75675c9cc1fa732836bfc46a938fe47f35977ebbc6a14e56f2301a8d8abee8f7

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample260731-pc3ryaab87
SHA256 75675c9cc1fa732836bfc46a938fe47f35977ebbc6a14e56f2301a8d8abee8f7
MD5 2f6a5d34a3225f7b29c162fbcd8136d7
SHA1 05e28f53b99e7a8bb4f1c02a9a16ed66b23f37d9
SHA512 403a6d7831f5760622f108d4ff8819663988e549a77f45be5feb5b7d7850c17b532937a38e18541f03974c53655b4ae17108de81a29a6d37d5b7d62d813213f1
SSDEEP 12288:h3FJbk5jJ3mnHdSwM+kvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:BuiNM+iDhr1VibHHufeZ1H6IFrXQ
TLSH
T1D375F102B26C3CECE467C23585759591AF31FC751750A64E53B17B262E33293BE2AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1616	elevation_service.exe
5624	elevation_service.exe
2636	maintenanceservice.exe
2164	OSE.EXE
4060	PerceptionSimulationService.exe
3212	perfhost.exe
6140	ReFsDedupSvc.exe
5396	SensorDataService.exe
4400	ssh-agent.exe
4600	AgentService.exe
3172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec06d1a223e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049844ce0e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e2ddedde520dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca9e64e1e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9f400dee520dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000550abe1de620dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1012	2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4600	AgentService.exe
Token: SeBackupPrivilege	6140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6140	ReFsDedupSvc.exe
Token: 33	3172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3172	SearchIndexer.exe
Token: SeDebugPrivilege	1616	elevation_service.exe
Token: SeDebugPrivilege	5624	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4284	3172	SearchIndexer.exe	100
PID 3172 wrote to memory of 3336	3172	SearchIndexer.exe	101
PID 3172 wrote to memory of 4804	3172	SearchIndexer.exe	102
PID 3172 wrote to memory of 2100	3172	SearchIndexer.exe	103
PID 3172 wrote to memory of 1896	3172	SearchIndexer.exe	105
PID 3172 wrote to memory of 5088	3172	SearchIndexer.exe	106
PID 3172 wrote to memory of 5076	3172	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2f6a5d34a3225f7b29c162fbcd8136d7_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2164

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4060

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3212

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5396

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2d5bf4071bd21aa1ebadfeb54bce10a88d75b29ba1d7e9da25ffb492b44f4d0a
MD5 a647ff6989eb4d7699803edf8cfc8192
SHA1 7ee3a9f4b504bd4fc6ebf7145a5343b9deca32ee
SHA512 ada9e3ce0db7e07fe4c708c98f94f88fed47983f268f0f84b72638eef623cb89d515f06f5e31319d0bc3132dc798879af1b3a4cd19522e6a38182297a5ecdd2f
SSDEEP 49152:ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnl3Vibn7ZB98:C3q60jBWVibn7P9
TLSH
T123D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 63bbd5c5a907657adb063b8145415305acfbc5eb48db32686dbce11b5bfb4208
MD5 55f56b40c98438c7a8b705e31b45f652
SHA1 92faf2529aadf7f88fb6911320d00b3d7dd03cc0
SHA512 91e56d6dd344b334b1f82990b63a3263a21cb8f8148c316a6da5848d05fa0bcd89241dcc186d6b53251b462f968b4e5ecbd2f4d894d76543f7b5efd749cd915a
SSDEEP 12288:w1XLsswWkxy2lRq2czA2vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:mXYfDtczAkDhr1VibHHufeZ1H6IFrXQ
TLSH
T1EA85012877E408F9EC67827DC9A1C501EA73B8954750E7CB03A49A651F333D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 08ecd3b8fc8399c9ff0c3950db3e5cd0a40882f7a7545583f9c531b8fd61459a
MD5 6ea29092a2321aa72100ce8fbf0cf6e1
SHA1 cc55d5773a4cdf3e28ea2ce09b30e68b5b66f34c
SHA512 35de887d7390288db1b0abb8b3f1b43fd251aec23ae81bb43836b7ba4a74efdb960b76f04205bfad5b08d7e92f8a2109780e03d4dbb931ac18ed05b8516cac98
SSDEEP 24576:V0Le5ji0hmxqrMtDhr1VibHHufeZ1H6IFrXQ:VPji0AcW3Vibn7ZB98
TLSH
T12295AE15F6748375D073C0B9C5D2A68AED7230865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e5cf88bd17a7793ea7c2b62639c5ae06502a51e4b14e82ed0036649e33760b76
MD5 816b585a21bebc17aa27e9d2179b325e
SHA1 e04bf6ab9c4cee7c90bc5168aa443a5de4818113
SHA512 9ef5ce6affcf8af2d8e80c3bf6cbb2d596b2a7f8c7d3dafab29ef7050420c2134673de71301fb46bca40e7dc1283f10a20996869922ee2347aeaaea1166d31d5
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWr6q8wyuDDhr1VibHHufeZ1H6IFrXQ:i/ezSC6vUzPviHjyC3Vibn7ZB98
TLSH
T132755C15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5716a42aa3706d35e0c3971923d7426d52418baca494f3598760e3b299b59512
MD5 ed9b75c5555f7b77cd54fa4ba02a9efe
