privateloader | dc6f63eb506cab38a8bea95dddfc5f252525dfb2b720e2756941441a8ec68fab

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
Size 7.6MB
Sample260722-a1trlstsfy
SHA256 dc6f63eb506cab38a8bea95dddfc5f252525dfb2b720e2756941441a8ec68fab
MD5 dae047c84a12cbc3048bcbb43c9e7850
SHA1 74aeebf5be3d155e751de7e632d524ce03e32e36
SHA512 949a12721b34dfca0330e03efdf0e01455bf9185c0dd8dce2bdd780997567600f49b3c56fc34f127e4268bc56ddaf9a2bfef7b14dea50baa2bd1321eeb7f159e
SSDEEP 98304:6+mQlizx8CCRTR19CcWLMrgjplrkeunk2YisAv/XXabb4uBQV7w1:6Uli98CCRrxW5pl/uk2YisAv/XXYEq
TLSH
T19C866C1262A9D1E8E0B6D138C95645F6E2B27C19CB7097CF1690BE693F73AE05F39310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit privateloader loader persistence spyware stealer

Malware Config

Signatures

Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Executes dropped EXE 11 IoCs

pid	Process
936	elevation_service.exe
4252	elevation_service.exe
1772	maintenanceservice.exe
1760	OSE.EXE
752	PerceptionSimulationService.exe
4652	perfhost.exe
3388	ReFsDedupSvc.exe
1128	SensorDataService.exe
2828	ssh-agent.exe
5532	AgentService.exe
3364	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6ac6cbb0e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2e9f2d97219dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000492e46d77219dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000613413d77219dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000843c67197319dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025027d197319dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	936	elevation_service.exe
Token: SeBackupPrivilege	3388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3388	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5532	AgentService.exe
Token: SeBackupPrivilege	3388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3388	ReFsDedupSvc.exe
Token: 33	3364	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3364	SearchIndexer.exe
Token: SeDebugPrivilege	936	elevation_service.exe
Token: SeDebugPrivilege	4252	elevation_service.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
4880	2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 208	3364	SearchIndexer.exe	100
PID 3364 wrote to memory of 1940	3364	SearchIndexer.exe	101
PID 3364 wrote to memory of 2620	3364	SearchIndexer.exe	102
PID 3364 wrote to memory of 4108	3364	SearchIndexer.exe	103
PID 3364 wrote to memory of 4780	3364	SearchIndexer.exe	105
PID 3364 wrote to memory of 6012	3364	SearchIndexer.exe	106
PID 3364 wrote to memory of 3100	3364	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1772

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2824 2864 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2896 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2896 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2824 2864 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 df0b37442aab457f1a07575991bfe67a3394b0a209d788fa46fc9c43af2c6544
MD5 b908091628148ac24ce676b21e76a9e5
SHA1 69b1868ecb120999e3d58824142d3abc911a043d
SHA512 537ff49dfdbf450b6b6c25c56bdb8d001b577928a6ca32d1e51971a4f68ab0a9817050f677cada628ca4a4a81cc5e5809067fac10edcea6a68d3db4ef2b67cd0
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4QV7wQo:M3q6sjBTQV7w1
TLSH
T108D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8dc203bc866de03dcb6445f898f02c461dfcff6b7693dda123e528486eb17fd8
MD5 835402e8a8fc894045039a056c5c8b6b
SHA1 af41a63de06728f16c2e6b561cddb066d2be2b08
SHA512 2bb1374d508e9132252979087bb2d2708e0be59de0b3ac5cb038335081b4283f2e1fd7cc5c0eb73d1a5928c98bed9d582a8201c221831f676c65368e1ab82307
SSDEEP 12288:31XLsswWkxy2lRq2czAzjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMma:lXYfDtczAzjzpQVIKIz0IrnsjbpQlrf
TLSH
T1C065F12873E408F9ED6B8279C9A28515E7337C914360E6DB03B499651F333D86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3788268cc9befaf99e3e5ffa487ac8e2f87aaca555b9eca996250ba30e259fa6
MD5 3b64c9bef78f280d09c58618220153c4
SHA1 4ff7f2e127b19552459fa4be3b6f66d105c9e189
SHA512 05ebb28c233513d077ab71fdb80008ed7ff2a277f97ca33be4b1f0ab025e93295b7ad7e6176da7faec7bdfc4e56b48daed35f752c7b71b935dfe16fcd957d19e
SSDEEP 24576:i0Le5ji0hmxxrM8jzpQVIKIz0IrnsjbpQlrf:iPji0AjLQV7wQo
TLSH
T14E859E15F6748335D073C0B9C5D2A69EEA72308257308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 260348091016b9810077c48c8216980bf729443a75ea8b4fe99c9213e7ee9bf0
MD5 f78f230f6df9788ca04269e5184b54d1
SHA1 6b8d33caffd8ff935dd146ebc698fc9e382c59cd
