1B6B8FE4237EF5CB07C066EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a31582622addb62704091802fcf3ecb3b29a015f6c580cb1b7a9b7b862423417
MD5 eee73be78a2ee3c99b8820bdaee66424
SHA1 d413b9c9f48b35b050031ea33400a36591057c77
SHA512 3bb3d9c4648b64a95b4c64cdc93cdb18caa9f2681bb585e4e2e7410c0b54af583a329e4dea69e3712c77d64698712249951b59cd7398e6eb58db27160c59064c
SSDEEP 12288:sG5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:sG5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1234523482C6F2850D34BCA342FD39564C64668B77386581B6B8FE5237EF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 996e32661f538696ada7eb214d96f334d4103328a1ef3ef2dbd472de721b573a
MD5 8cfc6628b5245d52a6421f50e8517316
SHA1 c324f091333f89a123abc33909957c7c6bfe09f7
SHA512 1033405341093fd6245edc2668459b007cb1d60967e2736f834036d39b846d7adfbf7054d1ba4416e47c8db48eb699736d6da8b4a71beaf67ed9eb9fa33988c9
SSDEEP 12288:aI5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:aI5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A24523482C6F2850D34BCA352FC39564C646A8B77386581B6B8FE1237EF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1894df90f5fc9c601127c915e006c6599041aa563f012d5b473dcb65b9ec32f0
MD5 823b6319d43c70a926a69077f39b240d
SHA1 651ab1b3a5e3d59002da74f3016561fd753f91dc
SHA512 64e2f4fd897e779dc6bb940cd77f2aae28ffd60fc64fa34b259fc0d1ebd1ebb43f5a971fa482229851fcd6971b34d72b473aad3969f1243c91bff477d415862d
SSDEEP 12288:kpsfY5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:1Y5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T19D55F009D69811E8C16E8235CB924640F3237C6693E1D3CB57C1F53E1FB69A06DEAB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a5d2074d7e0b5f75c1bd4aef569b10da6a0276ebf9000256514eca23eb273063
MD5 4eba5da9434a844bfd35f83804155ee2
SHA1 5d0373ed1143486515363ae1ec130c6bb363ae42
SHA512 b5dcceebf4f98fe67f8030a96b5a91020c66ca93e65b1a75a7ef8a74bfd10fe3adca1f5059003c5398382f4c701cf7066953e80ecd13d555a172f8e7dafcb9bc
SSDEEP 12288:OE5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:OE5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T17B4523486E6D6815E2AB8A302FD3D130861A78776345984B7B8B91237DF4CF0BC257DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 729df6fd0e62b3c9b39ec4cb179de1197869ce9a7ff5beb43155e37f309b62be
MD5 dd121c9fc3cb03622a59c03c12e26e42
SHA1 1b85a20203dfda08f90591709e7eb0ce89912e85
SHA512 0cef29658b04c64f5083257227629867ea343a7cc24f3a3af54ac00370fdaefd80a6318a351694cd8ed79286df9508a99abe6c415b98f669d3e2fc6ca5489570
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQeXch/3qHiXeLG:Ma0hNYG4JwfXA/6CIG
TLSH
T19B85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 824ffc997ced0b60fdb857319a5bb31d6d0c033168e48adfdb054e385db24fea
MD5 28af7a5df207ea249df9f1285b8f6d56
SHA1 ea01824303e448043434625da2c8cb881afd6def
SHA512 dea0ee9fc9c82bd4c1f0eb5b632911722adafc882729d76a2faf1b92ec9cf537cc4b5b6b1f5130197fb2982136cad1be9ed7b8b4e6cffd4e66b3e69be2056254
SSDEEP 24576:jhbHjPB5T+v8zVW76r0KA3qHwg4xteLG:jhbHjTXch/3qHiXeLG
TLSH
T11C55027D2AAD2094E276C27D5A928506C331B836231197EF27C6C23A5F77DE06C35F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 bba0d5701a3b95f4e9f8f16973f32c2fb139fabfa966f2a02ceb62bfe45f106c
MD5 1feeb958958d3552ddc273ce1873aff6
SHA1 5048173c4cd07c438e51e4d4ffcd82817f4e5113
SHA512 60254d9bbe216b24f8ff3e0c9e477510a0857ec23c6c2500208ee05318d732d32720e8f9ada2a6a19d92b0064acfaeec2dee405a8db3df8e75ad57edc5e37bd1
SSDEEP 24576:U3YgnJcRTk4yti+R5dpR/p5T+v8zVW76r0KA3qHwg4xteLG:UIgnaTk46ppR/jXch/3qHiXeLG
TLSH
T13345BF2DF2B910B9C8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 69db98b5bd164e23ee71cf8ed87ccce3568053147e4d2e03bade5f581d7e64b1
MD5 b7309a9f8db74b1165427560799b2bd1
SHA1 572cd39ed87b2b1ded9d2bcc8746169b2d0c62d6
SHA512 a9ebcacd892bcd92ef31796baabeb382cb15097b39ca478b233f58a0ecf4824b23571ea1ca947d27f29e56d4ed4d17190e61ef6e333550267eda65776598645d
SSDEEP 12288:iQ5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:iQ5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T13A4523482D6E2854D35BCA742FD39564C602B87323465C9B2A8BE123BEF5CF07C356E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 bbf3409736c91979c40a7b3c970ee88048b624467a62a2a8c06771a5e18a77cd
MD5 64a5c51883e1d36ceb52a42a347239bb
SHA1 08d33feec99d7755cbd617a09159a4ee2c6a55fe
SHA512 ca950d622764a27d50dfe19cdbfe34e5aec5f662745681268091b9d1aedec0d4526e9e94b141bec443f0c89459ac65ab379ba845fa0bd0f5ac3d137951be298e