SHA1 cd2eb4fba42bad4037a69f6e6a449a029776f62a
SHA512 81be9692c1eb112e5d3e6a73cf34dba9662001255eaa8864ce115d63fe0c7e2c3dcf72a857dd7e1a9f0c93b63864b56b85d25ba2c30f6a8f388cfb97481c24b3
SSDEEP 24576:LVbqPb88hv/l+bIDhr1VibHHufeZ1H6IFrXQ:LVO88hXl+c3Vibn7ZB98
TLSH
T1B6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 416cf50afb83023f559ccb158041cb9d8e8f135099ac2b15843d4127fbeb4f77
MD5 e01406d3edfd316aa0fd08f0fdfc3609
SHA1 d0f2c44b42c4cd0a8d299acfad57972897ce59bb
SHA512 dd287bdd691769cc9b36537b1a369b5649f702e8e305547e1d7898a805bd14ea644ae917f56182b52993c2667dd8b66f5f8fca74c7f3d0797a9ac76bd4a66db9
SSDEEP 12288:PMDvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:PMxDhr1VibHHufeZ1H6IFrXQ
TLSH
T1DE652318BB68B0D5FDD30B71B3ECEB40FD67FDD8480A1686C325BA9020352E8D6152A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d7665f0e05b9fa4282c8d61c6829cc04383e1ae963c9176e9aca12f4c74f3499
MD5 fd575bce8cd39b79b8027522d6ecaaa7
SHA1 4b176238bb166bee2957546d806e17b0d723fc52
SHA512 73a694b6d5e255fdd2e24b553d87df7dcc9fc133cee662ee262917897273b937a8358aabf62d24ea9efc5e9ff28984c6be3c1371feb1750efbe46e951223a5d9
SSDEEP 12288:9eBNUbTVO86USvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:9JIUQDhr1VibHHufeZ1H6IFrXQ
TLSH
T16D85CF3BEE28FCE2C67A4DB95791C600E77278704F12A3CBD165820E9E235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d42fe7da390c2a2aad63981524fa2cd76a7edfc6a598b4468d1a78a0355c9273
MD5 202bdca82b40473f947f53cdef21fc8b
SHA1 f875656388516a4b1d7510bdcbdbc8415e1171dc
SHA512 9ba7040ecd06d4b8ccb85c94da4ea60bee80158033a24f8db6f957ff63c4e75c8404d5d2c152bc66e9995857836b3696bce901e1db0e343225f3ac6ee183f659
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THE:UQvGAdlCEL8c/RRNw5CbVibn7P9
TLSH
T153267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 03031bd1c8eaf9fda43d4295fa3eb44c4a4d8fc106354ef7bb4230521435fe57
MD5 fc4f0c3415891ee9c662a925bd062d9b
SHA1 7dc6f57209c7171cf0a2569c656bfba12e9798c3
SHA512 4e741ef93c2cc5e6cd68858bd4677fe2a7d1297b27107e4fe6bcb6625544211c7f98df01c1c11fd13367fe3c21a11b857d0bd1e8fe44359b8fae330cf43e3544
SSDEEP 12288:ZAwSfxL/2Dc3+DLLmt0LDQewsAjYvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGv:KrewsAjmDhr1VibHHufeZ1H6IFrXQ
TLSH
T14185E031FE74E036C6BB0DB21B35D706687DB9604F521AC3E3A88E9D59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 519ec94441cf07678837f4e5707ab2748a5a6b4f11a354c2bb7844bed9f86fa2
MD5 f8f36e74276b8c6f64bf80dcc4e4487a
SHA1 f1e71965ba4328d97589e88b399e1b6339fd3520
SHA512 84ee36aa5b78d2e3c6919aed5318c63947c316fb2c89253347b732ae4777f8e2a861785a4c45acbe66fb390fa4a19b96279d2b1e4f53a950a5acb9ca5425fafc
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHYif:kUEtQevvqc2W1cpV2RI32Yif
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b3355d4ad376cb4cc2f713ad07f3c964604ad7bcedb68a47793d2808aa5f0f8b
MD5 d952d2a260083539b2253305e5135481
SHA1 e6fa2e22928ba59450f60abc36c0baf4127e436f
SHA512 ae9d339a6424956d761d2d9fd943a956b57e13f8af9866e3da97eacd99cdf1d44c14cb5d780c120ea4af37670e3ed19c1ca8c53ba88ff1a2643328867f319dcc
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zG3Vibn7ZB98:LoqtVjnmfVibn7P9
TLSH
T13ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bc6536d4be1f52e93cad9b65bb099d9b842ed21fbdda23033ee0fd49a38020ca
MD5 dc55b4d9c327ca2bc43ce28f762cd1c3
SHA1 3ca6e630e99562486fcd4cbbb38cfc4e84c36c47
SHA512 6864b297c682f786e3356fb6b1870eb446cb7f23d330fdb0c50b920da211d1ab95b95f1907cbd215e0e3d67257546f4a9c5037887e988fe2df6c4c182d6508db
SSDEEP 24576:GAhGL2IFoiwtA5l7S53fDhr1VibHHufeZ1H6IFrXQ:GAM1Foiq5P3Vibn7ZB98
TLSH
T163359D80E7F955D4F5F3AA7899B69170EA76BCA95E31C20F2160C11F1E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 394a6c3fa6cf1a2b492e54845b5c10d7c2c543e8a38ec4beac5577cee4d3daac
MD5 434c44be751628a06c72db2b60b32260
SHA1 07c04360506ff66d63f48d2c4537e06fa462f8a5
SHA512 010b36ab8b2c3e44e3e5b36749e714014b86d798a85fc91b5f42ef2b95f86e25740b99bfe0d082a89a582de9bed2a54b3a5530ab34aefce0dcc01f3385168184
SSDEEP 12288:zmw5HEjsChNDBFgl0WDm+CNvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:Swu2OWiDhr1VibHHufeZ1H6IFrXQ
TLSH
T19B75F14976A41CF9E9A782398697C531FBB3BC412A25D71F0360C65B6F37360AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5ceeb1448dd2bebfee497f5a62816b1fb85d2f21757507377f9c1210a3d1804d
MD5 4412dea2c0b0e778d550c4995594f05f
SHA1 d3b8d559f56bce17c392b6309a2d02693207d1f9
SHA512 c1f2c67411826c956631370a9ace9c7a313a4daf7c68799f6cc1bd2bf281aeb61eecae0256d4c88193b1d354adef29de26bdc0bb00e26fd27ba291787555e08c