SHA512 405b46d333a9069a2c285368a063d4975973d1eb091a4229d93f244774ad3dd26920f541cfab42a184709fcf3990ce3b6da13e8bbeb05e80ebc6ab1cbeadb869
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyu6jzpQVIKIz0IrnsjbpQlrf:6/ezSC6vUzPveHjy/QV7wQo
TLSH
T1E3756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 03fdb485bc669a66ecb17dc004468f15e4d2d8b534f3bab90701581d4330696b
MD5 8f07960bbeda544857c82c608adb9647
SHA1 9606d3f8a87c872a59d3d3786590dfa41137916a
SHA512 a37588afacc46c7c5ffd036539875f2f4806911bd172484ca20da39174da08f5f530740439951cf4bb5b5c26f54f53eb969301e5d430606256e827e167bb5b70
SSDEEP 24576:OVbqPb88hv/l+YXjzpQVIKIz0IrnsjbpQlrf:OVO88hXl+sQV7wQo
TLSH
T1B155AE66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 97513099331d813ee68599c26b6b2d3b219b40bc447c6a90e41de5d99754b14c
MD5 66c934f709b5870d33f1a5db155713cb
SHA1 e3585cf91b985b15592904da74932974dffa7108
SHA512 d0edd3fce03abf6fc1e8b395d77fa304b06f0e6dd418acbe74290cafebaa6111b5081e7b165df5007a50a60899be57a3100e33ef8c2e97d26654231412046cd2
SSDEEP 12288:cLgjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:cLgjzpQVIKIz0IrnsjbpQlrf
TLSH
T15F45235057A451F3D35D2BB3AA9E227973563CF2D180E8E71F707AAA0CBC628B467017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c553fc7cd02d8812c0fdeac6cf36837f9ffa6a6bb710f70db4c055c6648719d1
MD5 701cc31566660a266f1a03700c7dcb3b
SHA1 756fe49c4f355461203a38bc7bd4ef0d0330ddb3
SHA512 5f0a70d49dc004a0066740b43130646fe9d531ff742dede545f50c52458e69fccc5f1f76f200b92a1f96573d40a7855cd3094c2766476a2be4d4bdc43a8dc287
SSDEEP 12288:feBNUbTVO86UfjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:fJIUfjzpQVIKIz0IrnsjbpQlrf
TLSH
T13C65CF3BEE28FCE2C27E5DB95B918200E77278714B51A3CBD174820E9E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a8f098678547e8f6aa4bfda834d5c9febe8cda9824ef1bbe9dad7e88f30362c7
MD5 a4354c9efd8eadf497ca3fdd91927534
SHA1 2b669b96da7a8aa2a0ba1a22826a95327ece0dd7
SHA512 d473dcb3ada5b9dfc5e767342188c90a4709b9f2085b0dff8b3ca3df3568930d51c5a98777b12f47780b3511c9595fbf0e303e6d5a876140d42824402beb9131
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THR:nQvGAdlCEL8c/DRNw5C0QV7w1
TLSH
T1C0267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f3c1ed45c6bd947f91c21554eb90d15bf6de629e436f725155fe4745ba478a24
MD5 2309a4fbc817f7a30da142bbbf51a963
SHA1 99570c5a490f7f471d1b2f49b6595dc0b096a088
SHA512 8ed59ce67de6acd1554960947cff2cfe64bf42d81c612b7c500143be3b6f1fc15e54f88fd858fd6efec18669efcd93ec88b926bdaf551d9e672b79c6667bd6e4
SSDEEP 12288:RAwSfxL/2Dc3RDLLmt0LDQewsAjljWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImC:y0ewsAjljzpQVIKIz0IrnsjbpQlrf
TLSH
T1EC75E030FE74E036C3BF0EB21B26C716642D79604B5119C3E3B89E9E59742D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 71f36286b77f3f788248c7e0ee63c0fc24db7071b4ee856cb3144a4b7c2c4f03
MD5 7442a35ba6b0eebf5ae37b920c28f9f4
SHA1 e351760644086e671076570e6330bda810b3522a
SHA512 d6145d290dfb1418ae817ae0012b5bfe8e25fc0a0b5fcb37e500e617c495c1263d3c2181f47040b01e3b11964ed5f0f5c514f58ef4e2fd1d56d710bbd22d307b
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHkq:TUEtQevvqc2W1cpV2tI32P
TLSH
T1B8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1adc20054e4fd2cbf416f9ab42ef993a5ddce29607fdf4cfc701a41e0e9ede92
MD5 959d0facc06199ac4089fd24e5a5f10a
SHA1 06b55c6e88ca509cc09f20ba9c0d149c63ffa58a
SHA512 7f6bd70732a8acd3c87f7ca3897bf84a8654efc32d709d134aa1942e3fad962a1ee57d3522004e573359592ceccb802798857b281b022dc83fbc7c9ebb58cdcc
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zbQV7wQo:koquVjnm4QV7w1
TLSH
T1BFD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 84955130b34502c13169345a03e0a5c6a16a3cd1740aa1a8431041ddf87bb630
MD5 d7b0694683790216aa4ee4e119721e88
SHA1 e1d55e58d0e056566993df6e529ef2ef66c2b70f
SHA512 353aac71ce6263f38037a923499aee274ae6dda7cee7d1dfdd134f73feb27dbf2446232a67380a6f3b3a5a21236667acd425b490a7ab769dbf4c5aa2e87c3467
SSDEEP 24576:1AhGL3IFoiwtA5l7S53WjzpQVIKIz0IrnsjbpQlrf:1AMUFoiq5oQV7wQo
TLSH
T1C2359D80E7F955D4F5B3ABB899B69171EA76BCA65E30C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 79899b86751b36a9f2e4d507d9692e7ea85e68f0fd2bb3b8959da08ae5f71b78
MD5 62bd05bc8bcfd2b2699260c8f89ecc1d
SHA1 31b3b6444953a46f03a7821643119457ed0aa72a
SHA512 e20934ebb7a9e30fe1af4415811bbe95b4c44aa8b14e83bd7d438e38a1337f14b5fd5f47c7826659d043e6a958e1b0a1421fd5940a3182a4dda4fcd89f910b4f
SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+CajWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7F:fwu4OWhjzpQVIKIz0IrnsjbpQlrf
TLSH
