6b91e2e119c4b6ebbfdd2cf27d011067ac04a3f2c34783207cf03cfec320aff8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
Size 676KB
Sample260804-jp8wtsam4x
SHA256 6b91e2e119c4b6ebbfdd2cf27d011067ac04a3f2c34783207cf03cfec320aff8
MD5 2f5147f481e82f8714261ea5b4a476d5
SHA1 47071bd6cd96af458ff6c86049a5ddfcf050d2d6
SHA512 fbab8d1729c43f61e6e71c957b7cae5b93f91b95add7864dc5e2e5d322037d0775b6d2da3160f849a40b5a39c792a3f2ec2971c8b606b68afff8bb8b41558260
SSDEEP 12288:r2VHVF+SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:aVSSLexL2gyX6WH1Mr3nQzh
TLSH
T10EE4125B72B034EFC43793788891453CA722FDA679228B4F965871862E3A3854D3DFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2692	elevation_service.exe
4692	elevation_service.exe
4880	maintenanceservice.exe
4624	OSE.EXE
6024	PerceptionSimulationService.exe
6092	perfhost.exe
5004	ReFsDedupSvc.exe
2268	SensorDataService.exe
4836	ssh-agent.exe
2652	AgentService.exe
1964	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\46e71867e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cc59867e623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045739e2de623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc066e67e623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000126adb67e623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd22cf27e623dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a31a82be623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cabaea2ce623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e128462ce623dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
4692	elevation_service.exe
4692	elevation_service.exe
4692	elevation_service.exe
4692	elevation_service.exe
4692	elevation_service.exe
4692	elevation_service.exe
4692	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4608	2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2652	AgentService.exe
Token: 33	1964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeBackupPrivilege	5004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5004	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2692	elevation_service.exe
Token: SeDebugPrivilege	4692	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 6120	1964	SearchIndexer.exe	100
PID 1964 wrote to memory of 3724	1964	SearchIndexer.exe	101
PID 1964 wrote to memory of 2296	1964	SearchIndexer.exe	102
PID 1964 wrote to memory of 5156	1964	SearchIndexer.exe	103
PID 1964 wrote to memory of 3744	1964	SearchIndexer.exe	105
PID 1964 wrote to memory of 1436	1964	SearchIndexer.exe	106
PID 1964 wrote to memory of 1644	1964	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6092

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4836

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79cab2312a4896922e792a8e70216b524312301ced9f3abd1ff99839a9110e44
MD5 05616f27f7ef7c7f998dede0e6b6cdf4
SHA1 4fb4ee8438ef176d4cbd17fe177718eb96f2deea
SHA512 0d6d68a452e50d412eed544d08deecfe8ed82014f23d9a52165d91b70c5c100a233ae5ae52cc106725904855ddf1d2426eee5ca527af1f61fee34d1a3355f855
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnNSsLUX6WH1aUh:A3q6sjBtsgKWH
TLSH
T1FED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 5239ad2b9c5aae36aedbaeedee4df18440369bc7c99c240f4f36edb0400e1cf6
MD5 b61476b10f18571b0c7224f3b9b7beb2
SHA1 dc44cea81e24d26bd331dad0a39f615cef9ddcfa