SSDEEP 12288:AMZ1IyIvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:nZu1Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1FA65125933A870F9E5A34378D6E49A40EB73B8E5172603CF432586A52E33BD55E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fc56a8b20a0d4f1f629e9228478802c20df0062f51441fb20f7b4fdc6bac3dbd
MD5 afa0eed33b5963332712ad1d52074986
SHA1 fb080ca204445c7b4faab88fd256fdd4714c5a6a
SHA512 53a55ad210853ed62c5896def4f83b997075fa529464e914b17965a906ffd0a700b6d119d414a12e6a7fd48bc86e36762efbb777b53cc9b8d0516b68fd121320
SSDEEP 98304:fQRQyi36YOcPhLvw2gAf+PN3iVibn7P9:uQyiKahX+PN2if
TLSH
T1E8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d2b98e3a25d7eb79b59186decb8fd176b923185084ebc85f68678942f7e84a1c
MD5 cbafe664fb59d4e9755b6532f341875d
SHA1 a1a671d9a2e09adf7f9aa61cc6a30792ab1cfe25
SHA512 4e6b5bbec0ab4a77869a5f6e237ed204810c6eb2c3c426c9edb39267b5e15598f5b39f2a2594ebc0866022c6380510df37247ea42847661671c2ae47db935679
SSDEEP 98304:DQRQyi36YOcPhLvw2gAf+PN3iVibn7P9:SQyiKahX+PN2if
TLSH
T1F5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 23391a3e1b701c9d7c88eea3f87fdc01b914f358d59656057733b3dddd77c603
MD5 91bbb21496969fc14f2803d97cd8a0d7
SHA1 39eb7c8f573cd1b0eea867e9b69da89b4be18aa0
SHA512 4cac1cde50abf3d4d6ff2d7ba7f8e18f4291def396daca33ebcf85e3916c0727c70f8dbf3d6d707b310c99dd8f0ecd15c10d05c7067ac67d1d3a81a12629725a
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0lDhr1VibHHufeZE:j68Qg55nhceWu7PNU3/W3Vibn7ZB98
TLSH
T132B55A33B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d7e35f8f215993785775cea89715d5c0ef7606c956e33937cc59db9130962594
MD5 1bfa00833fe6589929b8a2bb029160f5
SHA1 f6f879fc8c792a4c50300d66afa1e1bd38ab0a15
SHA512 80af0a4775dba6a1dd67fc4d57024c4fb5d549c86b73646daba1f68f3d4015e0076ae2a930bd5271297e462bb6b96bc194346147c329bbee5ea55e8f882877f3
SSDEEP 98304:Ry5112gYy5azzVva69nLKnhZxVibn7P9:sLIHjWh1if
TLSH
T120167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 98eee498c9fdcb2d61f09e4340affada3391f7746e67f95735d2e1cc553d4845
MD5 90e82b21f30288f967e7fa95285d197e
SHA1 ea035051df189b3c902fda5493f64ca9355ba1d7
SHA512 9f72e697b28877acbf50712a3e27903e165aa530fd842029181db6e2c717f384bc994f18d1ca3053a43867507916ddb503a1bbed0b3741dad54da9c320d2350e
SSDEEP 49152:aB+taZ3usBWOBr4tEG20bqx0z+n217aau1glU3Vibn7ZB98:Iu6JmUxd2d6Vibn7P9
TLSH
T1C3D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7900724013f478234fb933aa27568392f3e4449c7d5abe4b0790bea38ecddc7e
MD5 f066abaf5b2a5ea95097c28f26aaa200
SHA1 cdc41f20af131ac0fcb2428b3e1a4cb55df91899
SHA512 eea67b72486c85b42b590b1744c4e5d3e829d257412957aa68b0c779f93a8111b8fb2a0768f1c609ee2f14d7e206d0ed3ba1155ed4e32764b52538440459bac9
SSDEEP 49152:m1hpsNoJpF1A6BU44CwH7R4xw3Vibn7ZB98:mmifPkRfVibn7P9
TLSH
T19CB5BE13F2D900E8D05ED178875A9232EA62BC450B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e0df0ea093c5af73af6c428303a1bae072abd0e4633ffc0b612cf9eba33e955
MD5 c81cf9c78545f9cc4d68d5fbeced5831
SHA1 4bc31e092806dabc5858212d8b7a2835b9166027
SHA512 98819273e9f13232810dda17c628c924ef7350fa6a63fd9ee89c137887599538f3901c2aa428d6f08dfc5c150b4cd8e81c742469b6cc173296152f2665df46a2
SSDEEP 49152:bSuZQIY0Be2KNRVtOnks6NMHq13Vibn7ZB98:J5dKvi61NVibn7P9
TLSH
T1D1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ad16e8449def3656812333fcc22f4b9e20e905009603bcea5d70009b4138b91f
MD5 4aaec34c9b2ef2f2106917fd367f2a60
SHA1 70db8d4338273dcb67f328b468eda8bcc2f3b799
SHA512 4a4e9b7353807441d5d80cd8f1377a23a03bd880beff72db0f8c1fc862aaf30675ffe1aac041e13eb02c4995b83073e1aeb399546735057ac1e2e285d55e8a21
SSDEEP 49152:XhtSn8EApI0figXgiDn0AP5wk3Vibn7ZB98:GX2iyphDVibn7P9
TLSH
T14795BE13F2D900E8D05ED178C7568632EA62BC150B39B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c9a41b895847539b2b16a5f2aa6ffd539251e8e34446fee7ee1717ea88803cbf
MD5 b590f2cf9950dacb2a98f08bf083959a
SHA1 ae81cf06b9c98ae76c042022cc717cdfdf812fe4
SHA512 5caade2063311d2be01007d945760e0e296a1ae028f2dcb2ddbd69f47c444e1611b23ecbcceb754574b76aba2ffdb2d9ff1696bdfc492059b9a688ff52be8e05
SSDEEP 12288:Mbvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:M5Dhr1VibHHufeZ1H6IFrXQ
TLSH
T12C652318BA79B1D5F8C34BB1E3ECEB80FD57BDDC580B128AD316955030353E866192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 932962179ba9725d3ae66cd9544353a8caffa3b979125d6a57186fd9a5869e7e
MD5 49c3c279dca8d0797a3c37256a6999e3
SHA1 b6cf5eea7795aa4dae005dd6eeb154c2ac1445c8
SHA512 3afcf79c8439e52fc610e271fa27478b8477109b0e412a79fd019105fc826fe6ff35cd498ef22c7c16476226895ec4cb640f92dedf4397dfa62249f7f0fd90b6
SSDEEP 12288:fMvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:f6Dhr1VibHHufeZ1H6IFrXQ
TLSH