T1A965F14577A40CF9E667963986978136F7B2BC122A20DB1F1770C65B1F37321BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e196b925e774b016227e9f39ec3332ea460034b59e50a5f52a8b4aa045ff77d6
MD5 3f90c43df38d88f6bb3b53dae19e886d
SHA1 24b1746fed91cf4bc45fc3a928b8c5f0564a839e
SHA512 8112b6f504ca46f01ea71e2faa3fb5a22e324bd1e1e17cff0c29ab7d8130dee4a299ff9ae2fca3e2c344ebaf33f0d1f9ae215cb3997bb49d6604b9e8328e9979
SSDEEP 12288:5eZ1Iy1jWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:8ZuEjzpQVIKIz0IrnsjbpQlrf
TLSH
T12855125423E420F6E297537AD9E50219E3723CA3637183CF1B3056AA1F76BD56D3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 78ce8e8bc6626c26e11eff0a97a12f9c4a01a89095a4a0ac0043d3075340b903
MD5 ec75993ab9de85e8fb4af9baceea04f2
SHA1 035308535fe5cc4de696ab6d9a14280ed3654697
SHA512 96c1b3bfde7e96337ad61129fd32880bfa0215262ae8992225ff2be92c159054ed77feb87778d9a537a20a1444a6c894be8beae739e0792caaffe2a11c35cd24
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ud:jQRQyi36YOcPbLvw2gAf+PN3lQV7w1
TLSH
T127667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c18db55f27db40990cec421bc360eb691d03f171840d7428d9709da7d0ad4a5d
MD5 7d04695405ddc27a6b11bee6b72c5052
SHA1 daca4a0c9ce9552ca6a7ffef61f555fbf0a5f611
SHA512 b1a4d77f23844e7afb644fdd861f24affdcd70a793f2ffb354efaa5bf9503ae6523db48051c629d7d6279afba276f7a80f17eab168a60b763e2591da75d874dd
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ud:fQRQyi36YOcPbLvw2gAf+PN3lQV7w1
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7db35c508247957996e75188cc428319c10a2c1a2043a0fd44fcb74df55ef752
MD5 9a713b8402a1a10fa8508df005d8cb0e
SHA1 48af2f717945286196e6cb2c52756adb46c7b470
SHA512 effa6736b0f43b7e0ce85b21fcf2672e0dc16be7e8c4a247d360abfa026fbfa7292ab3b3d61b2901885fce777b4fa265d034911984898d7e8a077e0ee03f07bf
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL00jzpQVIKIz0IrnD:w68Qg55nhceWu7PNU3/LQV7wQo
TLSH
T11EB54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 57c6504a9d12d6710af1013f07c4c34dfd63fde2a69d3a55358c13ee018bceac
MD5 9df2dd5afca5b767685c9ba60f9b8352
SHA1 74025579ae38ee1e7f108dfa20e85f85573d6b3f
SHA512 09c5ba09ad9d3bd1cb37bf9ef5384e8fb9e8a06be0269ae914e64a8606dd7f36c35508cef5dd5cb34dd7170a3525cd073aa3dfd20e75a8752f79abb71ffaab33
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99X:ay5112gYy5azzVvt69nLKnhZmQV7w1
TLSH
T1FD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1b0f5c3f607a9185a622dbecf1274495f42d50a65e1f4113a59de21edefe841e
MD5 1196cfd5681156b3c08b24f597cb2f01
SHA1 9deed3f367203a134827c7253bbdcba0f08c6ada
SHA512 ae0d53a1f6100d1a93fc5cb2184688302974eb8eb3299d7eefd88344279f9d684f217f89c34f80105998655c6ecbb967cbe9a728b486f4b08a6416e791ae291f
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3QV7wQo:Ou6Jmdxd2d3QV7w1
TLSH
T151D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1448e356b246bbb56aa401b7bdac1f3dd7ea7aca2a123a549f9b78ace0530c62
MD5 93ea7de62d761c02565ea62b77b32a4b
SHA1 f2948960bd9b4909f3466c5da75f343ab7854c92
SHA512 5c21476ed97f8b028121d820676aa30080fbf65b50b85986d8f4aa7bbe541d1cc34da4f03b9f70f8ddc81fa3fb467257b4dffe088ac666ce35e443b0a7494a9d
SSDEEP 24576:Yhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3PjzpQVIKIz0IrnD:k1hpsNoJpF1A63U44CwH7R4xRQV7wQo
TLSH
T1A2B5BE13F2D900E8D05DD17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 278c74a1bdb41b1e3820ab99e1c8ace80a86331af186bf1c83bf2f4d8e29e8da
MD5 8f45feaface68a5b090b5626b2a49b91
SHA1 4c60017a096c5e346a0470a63af9bfab63ee6180
SHA512 deacdd6a82f376f23976bdf2af17069f1d1151795c832268b5f5d3933897efc3992d256d0175a89336b131c3f5d671584e1ce1389e0340524e762a0ef45426fe
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHqyQV7wQo:M5dKii61yQV7w1
TLSH
T1CAC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5e5c43eee48f0531020114ef47d59c25bc8b707504701dc98905f62f8c7ee1a3
MD5 ed540b885da9fd82eaa4223ea127678d
SHA1 babc7b5b069b208ff08b022eefd2b77dbee0e470
SHA512 5c6fa6409cd38be8ee411653b9708f454c0ff027d478d5e4b1f7a9c11fbb20a9f1007780bc871c3c3ffa6650aefacaf801d89cd6a16f7e21d971e26140bed79c
SSDEEP 24576:xhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLPjzpQVIKIz0IrnsjbpY:xhtSn8EApI0fig3giDn0AP5wtQV7wQo
TLSH
T15995BE13F2D901E8D05ED175C7468632EA62BC160B34BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 00dd2d7ae8f78241d485b12cea9a16e644bdd389569eeccf5315cbff39599ac7
MD5 0efdc5ac981793df49706e6ac1f4d1a3
SHA1 016d8e0e3caeeeb1aa9fbf76883b9c839a9f77dc
SHA512 10ca8a3cc77de452e15f8fc87a40bbff809c4035898de074c8cfb2b6d20721f4493ea82e0b0c1ca21ff80df8bb2a0a5696ce17329a8ed1abcdfe1c96ef4c214e