SSDEEP 24576:uAL3UTr5T+v8zVW76r0KA3qHwg4xteLG:uAL3UdXch/3qHiXeLG
TLSH
T13E750154FBA900F4E96BC13CC9A28516D272B46D0364E7DF03A98A661F637F14E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4ea2fc2c541fadd19fcc1cc26bca53afe17e29dbf1dfe2f2f22e38888491e8f1
MD5 bcc0aec098196d720cdfcab4b6fed4f4
SHA1 fb3383bb5710e78badfe280edab5570ff4d94d22
SHA512 980bb9fc6615b269f1252b55de5d32677c6858c005f079f2dfaff845cbb407635c656b10953af8a946c6d3e492653db6de27f92b2d2bb075d63d401c1f5524e4
SSDEEP 12288:XpFtvOX5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:BOX5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1975502193AED20E4D17A813C5A938219C372B876131257EF06D1817B5FB7EF46C3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 61c0dc758c19096af9e7cdb9dc2ee7768541357388c16d4add6fa1b0b9d59f91
MD5 7811a727ddce2eb6f4aee1fcfad9099b
SHA1 36c46af44aac04ee8aa17b057392aa9474711934
SHA512 8aa5d7cdd05c3e8208e89f0b3d370b011982d9313bedff271ce6e4333643b6962ba416fe2d05b6dafca84763ef8f7cbab3c529857c3abbaa22b675fb86a283be
SSDEEP 24576:l7NM9YmZqmWMUkPjZM48Mv6bEhs05T+v8zVW76r0KA3qHwg4xteLG:l7cBWMpPjN8DbEhLXch/3qHiXeLG
TLSH
T100659E2E6BAC81E5D577C13DC9E28205F6B2B4611B318ACB1252833E7F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 995ab91ba5ae26324a62a7d3e81e6d6b4fad8e7b7bc25a3b8f547be99bd7b0ed
MD5 a663f935c9e94bb62b0088b390ecee04
SHA1 0d1df6a43d62e22f2b3a90ff1ba930c0f72932e3
SHA512 1f7e57922aa1bee5d479a8038099acb53bcf76410f958406e5e0ff83721a58d3cbc64df73813393385a3e0f017984943a3219d9817f54c469b7ab271ded31b1a
SSDEEP 49152:HF2YuHNETovcvNYf8kmAXch/3qHiXeLG:e6tCf8k9XA/6CIG
TLSH
T118857E292BED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 89bd6e4ccecc86becf2eb8726ed6c713db7e1c28febb08fa78c4e283fc8f846f
MD5 3a132ffa8360b483c65c006e0d8c5def
SHA1 2fb3b7a07571221492f44bb51f3cc400bebf71e5
SHA512 2da83928b8f6f879ebf3de6adbbc1c5fa68852962efd8f4890bb393d64921f06a8b4cc280043dd84913ccbf82034b0918ea5900489b58761f96d2af38965b2c1
SSDEEP 24576:jAFs06+Omlf8NXEbToj5T+v8zVW76r0KA3qHwg4xteLG:sFs060loXu+Xch/3qHiXeLG
TLSH
T1C265AE2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0df9bd2541d90961395c88d850dccf1134bf53873255284823c0ec09a58b59a7
MD5 c236cfc2a22db252d2c70818e1cc9c28
SHA1 2aa3f71fb12c84b4efbff45126172c9dbddf2655
SHA512 7410a57740f8b22877d1857c8a4ac7cd9d857884cbc0fea674671f6446c1add6b78e428e42074aacc54e1d91d3e627f5b32e1971e58b28971984c6d299c2db22
SSDEEP 24576:6JnJ5D3WtG5T+v8zVW76r0KA3qHwg4xteLG:6JnJ5DGt+Xch/3qHiXeLG
TLSH
T19C75E02DD2A810E8D4B7C274829A1755FF72383D2B226DC728B4D5353F22EE0A979F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3cfacff1ff389ac64f4a5286e5330884a249be4695b862a8d1e98f8879dd91f9
MD5 a0cdccd4adad6ad6da3e6a2120711055
SHA1 7b1ec904348756ff03c1db35905d03071249d911
SHA512 b127f6395b6382d28500ba44385b10ef9d2837b613910a1e5e7bebdd0346743deeabd9725b22b31ef78b4f4057c246db66fc079a76951a31ff8b463d88d78d09
SSDEEP 49152:go06DIKdwc+eQnSt65aVkXch/3qHiXeLG:tiXA/6CIG
TLSH
T1AC956C15BBEA5294E8B3CAB1CA6291159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 061e58009fce0ce998c32d736a08c6b13865c9ec98477b4bb3629832df9e3540
MD5 c4b145d5a5ad7b4ec12cc7f4a425f2bd
SHA1 53e151da36aa84879f34f728a59be8b1f18991c8
SHA512 53363040b5a32e495dd70f4daed54eae8772ea106cb5933ead157a0669f7de8a7e8e86ffdaf6e476ce9d5d71ab78a19463495535f55c6808ce63dc5657c9a09f
SSDEEP 12288:pEP3Rr25T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:6r25T+v8zVW76r0KA3qHwg4xteLG
TLSH
T13055125D2BAD70E5D12B813D5A928204C372F07223522BEF16D6C23E5EB79F42D39B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 9156dfabe415f4021bd379623211658a611ca28d175fbf7cedafd4728ee0b2d8
MD5 9f3e01d0fb3169108d619cb390940d9d
SHA1 b72d00137aa93fb447be9af819f589d1d019745c
SHA512 232b4b3e196a337c4497e9a0eca3901916cbfc41defca8ceb94e5997344ad147b6b3bf7bec3b773da30dca62c3cd2fce086c47361b411510d7cc5290f0d41228
SSDEEP 12288:ZjkyR5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:ZIyR5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E7551208279C6494D6BB46389EA381A0CA31BC31671196DF65C1E63F7F76EE07C30B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a7f3e7204c0733df764cda88677044990aee481f186dde32ca46fda992cf802e
MD5 398ecfe9b3f0b2b5c9ce3647d5ed3768
SHA1 d820fdf4a7768e26d6ac21a2e7249de6e96ab44b
SHA512 fbb66f365e44f17444ab719f78f42d2d73a16376c41371e9a125f094012569c8318ee6207aa90a28b93a57a9d903ea5f5d9f9f2823a8d5fe8c4a0e574b837752