T134652318BA7970D5F8834B71E3ECEB80FD57FDDC680B128AD31A955030353E856196EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 015866251f0a6ec3864b8ecbae01f3b26c53e681690ef96603ea012fe58c129b
MD5 8768080c746293389e08edd649fb070f
SHA1 2edf72ca3afba874068290fb7bcad806599119cf
SHA512 1c6fea3d6281f25bc32d810480c09227df82d63b970bdbe1250ba1ae2bbf26db0403bd5f74bb80fb49458bac48089eff5450c15ccbcc20fc0c328eaba3a911a2
SSDEEP 12288:1Kvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:14Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1A5652318BA79B0D5E8C34BB1E3ECEB80FD67FDDC580B128AD316955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 0fbdcc5801029b2b1193d58e06f8a320b1982904a1632ad0992f2eaede331f52
MD5 d560cda4fe9ab51f9cb4c948a6ac52b5
SHA1 dec22c61c43a156b6b84d46509053f5fa774d097
SHA512 f4ab39c8aa29db4b723f63c0b3741516fdc16fca6610cf9d165f87e52972619a0a39964e388649c75fc783ee65d1feec5e91c21cd05ded241d0019a1dd804230
SSDEEP 12288:zVJvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:9Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1946523187B7960D5EC938775D3E9E640FEB7FCD8980613CF87114A5128313E86A38BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 3a842e7258510c3eff584437f6effc64727211bd159647e3dd9dd4c5ecbef933
MD5 86ab9abebccb6b4502dfcd8759354e76
SHA1 58059ff23eb421bde99f298df889bf6c8518b58b
SHA512 a3d876e0aea52ef5225c5ec33e3dd7ec0431487d052b84fce28095602052b55ca0b68463d3c569dcaefa4176b99a73a13ce9d5a53b25f92a4dea3053730dc3f0
SSDEEP 12288:eRvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:e3Dhr1VibHHufeZ1H6IFrXQ
TLSH
T142652318BA79B0D5E8C34BB1E3ECE780FD57BDDC680B12CAD31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 6bb9e7611b212333bc2117ab9b0cbe08a49ab261f146a90a318305c9e02ca0fd
MD5 786aa34a0d2619ba5e671dc06ca8a639
SHA1 07c6945b877762038708b6758a5ac3badf26b5f8
SHA512 9d7e96be0107fec3421691de359ce50d546b703adccd8113c6adaea0663eb0d803bfe72d884791c16b916df96b71e967bfb14e623c6fbedc7735b1436cfdd3e0
SSDEEP 12288:Ewvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:EuDhr1VibHHufeZ1H6IFrXQ
TLSH
T135652318BA79B1D5E8834B71E3ECEB80FD57BDDC680B128A931A955030353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 162fc9065ec052eeeb7ee4f4c6d8b8bec2d720ffeaf86b230e50ae7472f7086b
MD5 94fef0eefd3c027f0f57756d9c8ec783
SHA1 57574a6483345a89b5f21b094d8fbf84a1d3b24a
SHA512 4fb756e22899a8522900b4afeb5811d0df5ca0ac5787e6ddbeb60af5e7b838b7cac807f95b49d13776834a2eafccd9a12fc31af2b4047daef09e830f313820ab
SSDEEP 12288:K0vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:KSDhr1VibHHufeZ1H6IFrXQ
TLSH
T11A652318BA79B0D5E8834BB1E3DCEB80FD57BDDC580B128AD31A955030353F866192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 1b191cb2a7e8292eab5927b7d94364eb6f384f967b882a511bd5ec312af8b761
MD5 9894d33d8ed747c42ae370f2e1ad1abd
SHA1 8ccd3a05261dac7870c85aaef93f1753f9372dcd
SHA512 112898d3913e2dad7c1b7fc98ba7491218a5557599afa92f80bec810b1c11083999d139c0d50248bf18e9c78ed43fdfa0392f709c69c0df35e15c3ebcee9fadc
SSDEEP 12288:3iZwbrzzFEoS2cPvysvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:yZM/zFVSOaDhr1VibHHufeZ1H6IFrXQ
TLSH
T1BA850295B36018F4ECA7823EC9559905E6B3BC990A60C65F03B436671F333E11D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8e17e5a2037ce6fbc419db6be6a846a30f501f2992092f8b0f83caf8b66662fc
MD5 9a19ad517e4836dbd0669272167322ff
SHA1 14b46eab6b12c4161bad48f714362fd7c4c22210
SHA512 e80aa03711b94c275688e19962cf01cad97816029e1cfc83939386e6de2f9bb63ef7a52c5d0459eba11af07c07afdfbd247010c05a248b6f72ea632fea8a8145
SSDEEP 12288:F3vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:FFDhr1VibHHufeZ1H6IFrXQ
TLSH
T17D652318BA79B0D5E8830B71E3DCEB80FD57FDDC680B12CAD31A955034357E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ea94c64a5461fb8406941e6540a96f9c0152a45837ac53c3f8a7debb8da0f44f
MD5 4c67992dd18bd815994b4e125c914b53
SHA1 ad0c45361a22b7b5d3ccc015dc406920778deade
SHA512 6b67ddad6117faaddadf37023a5c00aa2080f2233d948ee5fce4a19393264533dfe0b3883b479e7753b1480f879bedc89945d4737613fd5826a7f2aaec16bcad
SSDEEP 12288:Ezvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:EBDhr1VibHHufeZ1H6IFrXQ
TLSH
T1BA652318BA79B1D5E8834B71E3DCEB80FD67FDDC680B128AD31A955030353E856192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 e761a7c6a49b169efd77211bfb661020deb52beaf89e6d32274ec2bb6b4b0550
MD5 90fb3d67c6ed7f7d0d41b9aba693dd6e
SHA1 2264eeeda359c930d2a0ccae70223a27edd59d73
SHA512 8e98ed71d31046c2d4b21ae1a54ad5ff7ddaca097e098bea87a5c05131bbfb7c2223a238007582c8b6724c16b38f00ef73f23831ca21b0101de29b5dea415f14