SSDEEP 12288:+IjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:+IjzpQVIKIz0IrnsjbpQlrf
TLSH
T17A45235056A441F7D3082BF3AA9E1279B2563CF3E240E4EB2F7475660DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6ad0df440c5eecffa1e9057ccd447682fcb3b57b09979a639719a4cff4c709e2
MD5 fd64cf30d9e4d9b47d61093d0a291e3c
SHA1 2249a9e2d768b7d16488c1e64d3407f6893a22f9
SHA512 b0a9ee7e4b83a0fea5d42f9a094cad9cedbcc6c06d662bbdcd0dd49e7bcdbc24a6d119796e05f448dec2348bf5808dfed44531b65738dcc4f308835a7ddc7289
SSDEEP 12288:AZjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:AZjzpQVIKIz0IrnsjbpQlrf
TLSH
T1DF45235056A441F7D3082BF3AA9A1279B2563CF3E240E4EB2F7475660DBC738386746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 55288d9da95b3682d493f7ce6c5b646248e943b7e4ac48c51ab4f3524c7bc0c0
MD5 f5f5cb797093afc4961b331e9b82bcdd
SHA1 b2f219fb359a05c43309ded471380fcc68edeae3
SHA512 9f28ca45a63204b77b5965d393dde64fdd4975748aaef2400e35aa7c250d72d72b67e9638c11bbf454f2a71669083265f97170404ca527d664a558362b364f4b
SSDEEP 12288:EHjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:EHjzpQVIKIz0IrnsjbpQlrf
TLSH
T19B45235056A941F7D3082BF3AA9E1279B2563CF3E240E4EB2F7474650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a3701b58c78c41097522000af1ce132f9a9a81bc39fd96f58f74a1e701322d44
MD5 b87bea37c425e789d1dafce26b375f27
SHA1 d58c344ef5c170e80ce1607fa7d2e2d40eeb4a62
SHA512 07f3d3fcb3da22e5d322b96ffc4396fc2edba30f1224a9625e6a6d14f34013da01df01f393f30c39ab40c425de8fe8bba3a8f67d28413288b8e9a02d27bd5a9f
SSDEEP 12288:HV2jWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:YjzpQVIKIz0IrnsjbpQlrf
TLSH
T1DD45235027A841F2D219A7B2DAAA1279F3763CF3E310D5EF1F30256A0DB83647837956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 50c3e4ccb31e8a23a021b691642d08bd09d1a7ef94e131db478f89a273ccbccd
MD5 981db560fc64f9a3d8705f6cb520f373
SHA1 93f8084409dc1fd60a2f453a43135471882f9b68
SHA512 9723d3daf8a24ccc233ae24e847032af8850e090d4e5f774b77b123e771874191576002a93df0e9157c1b795ce09495f5b4da44cce2689200b35895c80000464
SSDEEP 12288:zujWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:zujzpQVIKIz0IrnsjbpQlrf
TLSH
T11A45235056A841F7D3082BF3AA9E1279B2563CF3E240E4EB2F7475650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e53650183e4e1cd0c3735e2f1abcc188930b42393d619e602d190ef763c72742
MD5 2c1a23ba80691555c3c1e9972a4b949f
SHA1 6a6cda8cc4c14a696d2b70c6a233d21bcd587017
SHA512 f73eba7137254df9aa894d4f0fe1dc5d5d82cf21da81c51bb7a152df3658bb357ce46ef18fba4b183c621760d74d2a1300dab88771f0c0a5030bea1e8774119b
SSDEEP 12288:QtjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:QtjzpQVIKIz0IrnsjbpQlrf
TLSH
T19245235056A441F7D3082BF3AA9A1279B2563CF3E240E4EB2F7475660DBC738386746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9ec023e782fef9997b91375621db8c3fb2af627dc0e3904b7f806a947fd0c647
MD5 ad093bad3dee3edce025d148a06f6424
SHA1 6e0fcb9b296c7e3cf5ddf2c6cdafc44f5bcf90ce
SHA512 36acd06942610c1c534cc9f29c60c128f50497e3145508b23dedb7d8dcb629c53cbc593fa99bd058fd1b9809df7394641af6bdfa404b41664c1a59033612b70c
SSDEEP 12288:DRjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:DRjzpQVIKIz0IrnsjbpQlrf
TLSH
T1D345235056A441F7D3082BF3AA9A1279B2563CF3E240E4EB2F7475660DBC738386746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d971a575efbf3184315fcc71b0b83688b9facaa278ce2be9608d6698f3840061
MD5 b8cf7ee33336776e19c8888e4b4365d7
SHA1 00b50ad8b3a293dddedbcd8679378a4f5f26c1a5
SHA512 9517c5afbcff024ea0f2a8e6823fe740320413b9881aff42063974bfeca29d4901960b72604fbb73e4494f99ee60a91ad152160e9847354e6df9169b980009a8
SSDEEP 12288:diZwbVzzFEoS2cPvy5jWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:gZMRzFVSO5jzpQVIKIz0IrnsjbpQlrf
TLSH
T1DF650294B3A008F4ED67823ECD554916E2B27C664760C65F07B4366B1F733A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ea153327c05664ee759a5ae49fc496c1292e9856eff3c0243904733780268fa6
MD5 d0577e024369c7b9049ce8748d912adf
SHA1 f0bf99c859f6bbaa867a17c50db3bdd2d288453f
SHA512 e6975055ea8e30be61dd1313b51024f6f9ea5ff4e1b921c3937d6bc830e43006a41939442e91d42291dd5b4db11f76cb183380e2414d8c05cd0dec377aada7a1
SSDEEP 12288:2UjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:2UjzpQVIKIz0IrnsjbpQlrf
TLSH
T1F345235056A441F7D3082BF3AA9E1279B2563CF3F280E4EB2F7475650DBC728386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 39e6a325f95faf1e6f075089849ae1a727c9459b6e5973a92dd208ea96529b61
MD5 c66995beaa4253c9b5bfc5e5e2264e06
SHA1 88d01bab606b5b0e57618719a47b1ca1474e27c6