SHA512 95372fcaac085074bdad537093bd1b8398101ecf37a296deaeb04cd1de023eaf05ff4d7e7ebed7f13000d4aac2a01c6a115b8a1ab03d48d1ed26543b03d762ed
SSDEEP 12288:Q1XLsswWkxy2lRq2czAcSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:GXYfDtczAcSLexL2gyX6WH1Mr3nQzh
TLSH
T1E605F12977E408FADD67817CCCA28515EA33BC8647A0E78B03A495691F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b18c51daea5986b5591869d2e5fdf70a9592dabe9c421d9871e7f486620f6035
MD5 cdd2db3b00e0e4866cd1d5280455a943
SHA1 bdd2b41538ad669716a362caf0d076c1880001d9
SHA512 a0ef633b7dfcaa4455d61133b731ee9abd22cd72293c53f35da654a217d1015c12373f8b8892ed2ad6777ae0df8351c50375121c146d9e3114899807b2fed947
SSDEEP 24576:t0Le5ji0hmxxrMFSLexL2gyX6WH1Mr3nQzh:tPji0AjSSsLUX6WH1aUh
TLSH
T17F359E16F6748335D073C0B9C5D2A69EED7230865B308ACB4286D77C3E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3c3a57016026870a70ade7952a00f65cf6375dafc2b9acfafad0475cd586428f
MD5 0a6106d941e5fbf2759fa15a976f9b95
SHA1 365ca39bf93b2b7a4bd40ec9a4f74a82fa32d4c5
SHA512 1cd9e1832b782342bc4299b038d666cd644f2a5af9ddc2fbe13c17131adcd635c3238cea1f9b6ae475971b964d2c09c183fc94f725b965bdfbb555b8e57c6cef
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyuvSLexL2gyX6WH1Mr3nQzh:6/ezSC6vUzPveHjy+SsLUX6WH1aUh
TLSH
T1F0755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c7b28c158a1f7f0a49a6595104e0679fd52617ad6f658cd3c3e60a150a6b2ed8
MD5 a7a89d412a6795a32df54738fd056b1c
SHA1 9c3fac056484e525634f2a8c219ef26d02fae2fc
SHA512 24c3a7e2bac0d32edd8ad3bc78e67cd4b99411fcbd94f09441918d444e37d74ce602b9031b9a9fa7f868256e992303e71ffc531ea37748e8e9a46ad56f0e8ba8
SSDEEP 24576:hVbqPb88hv/l+YASLexL2gyX6WH1Mr3nQzh:hVO88hXl+XSsLUX6WH1aUh
TLSH
T172559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 639bb6d9030bc9a5e98dbc75c0ea3d5d3a7b858f9e29441f2c7c6e4e9701ca4e
MD5 8b510a9fa13a0a28dc44c9735593d455
SHA1 1621384399e19244dcc16c5ecfa69932d00d5a93
SHA512 89a5242613998cfe1da0c709a36fcaaa570be3f692a3470c8927949ffac415142afb6ed0bbe082223b6b983c0fd57a69b530166a0616daa75f8171ffd2b69da9
SSDEEP 12288:iLpSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:iLpSLexL2gyX6WH1Mr3nQzh
TLSH
T149C423AB6AB434EBDBEB80F859EB049C6E02FFC708915647E514F09D283C24BD92D547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b8dec480ba794f10365724cd3377db3349d71028d9ccfa309befa8d808fa4039
MD5 cf154a5e0ffc6fbe6b0cd542260ad1f6
SHA1 db22e340a97d6fca2679215891cf87dc8d37bbe9
SHA512 a0f0778596f2925160a3f3daeaab1e0c4aebc8a96f74a9ca25651a16b342dfa639c81cd0fa26ec50aa302b94f9ac2d064935c7d5cce4703ceb31980068767063
SSDEEP 12288:7eBNUbTVO86U4SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:7JIU4SLexL2gyX6WH1Mr3nQzh
TLSH
T1FE05CF7BEE38FCE2C27A8CB85A918240E76278714F6293CBD165C20EDE235D15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 138f633c5b4bfddf0898fd5e8bbaa5d154dd146ae62845fbebe956de49839cbb
MD5 1f86e39c9e5cf3889980d701abcdd7ec
SHA1 69548b279ee57e29990189fb795bf8f87ff1e4f0
SHA512 00b3de218c3a5c402778452897e5179a85c74a3e7729c1805de820e4974c5f064675c3e2196c916a177c7d492876680d864ac24d830e5a6b58f18d111aa1a939
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:BQvGAdlCEL8c/DRNw5CasgKWH
TLSH
T1B7266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 78775adf9b3864089cc448cc2a527277ce82cfa8f26f1a1d2f04b993100e1efc
MD5 2e9db20c73ef8dfc64f0bf5922c65796
SHA1 2a97e8508564b8e15e137dea5e35442c8301cec9