SSDEEP 12288:myPz5L8Ivt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:bzy2Dhr1VibHHufeZ1H6IFrXQ
TLSH
T13775120B77A530F8E4678238C5A55A01FB72B8B50B158A9F536447762E333E09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 8d44c8e8376165f89e63804b67d41d23ea970b1b33025843fbf691f6e959a692
MD5 6f29b5929328f5a004524d42e2cacd82
SHA1 5e5824311451be8789a98587749fe10c6ceec444
SHA512 d693ff1397a8f23a7a2cbdf01fd2c860a8bcb00f833e4a080a6897503aae62c050f162bef9087b092176c1eaca5591b1927de3ba26b3859b674ee29f0d081131
SSDEEP 12288:B3vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:BFDhr1VibHHufeZ1H6IFrXQ
TLSH
T130652318BA79B0D5E8830B71E3DCEB80FD67FDDC680B12CAD31A955034357E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 080e1294c872a7247308806b0ca24ab2d01fdcb582c3eae2a8bc56fe4048131f
MD5 e845555191242f282109c71c1a071fb2
SHA1 d73eabbe6a809eb7a6923c176b1c311498e74107
SHA512 4a9f0e87bf4baa857ae04875f751804eadcf8a6b37442470be0bbd36c73ae29401f775ad91b1f481e0223f5a349f2ae5497a4eb39c1a63b147db19e5205475d0
SSDEEP 12288:N3vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:NFDhr1VibHHufeZ1H6IFrXQ
TLSH
T1B2652318BA79B0D5E8830B71E3DCEB80FD67FDDC680B12CAD31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 d0cd4b5f00a74c7a0554b5207c1c80d83bbf10394d7d1e595902c2c7a76264a6
MD5 2cf0bea7a269e3181d042d7bd8aa4a38
SHA1 efe9b98f1cde74cd6d3cea44e0627966dc706ef9
SHA512 c3528b704c0e1f1e07e260a36232422b404b6da4da9e9b91301afe3cabb8a84064caa50152dac2202aa7e1be420cea62a304347660ebe34bf639d8a217d227ae
SSDEEP 12288:yyPz5L8Ivt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:vzy2Dhr1VibHHufeZ1H6IFrXQ
TLSH
T11975120B77A530F8E4678238C9A55A01FB72B8B50B154A9F536447762E333E09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 3a6af5d8aea1220a60da8e18f3b31c898160ccc12065c1a88190474a5621debd
MD5 c569725bc45be9894f46792c6d86d3e5
SHA1 17cc0f24dd7b71546fe23ffdc4996b42a7dec95d
SHA512 584fc3f64ffa7971993d19227879c6fea17401a038b72df361a825c6bc54b8d9aaa670b664f01d5b658dd24b952c39c50c4a7a4b4151b0ab0c359d9d09a346f3
SSDEEP 24576:/T0aLl3z0zDoDhr1VibHHufeZ1H6IFrXQ:/TDLljD3Vibn7ZB98
TLSH
T13A850294B36058F8EC67823EC9659905D6B3BC990B60C65F03B436675F333A01D3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 decab8c0c1557f60921f76ffd2ebb8d83d084d56c501c846fcb27fdda29b9b1c
MD5 58ee0f64e2d20fc8b417398083937d77
SHA1 85fb656852e2ea8e6fd809b8925bb0322573d232
SHA512 fd759af9199d7511f41995b1a4f16db8e02bef1fa14f308996473be05c56082ecfe8c2495c3428d15a8b7ccfa314262e2a3b0393764a9cdaae1a352887f1aedd
SSDEEP 24576:r3Id9CHKy7GZMDhr1VibHHufeZ1H6IFrXQ:LId9CHKya+3Vibn7ZB98
TLSH
T1DF95CF90F3E410E8F0B79A35C9769501DAB67C991B21DA8F03A4665A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 66d6b65021a8e4d814eb7276adc0d6306b43d281e1c5a8200aa4fd938bf4c571
MD5 67c640c433dd54d38657b96086049504
SHA1 ba35fd934b32cdebdc01c0d7f45703f9829bde00
SHA512 62928074d7c83df347c98e0cb721b49d4a3cf655d450d9de2d8c44109b6069a024f184b1dab1b3420362326c9f5685162556ad2af31f599a4efeef8affacdefe
SSDEEP 12288:+qvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:+YDhr1VibHHufeZ1H6IFrXQ
TLSH
T189652318BA79B0D5E8C34B71E3ECE780FD67BDDC680B12CAD31A955030357E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 bf1694091f8ddc666f2757a2932f26f72adde0afa0fe614563c53ee63b54bff9
MD5 405e6f850f0d82685a53b89759c9519a
SHA1 edcf9057fba54cef08f59dda9c4e9c652e0bc99f
SHA512 14bc645d93fd3c046c3a76496a1e967fc55bcf400eef6389a99ec191142d23e46ec8db9a1c8629bfa0345d6c936e4051a9e08c645db2ee898b1ff3ff162153ba
SSDEEP 12288:Yovt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:YWDhr1VibHHufeZ1H6IFrXQ
TLSH
T1E2652318BA79B0E5F8834BB1A3ECEB80FD57BDDC580B128AD316955030357E856192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 14e1f02b5a746f54c260d36d27eab39808bc809fad851b71b5fb5c9d4dd79589
MD5 c83d41b87af9485e33f7c1573ed260b2
SHA1 73e017c25ade7774108062efedaf0956d35e6a4a
SHA512 d1a1e4df9ad78b3d246f159a72efbdad2f7f1da01fde71edd61f982425399ac8c7d134495c6b27385e6908580d7097baaa1ef85b7d5304b6852208e76edd2d4e
SSDEEP 12288:oVvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:o7Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1F0652318BA79B0D5E8C30B71E3DCEB80FD67FDDC680B128AD31A955034357E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c572415681b902f33d529fda1614c6c0ccb04a6ca777770bb9d827cb1e00ae04
MD5 c9aa0101da63234a9b1b86d74ecd882b
SHA1 5972b1ca4b4d80e345b079b01cafaa0e18e38eea
SHA512 1654be1809f9fba784ec6ff62b52e7d0b8c2f449c7ff4824fabde8538c1c17b33c17d329512a5874d4aaeec6ee544066977d4cfbca8e1e56f643f0d4cfc9ccbb