SHA512 360008a88ca3462d88e407cebdf8994cab99be9ef3ce37011366626b074e7d595138649e3ee3ef15c44170e826c983deb7fdd20c3bc2eda7b940595cec3babe3
SSDEEP 12288:GwjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:GwjzpQVIKIz0IrnsjbpQlrf
TLSH
T1EF45235056A441F7D3082BF3AA9A1279B2163CF3E240E4EB2F7475660DBC738386746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e8dcdadeb3143e1ba481f3259d4bcd71bb66e3ee8d7f0dfbe5f5f787c71b2a93
MD5 00948ef945ea78a8e223770b3d5f0d75
SHA1 625e34d105cdf565dd99c7efa42799706c27a580
SHA512 9d1c22b45cc392c33eb54b63ec1192137ac6e596857060f7bf13ea9f1e79257e8eb600fedba1c9102ce5fe9bca55432d84dfabaa5273979605a515b18eca253a
SSDEEP 12288:EyPz5L81jWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:dzy1jzpQVIKIz0IrnsjbpQlrf
TLSH
T17B55020773A120F9D22A9375C9A61616F3727C724720DAEF17B016761E377A0AD3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3773c4343efb32343ea6a44207f1c805b0a200c05560c0e6d6ae7c3836980756
MD5 4e98c4178123946bb676cee69756636f
SHA1 433e6f817cfe2ccee2a7092415f18c0d5b09a962
SHA512 183b47d94d5301f8ea7b48a7b3453b0cae6ada5aac570facb71cff26b260f573c6108b2ef882c272f25a8f1a156b1417cc5f1eb76d643c7c27f4f1fac5480e11
SSDEEP 12288:aUjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:aUjzpQVIKIz0IrnsjbpQlrf
TLSH
T14F45235056A441F7D3082BF3AA9E1279B2563CF3E280E4EB2F7475650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ed8fd777d279e4b3ba4cb32de16c4dc21caa3a57420df183584b57e59b7f0326
MD5 646ad306dddd2d4e0fb3b8f5a7c4d3bc
SHA1 0c9f6b757193fb3a2e22ff88195921e3bbbc9e1f
SHA512 f4a80cc0870f1c312b6f7c6d6862055c9693c10fb169ae6b6d8548d9ebda5b16ff899ba83cbabadbdd00037b3102d736f48b25b0a9921ee06eec14aed56d5c11
SSDEEP 12288:7UjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:7UjzpQVIKIz0IrnsjbpQlrf
TLSH
T1C345235056A441F7D3082BF3AA9E1279B2563CF3E280E4EB2F7475650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9f19b0c8574c5397b9e80a3fb9a4e75c8e77835458f1f685f06fdd8e7950d9a7
MD5 33636007a777a85fcd134d62eaa74e32
SHA1 ee3b66f135cc90511abf6953ad10910bdd37fdab
SHA512 9a3537d05a7e5588bb7ad6e15faa99d16b27e1c49be7c715e827621c24e3d7f8991399c68b11a8676eb42ccc23ac3c8474dbc48e299f200cae6a09fa5e98bc20
SSDEEP 12288:zyPz5L81jWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:+zy1jzpQVIKIz0IrnsjbpQlrf
TLSH
T14555020773A120F9D22A9375C9A61616F3727C7247209AEF17B016761E377A0AD3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7c27c8651ea0ca456582bbd9ed9b882b8270801cba3236949eaac68e25b24d34
MD5 08f78f4bc4b5b96ee23e8fbed18d32ac
SHA1 d8f2b60c663d063304b187ec8f8d4a08963873df
SHA512 10a9d93495f584220256beb1f36ccb6690eddc02b47b7456d8c1cdfc30d0e1ae633d4138e81b4de56e93825cd05892be77dc6fef441563ee04d44a32b41e719f
SSDEEP 24576:6TDaLl3z0zD3jzpQVIKIz0IrnsjbpQlrf:6TuLljEQV7wQo
TLSH
T127650294B3A018F8ED67823ECD554916D2B27C664760C65F07B4366B1F373A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 101c75517f893564ba637f01b62d4ecc01f4f5e10d03c34f38b849ddd12540f3
MD5 ab2c11a913bd86ff070b2f05bea3d781
SHA1 50dc992d8d111699413238a8ad1e9fecad85cc49
SHA512 0a4c6d590475265d42d3bc8b13997516a5bc722ae92f8152bd0bca6a656df2c51fd88b747c7b087a4a5f2a7d62720d45d3f691fff0e3bf91bc96a272602d8294
SSDEEP 24576:P3vd9CHKy7GZ7jzpQVIKIz0IrnsjbpQlrf:fvd9CHKyaDQV7wQo
TLSH
T11F75CF90F3E410E8F1B79A35C9764511DAB67CAA5B20DE8F03A4261A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 17d247ab459bdf757494a9ef14e0c21947599da2e82b18c78e2f7f062f489bab
MD5 344ac913e5294f0fe27f9a7a1ea6993d
SHA1 4d465756c9bfe77b0676a1139346d36c40b60afb
SHA512 b53b66bd219eff3f8de5cdcc3f37fa51395715e0ae83bc0d4b0c69e7a3826da616eac6705bc2e0d84cc96aa146ea8c6b82ff4eba60870fada006701030ac2a57
SSDEEP 12288:PnjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:PnjzpQVIKIz0IrnsjbpQlrf
TLSH
T17145235056A941F7D3082BF3AA9E1279B2563CF3E240E4EB2F7474650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6d3b4a5ef54b598043d24fdec9d252a04a771b92d188aa38f0c758f62c2a0bca
MD5 afc1f438bbd88a69386171a8c58b1e1a
SHA1 c23a54f262d57a3d4c39a8f7b08d08109f28fc37
SHA512 f62f5c011a2d6592e3691d2c9bd670bd96b3d5380ed9c37193dd27130c6585bb309214dfbcff6a7b4b21b4b3a439df7b027fd2dd2d3ab5e50177e46ed5df897e
SSDEEP 12288:0VjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:0VjzpQVIKIz0IrnsjbpQlrf
TLSH
T11E45235056A441F7D3082BF3AA9E1279B3563CF3E240E4EB2F7474660DBC629386746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 30883d15d0839ed1589cb79a74f81ce4fb425f9fbc5b502eb14bb39a973bbc50
MD5 cd8335c03d121e73353a5f57ea755814
SHA1 8a677b6264c86e99b4a4484cbb954ebea4b86d24