SSDEEP 12288:/Fn5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:tn5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1F245234C2D6E3854D65B8A341BD39660C2527477334668AF2ACAE133AEF5CF07832ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 30468f5a43c91a4bd73c6b2d4d0936e1fb532e84093fd777626298e8246f2865
MD5 5aeaa6ef50d8979546eb3f3cf026a017
SHA1 a46e1ccf6ab812aeb393f92f105dc4c9bb690e09
SHA512 40e529c57024be0be2513ea9a2477627d5e53c2f82d1ad9c434971afc2503966f3e1ddd9a6c6e6a297520b0c0e933e5939cc9b5835afd52dc2c38d714cb3bb88
SSDEEP 24576:pQ9MxZKdcz97w3M5T+v8zVW76r0KA3qHwg4xteLG:pVKXIXch/3qHiXeLG
TLSH
T159558D2DABE9059AE177C23595A250C3A673B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 536c374297dec3d02400312b181810b4813737a3eaac0117aa363b708a82a02a
MD5 b9f1831ff12501918ddaf5dbe0f856e7
SHA1 dcee3a9933c00f8a505fc255b3fa12d14c3965f7
SHA512 561cdc91d3f52c1eda365a9262824019a655da4dcbb6759a8271fbfa6bf3d5d213de10d74b21ca8368312025a099d33b7c208f1b3dcc7b2585228ad6334809e4
SSDEEP 24576:uyocxApN5T+v8zVW76r0KA3qHwg4xteLG:zocxApnXch/3qHiXeLG
TLSH
T1CC65E01FBB6E40A1E167813C89868245E773B0311B6257CB6692C33E8F779E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1ee838c039d8f2214f64a4f11a87ae2d41230a7a28ff4fd8a16927be09ec0185
MD5 8f2f52565232bd10e07fa74cbe315df0
SHA1 d2963f85211d21024a035f79082db1fc767167ec
SHA512 0f800bf2bfbbe8e31041c62073c93f45fd89ffe4b0f4b2c90c7d1829a5f401fc2c75e7faecef8d1dd0b2c0bc267b7ba19eebe7ac1491ac3884c2d39374f48dd4
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKnXch/3qHiXeLG:s0zuNIzXA/6CIG
TLSH
T122A57B3DA2BC00A8D9AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/512-357-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/512-351-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/512-350-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/512-517-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/832-244-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/832-237-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/832-338-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/832-238-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/836-249-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/836-272-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/836-269-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/836-255-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/836-248-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1396-289-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1396-405-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1732-407-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/1732-536-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1732-406-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1732-399-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/1976-326-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1976-327-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1976-333-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1976-513-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2540-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2540-38-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2540-29-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2540-228-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3048-412-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3048-420-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3048-418-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3048-537-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3280-387-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3280-285-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3280-279-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3280-278-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4092-528-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-534-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-524-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-523-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-521-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-519-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-518-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-522-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-539-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-538-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-530-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-525-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-533-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-532-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-531-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-529-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-527-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4092-526-0x000002DB0B560000-0x000002DB0B570000-memory.dmp

Download

memory/4100-411-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4100-292-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4100-299-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4312-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4312-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4312-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4312-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4316-432-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4316-508-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4316-303-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4316-510-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4316-304-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4316-310-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4336-260-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4336-367-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4336-261-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4336-267-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4356-382-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/4356-520-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4356-376-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/4356-384-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4600-321-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4600-507-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4600-324-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4600-315-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4648-0-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/4648-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4648-12-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4648-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4648-14-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/4764-60-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4764-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4764-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4764-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4764-76-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4856-361-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4856-374-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4856-371-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4856-369-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4856-368-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5008-151-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5008-24-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5008-22-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5008-23-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5008-16-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5156-514-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5156-346-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5156-339-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5776-65-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/5776-71-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/5776-73-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5776-230-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5784-388-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/5784-394-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/5784-397-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5784-535-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5844-505-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/5844-433-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5844-446-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/5844-515-0x000000000D0B0000-0x000000000D0B8000-memory.dmp

Download

memory/5844-462-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/5844-430-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5844-570-0x0000000140000000-0x0000000140179000-memory.dmp

Download