SSDEEP 12288:a3vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:aFDhr1VibHHufeZ1H6IFrXQ
TLSH
T168652318BA79B0D5E8C30B71E3DCEB80FD57FDDD680B128AD31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 5954d2d3e03f55785a39d44039de1910d0caa19b045ea533017a77a88d6b9d65
MD5 07a9585f42950358e4d6dba53daf4f03
SHA1 922f88ac1b627f2ae416fe16dbc52a5e99385ef4
SHA512 b5392bed002e46fe02e816ee86d8d6e1e29364c9ae17478d176831d1b1990f8d47815a5129a4ca88a8bb3c3bb969d636ad8007ac9a1c379c27f2eebc6696811d
SSDEEP 12288:1qvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:1YDhr1VibHHufeZ1H6IFrXQ
TLSH
T11B652318BA79B0D5E8C30B71E3ECEB80FD57BDDD680B128AD31A955034353F856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 cd13dc661ef63c6dae8aeed6a688c16e9beabf319d240c5fe95962aaf9a86553
MD5 1c74da21aa589e36a9ba44b800464c59
SHA1 f17a76c840ceafb61c77e1310cc1a6e7f4bc934f
SHA512 d716559934954e15e44fee3671a80f471ef4fc15dd9fca6e382f3a756464430cbdd5df9443264b6e911bb928c3f77acf7c629982ab759f9326071b5f417b7894
SSDEEP 12288:q/vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:qdDhr1VibHHufeZ1H6IFrXQ
TLSH
T145652318BA7970D5E8834BB1E3DCEB80FD57FDDC680B128AD316965034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 25ef07225ef13ba24b84c693ac7f9ead4a3ee7c786ff5817e03f5c2f8907e937
MD5 bafe84a10538007de0c32b5d126030e1
SHA1 0a4ad3424317f524e560c89ae5b8d00bb09641d9
SHA512 c76bdbb8e3cb2e8b508b54dbf0124ac2da128dee9f2a5350f52ca4fe2a2e30a3731a7fc40db8af3cd4ef2d7927f0b107985b2776d4e3652236e8cb265fc79db3
SSDEEP 12288:PRvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:P3Dhr1VibHHufeZ1H6IFrXQ
TLSH
T109652318BA79B0D5E8C34B71E3ECAB80FD67BDDC680B128AD316955030353F856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 65b97e40ec9b7fef4d5a76af466825ccb05f3304de4e2d280e924792e50a57b2
MD5 9a6b6ca29ae8268e6541e5d847e978cf
SHA1 7d7744e42f0890f9c8d44795c53e96a8c4df2b41
SHA512 1a776eba06c9a351fa59f5299c69dd7ab20b9e8fbfa9ac69a9b7256295e9307072d0ba190f05efbe8d0514ae5640a6a53529cb60e9eb010870644a73e6b3c206
SSDEEP 12288:gCvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:ggDhr1VibHHufeZ1H6IFrXQ
TLSH
T18765231CBA7971D5E8834BB1E3DCEB80FD67FDDC680B128AD316965030353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 969481a3c0bdb6ba0072e8d6f06c6abbcb2d42c94e6b1b4e7cc4e14bfb4ea973
MD5 3259a831e8ff19658dc9cb1e9aed13bd
SHA1 b273cc828a1796fd4a53312c5bfb29cb748c8832
SHA512 3979d957fa7d91fa04ec1934322b0743ebcd386485de74deb51e1f14acfcd27c27fb84fca94e5dfc5b4a609286867bd234ad7d236c53397f091e7110ebe12554
SSDEEP 12288:YRvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:Y3Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1D7652318BA79B0D5E8834BB1E3ECEB80FD57BDDC580B128AD31A955034353F856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c578329de2fb5a89517ed3674ffe07a4f14fdb45d772a9f87ae971b021f0ca59
MD5 1799d154377ce36128c34a96b5bab05f
SHA1 4f372704d4953bb4f75035829c693bb1b155ae7c
SHA512 00e6e773516a1d123f78f6dba0aa37cd694f5ab9e77c9e67e86174f1e1c97880ede0ee4d37c13f4dec90c065dfc2ad33321030420285904aabb5bcc163665abb
SSDEEP 24576:Tfwvik9RX6wkyAIRDhr1VibHHufeZ1H6IFrXQ:XMnYIR3Vibn7ZB98
TLSH
T18295D029EBDC44E5E1B7923C99B7460AF6B178681B31C2CF025A53AD0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 06e632295999183931ce166d77acd6fe6148130d2638dc32d43f8cb142d03b12
MD5 40ffb0b575d88358d509979923d12e5d
SHA1 e1f4cfe51aa0c1169557a96e8e998a475d311f04
SHA512 2bfd70b91f13d68f20288c301675475e9b78f2f72e729a9de666ce56f3904515d7c99a52af1daf4bf7cd28da8d6b1950a0c5195cb2433683d84f0efe493383d5
SSDEEP 49152:fYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0E3Vibn7ZB98:ZySzPCVibn7P9
TLSH
T181067C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 56852f4c2b926626000a772237ea56e3c3f0f6cdf4776fb7fd7a317091a8cac7
MD5 09850dd73e70a8969b75fe9a619ec588
SHA1 23f5955028a87e124fc6b2566eae4dc0acf69ca7
SHA512 d0dbf2d7db37e0b2e3d871405c17d9fa594e941a6eb932e132eef50ac7411a63e638d44a58bf8b46923fb049b0f5e50488d42adee3c39310b2665d54246259bd
SSDEEP 24576:t47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYqDhr1VibHHufeZ1H6IFrXQ:t47JUQj4irIhCnDHUPfF/U3Vibn7ZB98
TLSH
T1EF65AE1DA3EC01E5E1BA927885158A5AEA71782D1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0b81fe61d036106dc2accc23fc71f7d523ac4d43087a7ca41762790acbc73b2d
MD5 b72a9d4e24e89c60cf3e66bd7b48841c
SHA1 f11a4ea5c8de4cc9e0fef8f43c560a1d23fd1811
SHA512 636ab687bf233617cb99e994d03d6cfc8ac1eae4e8a3d14ce58436e0236d47fc500438892bbcb5d68798f51c47f99d0dfc56ca73aa4d740b7dbadbcd6e407430