SHA512 49ace9904956b4f81d3f0e9a3ef4869d7d224764d447cb5d87e873b5ba933681a3bbcdb688ffac03f2c0b37d6df0039f9ddd8761c78d37b999c28be1b6cda0b1
SSDEEP 12288:byjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:byjzpQVIKIz0IrnsjbpQlrf
TLSH
T13945235056A441F7D3082BB3AA9E1279B2563CF3E280E4EB2F7475650DBC738386746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 51a0184cc932787f468d75dc911b1d068f6d5b73a54e7d394e340fb1bf954097
MD5 dac434b15628c56db0d184eeef1611e3
SHA1 cdb4400e402b682572feee008dccd9f9eb58bba7
SHA512 896afe002e630bbb7eea9b77426c2eaef129d25b1f0d175ff4bdd11a46cd94bd80cb4776850d4a2910134790192749b3cd47f0cd53eba797c0f1daa5e0999517
SSDEEP 12288:UUjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:UUjzpQVIKIz0IrnsjbpQlrf
TLSH
T1BF45235056A441F7D3082BF3AA9E1279B2563CF3E280E4EB2F7475650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9b3df6d44c10281b5dfa41807c1477085ea4790561a0871520d6a0ab8dc2214a
MD5 dbf6287e2cba0ee8f43c20e6b7ddaa3c
SHA1 561d9e3c3c303f330c8fe74d1238731a8b5a58f5
SHA512 86edb4d850b477065a3c016296dfeaed9fe8e83bc8f9fe64b4e8fe3d1ad5f88d6b98b45b628e5565cb765a9a62712237a1344384ff0248a448343f0522d38665
SSDEEP 12288:7njWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:7njzpQVIKIz0IrnsjbpQlrf
TLSH
T1EB45235056A941F7D3082BF3AA9E1279B2563CF3E240E4EB2F7474650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 679cc6ddb7e43489ffe219d79b9f8b40700cf77a389c24a35f0e418d85595770
MD5 4a0357aa80c0544b31da271c188b887b
SHA1 13121122ab1df6183fe276a9e11cd01d730d8dec
SHA512 e06eebdde987d535c9bfec2db48f7e785d9e343ad297e4950aae60fdd178981c0cad3df5ef0363a64a65a7c96d695a8ec06f69dac83ad3cca506b1a78fb94cc0
SSDEEP 12288:IsjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:IsjzpQVIKIz0IrnsjbpQlrf
TLSH
T1EC45235056A441F7D3082BF3AA9E1279B2593CF3E280E4EB2F3475660DBC739345746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1b27557b751dcd8d0ab1fbc51da429448212f18abf6512d8c34ecdd0068be42d
MD5 cb5da1efc4fc937951b6b0bcb28e7499
SHA1 d848ebfbb79f675560d9713c17a77738e457a894
SHA512 f30507caa7a11684919f758e968d4a00bc5bdd7f368925b9e69aef38878143fa3a3b87dc333c6dd6a266835777b3ab8df4964a5ea853bd37beac8282db1b23b4
SSDEEP 12288:FujWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:FujzpQVIKIz0IrnsjbpQlrf
TLSH
T14D45235056A441F7D3082BF3AA9E1279B2563CF3E240E4EB2F7475650DBC738386746A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 bb09165778a9928eea42063a376b157907969d0a8f4473f9fd87dc4d9f22e51e
MD5 d727dce7500a0e056e35f4969415b2ff
SHA1 859dc7e3d926521805f464affa462c12eb0b60bf
SHA512 2bae3b0dd0a40b7faffd231ab0eca959f8457449fc97d9b028b64fd393cec4936cb4a2aaa83c6c71a1c17ed3f5c9d4c8e2a50bf1d448749103bc89bcd5cccb39
SSDEEP 24576:bfwvUk9RX6wkyAIAjzpQVIKIz0IrnsjbpQlrf:xMnYIGQV7wQo
TLSH
T1F285D029EBDC44E5E177923C99B7460AF2B178691B31C2CF026953AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8b9b3c9efaa7c8c9014bbfff5afe4e65be8ef3fc0baa44d2435a48d26217ed87
MD5 54cdf7aa2f5166f5ac7f4379100dfdab
SHA1 35ee74e594915dbf1b9d26f9fbb9bde67ec0baa2
SHA512 d67434140ea6df90c0373192a7fb5d69c5f426466d6cdfa55b00da25b508c1fe9cf7c0c84a513fc4be7b04c2e40d9f95806f2fa7fb2ad1c6e4482492dac300b5
SSDEEP 49152:DYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NQV7wQo:2ySzPFQV7w1
TLSH
T1C6066C56A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1d9a12a0071d81614b1de7df7c8607f2d9185b99b6c28eff800b17a89def3d93
MD5 88b97461b6f1d012d6ef2c101797eaee
SHA1 79e055a621ce2a2ab21b7c00635c3b7e460aafbf
SHA512 aec7cab47c44223afe88f5184a05160a7bde2fb7d1d348bb78c558a862e2754100c24e964681b0a6f5c4a171823247e11b58be4454d02e508b243a85b967e01b
SSDEEP 24576:B47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYJjzpQVIKIz0IrnsjbpQlrf:B47JUQjTirIhCnDHUPfF/9QV7wQo
TLSH
T14C65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8aa353a8bbdd04a3ef25caa0419f80b8f5986fa622cfb21dbe568b074aa549e9
MD5 9db5b85d47267347b3ac82b2f279f9a1
SHA1 3714cc39166ea5020b952044d3e36f4533296e64
SHA512 59afd1c330e38fd4c790bbb17fba8735de1a18728913c452a1e7447c4c84aef9c31e33e3256bb29783108476629e8b231a842e8905d856e5b3b972108e0ac70b
SSDEEP 12288:tbsfEjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:IEjzpQVIKIz0IrnsjbpQlrf
TLSH
T167550119D29802E9C16E6276CB960651F3333C6293E1D3CB17E0F53E0F796946DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 05ba1c8f0363b5b7391db30ab729393cab505c47c305e25c10f0e229593bf30c
MD5 a91cdbc85d84250af4e6c36ae7d4078f
SHA1 900e8e9be26b56d503907116bdcaf06244114ba6
SHA512 7dbe3279077b229b119294b4f6f7b8ab4c64c2f207530e32920bf36193aacac91929026e260ac3a566c761bd4df3b70f2c85f61884bf51e76e1d01304cb1617d
SSDEEP 12288:vpCI+/U3fZW9AXguGvjMk9EcfHfYzxPNxYt57MK:vpVkUPnZk9EcfHAzxl2txMK
TLSH
T173353950766AC75FC6A940321E32C2CCA7707D41FE05AB0772C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9368f627fb6aea16ac2907377fe4cf12208e33d873d09e1f4c33a21df6ca2770
MD5 d3ad8e06f8878e9d5f25ad49bf4c5599
SHA1 eb37703e21d8105dab59f55a78b23a046ea80646
SHA512 ecfac3e9e67598aaa7b09cb012f40638db3e0fe69267cee9fb65fb5133ffd88887c120ccd47cc66680f1865da51415d65aea61b992901c2b6b1481e52f62bbb4
SSDEEP 6144:mq9DTY1zaXGCFwgHmfBCk726tMxp26tMxvmaGEzgpXLFBx/IN:3jLCCkIpXL3xwN
TLSH
T1B965FA816537E3CFD1FA203207265B4DBB64EC07B3496F26B3C84539D86AB2560B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsupdate_2026_07_22.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2026_07_22.log
Size 7KB
SHA256 55e361f0465e8332a77535796e3691f99c3b8e44fd77284076665722194791f6
MD5 e950e77363bb9582ea334239fc23de1f
SHA1 a1c35a8f646fd4ae88aa085876ac06789f9a4fc0
SHA512 6a3eacb3a926eb9f9242216d5b2a3d248c26bc5f0445af3874f9efdd5a44e638e563f632d00ebd9a90d2bfce6f7e731811bb29cc036c9b66bfbea14d0a49f678
SSDEEP 96:AAXKYB9eMFOruvZJH303UnOruvZJH303JLcCauj0:/XpLjkkVk5LJA
TLSH
T1ECE1061E2AF90556B673EB2699F21823D77B3A267C34DE4C00D5079F0A62700F975B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 47b059f4c99fbfb814041ad704d63392774862130f7e305ee5407f6359f43927
MD5 88942c4ee330501be8fa9530fcee114f
SHA1 05697a14469128abf8dbbaca09925cbd6f78f276
SHA512 a2717be547c5976f1810f0f842b5837c0db4cbf89a8109a34a03168261cb6e593bf48471f211f67b20cfc0b66303826f7c145cacc4f08a9ec186157ebcbd8df8
SSDEEP 12288:307cjWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:UcjzpQVIKIz0IrnsjbpQlrf
TLSH
T1D145235057A845B7E32D2BB2669E1239731A3CB29740D4E73F2076A90CBC6E87C7741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8c7de928c04a9ae1c6cf917b2dec427b0e4e4138c5819649a6eda846c25c3c3
MD5 b0a93fc230949b98fb8760aa694267f8
SHA1 07c93e93dee6aef6a38f7b79d21f87be0c5f523a
SHA512 403f9829d1f99e2042ad089b6f0382548ee69037b6b6e7678bc9948f48ffbaa8cd09e87132cf31c89b95a9be5e9d3777e4047ef8c88b98bf2b2a26adeee95893
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bY6jzpQVIKIz0IrnsjbpQlrf:8gb4mBIBhGF3QV7wQo
TLSH
T14865AE1E22E802F5E1F9D2B8DDAA4417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 64bd611695fe587f28315a05694c2b2596c7300fe3b1f7ee69de080c718349fb
MD5 72af593ccadf8b39568ee268cf60b23d
SHA1 3d63d74d52c716f8346356998703300166eb2e65
SHA512 3de0f6ff444e812983f230d02ebd8a5d4730a47efdc23aa13d0f9cbdfcfddb8e6a632926d860b5f7dcb6c72fc7349d3c83e6fa63bb51f0e67641149cc58ee1fd
SSDEEP 24576:eG88u8FpJqH1bzria7/m5jzpQVIKIz0IrnsjbpQlrf:17ZFPqVea7/sQV7wQo
TLSH
T1A185F16567E001F1D47BD1388A864663F6B2B8210364EFDF07A88A551F33AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9267a1bed97746ced4569c0de9b9b475fe3b1706a4a858070978ab0e2fe0d34f
MD5 41b46d07b70ebd78e9ed273a44e4d57a
SHA1 ab70699e164f5cc6c8fa9fb0c0c4cc54566c9824
SHA512 46442fb2e3f7a1b5f5d37c204673eca8194d21e93a966dae71b1789edbb0ce10708d79bf00675b0e94e705be33848b801d63082e53197be246ae3554f29fd97d
SSDEEP 12288:gHvUrBFrEjwaQ9jWAX5QVIKIwJq0rreJDsQAs3h/K+EKszZImhtpK7CMmqf:gPUr+NQ9jzpQVIKIz0IrnsjbpQlrf
TLSH
T11065E11E62EC18E5E67AA17D89864719F77178621311D2DF03A0817E0E77EE8BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dd1aa6e5a7d93f663af4267945037c6b189c846078010950a1a6305699e54854
MD5 e6a11e6a70150a83d5bf809c9aa07073
SHA1 88fda07fad3ee9b7548ebaeb3a01ec9fccb83a3d
SHA512 42191318ad33f4141e7001119e91d43d052f6bc1416de40df2217392c9e29f9e240a4d8b5596e546528b01c484a24fc5f585d0f2ea7e1804362631550f6c258d
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTQV7wQo:3G05lO43buQV7w1
TLSH
T1E4D5C06A62EC11F9D1BBD17CDAC6460BEBB23825033456CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eb1f9c7795bd4ead02c7d1593ff05ce16cbde4fad8a6839207836018774b3617
MD5 ea7c1d6a2a1fc4f82f10930c46c374d2
SHA1 e24ddf2d02f550e2e07fc61d934d12bb89259fb7
SHA512 91dc73f180b95cc90222b535ac121964002733cf5438d1181fc11b454add81c60831dd5827eacd032c28d78a070854ca8dc8221fafc709f376b11e5aaa60d01f
SSDEEP 24576:Qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnTjzpQVIKIz0IrnsjbpQlrf:oa5POZ3BJt2pasx2+mLQV7wQo
TLSH
T14A65AF5EA7FC01D5D1B9D17DC583461AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 17260eda815e96b0809b1ea2183a541ce87f06ba396647ab7a0d373d3abe9417
MD5 b03aff26c52030fd01ae0ac40a99fe3b
SHA1 79ab32948405a86b9ba3fa8be18204fed0a92b5e
SHA512 61c42cf5d9b7ed38fbbd3c74fb27caa134e0843286de4f44ba04911e945f2b4401e55a4f490bfba81b967b49c74b5bbd9ce586647311b59de87b52dd42ca36a5