SSDEEP 12288:H1sfHvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:81Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1C575F009E2A812E8D0AF5275C3959A40F7237CA886E293CB53D0F53E1F362D45EE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 960KB
SHA256 29c88ef0aeebb4119604e45c828ddbe66539c4909570f000ab3fc63b7a604c55
MD5 005f37f2bcf53185e5dd2ab249e1e3e9
SHA1 573ce971d5c186ac3659b7bad861d1a068c54fbf
SHA512 a6d1474ef7958e4b3e39db5578df2d7170356ef909b822fd7025331e14e158c0f68f7bb4c73b916219bc07ff0fb2455ffcc83b4877d1fb8c9deaa8fda0ae6014
SSDEEP 12288:USkYU3f8qMNg4hRnF6Jh0pMARMmOmmauu:USBUPd0RF8CpMARMmnhuu
TLSH
T10E2528117666D74FC6AD40321E37C1CCAB707D01EE45AB0372C99B2FC5B6658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 83199b722b6419e00d74f4e6f966006b762473867240912c53010e3a065907f9
MD5 16e9ba57aaa5df1cf8a691685f640356
SHA1 1c6ef47041572bf9b519f52a61bbcb66b804fb31
SHA512 88256e76785fe2e8ac1697fd16824ab565fc8ca76c15d926d1d6f3b2741cf7d834c4da9efcd93cb8d4fce50f2d9f52cc3d95ff44a8facfd918e01504b5cc38fa
SSDEEP 6144:fOxUBDg4go4xk1A5I1bi44QKFPM9CaCNPC6C4CYS5pI2PLD9tMxfD9tMxTzPFK83:Pm4X46ri4CFPM9CaCNPC6C4CYItHyY
TLSH
T1A555B741A137A38FD1BB6032072A5F4CABA4EC07B7495F2673C8453ED86A715A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 24f11784fb5703e2a3eb17b57ad86f752614b80cd6e1f092b537c45df9b26385
MD5 414a802120680eccfdee0ddcfa5b4474
SHA1 b06d174a9e596c53c5d9608dd6b56e0da32c0363
SHA512 d0545240978776c64978a63993df9e81d4058569affb0a302d75cd439e26b1a4b495a592dd47321fd2668af163578f427e6cfbee5c15baeae634cc365db15fb7
SSDEEP 12288:av7Pvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:YNDhr1VibHHufeZ1H6IFrXQ
TLSH
T1A3652318BB68B4D5F8A70B70A2ADE600BD1BFDE84F0511C7D315969034357E89E387AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 762e0ceeeb6ada7c5da16ec083644dae89bc61e5a97d27e0d2439e9ab5f4ff2b
MD5 a1ee9a589df30c2eff9eedbf1e24f3cb
SHA1 8158f51d31777635fb874d834a63a72ab7362d65
SHA512 953c1196abc2c7a63f661609fc408a54f49ef3b0ec570c2f6b9c9e58419022d664602f142fdabffe9e66dc59cf6d8260ea7317bdeb1c4d5ea25ba193e1672693
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYDDhr1VibHHufeZ1H6IFrXQ:igb4mBIBhGFq3Vibn7ZB98
TLSH
T182659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 62d857a1151f94d64da6447a44219a6cb4c4a0870d09c496375b389274311100
MD5 523d19a456ea360f2ab4023033e215da
SHA1 04caa854aeae46638e7a4ceb77dba9cc14699184
SHA512 51e7077bc744dd7b37335c3237fa8d764ad686d0659528037b85f5a845c11ed9dcd895754b8330c44d307bd096d813b6a8bace6457a3ac3f0391ff1d57105fd8
SSDEEP 24576:3G88u8FpJqH1jzria7/maDhr1VibHHufeZ1H6IFrXQ:27ZFPqV2a7/b3Vibn7ZB98
TLSH
T18295F16577E101F0D477D1388A864663FAB2B8650364EBDF07A88B511F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 297ab634a4d6073ee90cc78963924843cc8e167193e24ff68f6b0a366d9a4879
MD5 9c862dce76b18506a51afd77d2de4f37
SHA1 1ad0ea573b7213cc6e9ae6558f611da87cfb9e33
SHA512 903daf8835a851a2cb827ac9112cd743e07bd5e6738cfcf4be1772aaf7afbd3d3842783debbf99cabf701858bec81f4c0d1891e1c43256c7beea3997d088347e
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAju3Vibn7ZB98:fG05lO43bZVibn7P9
TLSH
T162D5C06E62EC11F9D0BBD17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 17679f552849b41d2688dda78c312942b007e0b1da348ee7bb190ac3b8591bb2
MD5 4ee42ca14eb05f44324aa7a643d0b586
SHA1 80384d42c700dbe1d0939363599b220e174e6b67
SHA512 37dcc741c25b584989ec00e47a0b01ec36026024cbc0495b10d175d485585422352e3d89dde7469406d1ca8146ae16451868405bca0d86360210a56761e64603
SSDEEP 24576:Zfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnEDhr1VibHHufeZ1H6IFrXQ:Ja5POZ39Jt2pasx2+mW3Vibn7ZB98
TLSH
T16865BF5EA6FC00D5D5B9D17DC583860AF5B1346553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 130f8a326dfacbd5d0398a77f2ddd029a5d9c06ea37fc9230a0c63647de366dd
MD5 eddc014734baddfb6a70556c94a3aae0
SHA1 6d2558c7b4b59425cbc9c19554f92af773b8ff09
SHA512 deffda1271b3674cd7b79862b5cdad2b8a24951fa7583db5c86762ebbf86407412f73b5409b10363f389c0eef78a30df9f9e40a7237069c5576bf91d954bcbe8
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkCDhr1VibHHufeZ1H6IFrXQ:kNc/zEOVHF73Vibn7ZB98
TLSH
T131858C1623E901E4F5BBE1BE897B9546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7fb8633b710d71895ed29de0d7db389feedbbc0301329a88f57c02f73ed8a71a
MD5 217eed1a176ba5439fda24804c1fc6f3
SHA1 ec3af2fc54e91d536feeb267f3748b546a98675e
SHA512 b13cbad6ac5933a5cbbb7501169bf311b516a0a451cacaf5e2533de7f22bfa578da2a6d58072196d242e3a6e948bb9a1f44207773e4a08a384a44c35f0fbbe61
SSDEEP 24576:htkNvNnaFeYhJNtmZBmgDhr1VibHHufeZ1H6IFrXQ:htMwBtOmg3Vibn7ZB98
TLSH
T11155AF2EBAB845E4D1FAC6B5DE238512FA727461073253CB5390C13E1E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 318bd4459470fc949efeb8883b905f950296fbcc967e9c3a937c61f4c0c61f9e