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkBjzpQVIKIz0IrnsjbpQlrf:VNc/zEOVHFMQV7wQo
TLSH
T119857B1623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9fe81f62e8f04fe8fc9219d4b838a6a1c8c7fe82af63e07a3de5b947dcaaf49d
MD5 b0f945d746d4dcdad06411616c00f97c
SHA1 ee3766c4971c86d2f6ed1e782f10b420b829cbf8
SHA512 fd51195f3d655acd11c499e155cf77db3982a2406dc0c637892cd5c9b553f5799150de65bc56a77fff3d982049bbb43ad75186169d348cd4fdd91e96f71efec7
SSDEEP 24576:oTkNvNnaFeYhJNtmZBm1jzpQVIKIz0IrnsjbpQlrf:oTMwBtOmrQV7wQo
TLSH
T1DE55AF2EB6B846E4D1FEC6B5CD238512F6727861073292CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b9b4f7b97043e2e439a5e09ec854fd622c339a8388577bfd2e1e3b638b21db7a
MD5 4202da7384b832ebd043e579908a9265
SHA1 9bfacd8f578ccb13b0c89d323b6570ba2ee39929
SHA512 9cdfccb3a0760b41572e31b337945cc2a1c604462492dcb92e24c1c95da949d4905c9bb48a459a547678abc19adec6fafdd78a4723239d60c0737112d4df21f6
SSDEEP 24576:eD3FHshBIYQgAojzpQVIKIz0IrnsjbpQlrf:eDVHeBIAAeQV7wQo
TLSH
T1F575E13DE79C00E4E57AD2BCDA634606E77138A9032165DB06D481BA1F6BEE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-97-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/752-330-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/752-95-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/752-103-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/936-31-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/936-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/936-20-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/936-134-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1128-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1128-333-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1128-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1128-123-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1128-129-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1760-329-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1760-85-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1760-84-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1760-91-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1772-82-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1772-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1772-69-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1772-70-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1772-80-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2828-144-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2828-135-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2828-137-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2828-336-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3364-170-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3364-266-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3364-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3364-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3388-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3388-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3388-351-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3388-117-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3388-111-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3388-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-348-0x000001D95F560000-0x000001D95F690000-memory.dmp

Download

memory/4252-265-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4252-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4252-46-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4252-47-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4252-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4652-331-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4652-107-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4880-0-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4880-66-0x0000000140000000-0x00000001407B5000-memory.dmp

Download

memory/4880-63-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4880-8-0x0000000140000000-0x00000001407B5000-memory.dmp

Download

memory/4880-6-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5532-157-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5532-162-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5532-155-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5532-149-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5532-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download