MD5 ac9812a902c0e0c6ec8f71f30a46618a
SHA1 c1e9b21f7584f9eed9a831a0770bac764842dbbd
SHA512 e68f2e74947fa22ed21d16dc665df07a3a6b2988dc8596c8b52cf5fa8f3b570b565324f55b37cac1710232b76eb66d6e539dd901c1c4a1f0b0e246b6a9e5291d
SSDEEP 12288:UHvUrBFrEjwaQgvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:UPUr+NQ+Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1C675F21F36AC18E5E677A17D86858709F772B4A5070292CF03A1817E1E27EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 d918e5d78c6bb55dd39c40a34f650f765792e542c2d39ac2f065be750226dfd2
MD5 f3c22859cb3aea936135ad06dbb1554d
SHA1 97b8ca9fba72705389ddb88753976a5d725d0af1
SHA512 280969b3d06677cef578d49de2648bbc40bc699847a90d6839120c0b5174d11020b76afd14863a19e6cbbf7b773c6a7e34842f142739d36f87ebb751a0fa11b1
SSDEEP 24576:LD3FHshBIYQgAZDhr1VibHHufeZ1H6IFrXQ:LDVHeBIAAZ3Vibn7ZB98
TLSH
T18685E17DE66C04E4E47BC2BCD6638A06E77278ED032256CB029481B51F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1012-0-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1012-298-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1012-299-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1012-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1012-1-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1012-78-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1616-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1616-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1616-23-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1616-14-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2164-296-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2164-55-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2164-62-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2164-56-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2636-50-0x0000000001DB0000-0x0000000001E10000-memory.dmp

Download

memory/2636-47-0x0000000001DB0000-0x0000000001E10000-memory.dmp

Download

memory/2636-46-0x0000000001DB0000-0x0000000001E10000-memory.dmp

Download

memory/2636-52-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2636-40-0x0000000001DB0000-0x0000000001E10000-memory.dmp

Download

memory/2636-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/3172-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3172-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3172-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3172-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3212-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3212-80-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/3212-85-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/3212-362-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4060-350-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4060-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4060-68-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4060-74-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4400-122-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4400-365-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4400-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4400-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4600-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4600-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4600-133-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4600-127-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4600-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5396-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5396-101-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5396-107-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5396-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5396-366-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5624-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5624-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5624-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5624-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5624-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6140-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6140-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6140-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6140-113-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6140-381-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6140-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download