SHA512 7d8e5e43f10cad941de0129c614e85d606270e1afba5e4afb8f97a9845797717cdf3da63c89f65b3c53e86f354f4655395228a3a11385d324ea4542477378dff
SSDEEP 12288:SAwSfxL/2Dc3RDLLmt0LDQewsAjiSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7un:X0ewsAjiSLexL2gyX6WH1Mr3nQzh
TLSH
T1FC15E031FE74E036C7BF0CB61B76C716182DBA604F511AC3E3A8999D59342D2273AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 968d1051a43acab271993bf5ddc0616448ac9356a868868de94c15f36b2284da
MD5 4c9c1eb9a461b13459ac83ff1cbd5dea
SHA1 ceacbc39f4be8f4491f20ed0dca29ad4fa1e7125
SHA512 7fdf61c8695b7c059f92d64be4285890e67486d56f04163cfaa808984afc62de0daf6c7ecd537fbf10f6599f8682d86309ed77ff226cdc796a52d48d87d10856
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHJK:+UEtQevvqc2W1cpV2tI328
TLSH
T119474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 91fb635b129e5650d77cfb41b4083f7d64f78a30f64d9812198e54d5bb816f1e
MD5 57223760d9cc991922ded39ecd3ec711
SHA1 8264fed7ca2d3cd3f29f652ac61653a05eeec724
SHA512 4b78c91c539b8e15a337aad794997a51d8811b1eb30bf2afde781f201dd3610da507513b40fb33136740a39fa3bad0ebb33b6ed66d6dbae73efd3caf0c6490fc
SSDEEP 49152:UCbRquA/m2yL5zifFiV+XenmE3/zCSsLUX6WH1aUh:9oqHVjnmOsgKWH
TLSH
T153D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 00b012e54fd52556f913cd35952f49ebb387f50492503b9bb2f4d2e8612b4645
MD5 b5f7f58fa47d258b85016d30439627bc
SHA1 c4bfaef3219e97e9da3555e89b40fb4d3ea607b5
SHA512 741409dea429bfc0479492162f9c92aa4a69d993912be6784a6a9d5716a2cc3962dedda0b617eb19a05f6b68cffe559b763b8142ec09bee9a81cae1bbc71bd34
SSDEEP 24576:FAhGL3IFoiwtA5l7S537SLexL2gyX6WH1Mr3nQzh:FAMUFoiq5rSsLUX6WH1aUh
TLSH
T127359D81EBF955D4F5F3AAB899B68170EA72BCA65E31C20F2150D11F1E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ca619547fdc6cdfea92e07330d550cd329bb3ae705296f4497b67249b4c4177d
MD5 efcf9cf8f2449ca46c48fdfb9770442e
SHA1 c14bf0d76cfb02585912c962adf4e5afe751d660
SHA512 ea78080032bce18360dea506d7bd081697ff368e176dfbc1e21d451f8eb3c35d59adfd6878577cd9551f49914f09194c8da03b9f14b61012f84a8d3349e5c661
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+CPSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:Twu4OWeSLexL2gyX6WH1Mr3nQzh
TLSH
T12F05F14A76E41CFAEAA7813885978135F7B3BC022A21D71F5760C25B6F37351AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cdbacb71d1433658c8356366b2684639098fcd70b76c20017b4a75996f34da6d
MD5 f23f7dbbfcdae458b4bd09658d6f6e5c
SHA1 60a70230543c2c991d1da15ab3f1d2efb0817b2c
SHA512 42c9a7e9d5a061d249ee60bb0ff91c0edb8623c7873d99407ad0aa0b65859eaf820014ba1dbeaf3a00701569d6c9e5221687b0c6b7e2de8d0343ecce31fac687
SSDEEP 12288:FeZ1IyySdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:wZudSLexL2gyX6WH1Mr3nQzh
TLSH
T1F6E4129A36F430FBD2A781BCC8E60548EB62BC87177243CF552491992F36AC65D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 01992298515fa54588ed444a06642101d5522477cd1aa79b1d11f282997cf22c
MD5 1b287d8ed99d2651dda3942bbed2bc2b
SHA1 0f85e1aaf078175dbb94dc3c7c43a16afc7e0f1e
SHA512 ee139db01e71eaa23fdfc9188c0a55bed41377e31fb527d2238dc9f990b7448825747b3d1785e8d206338003dca719a6d122d52c7f0c75c4eea84d2034eef4e0
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UN:UQRQyi36YOcPbLvw2gAf+PN3ZsgKWH
TLSH
T188667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d1bc6e05c4e4bc4c6a4bf90735205982e34ff103d8f9a680bd00e51b5ab228f4
MD5 b7503cb118246a8f24f7484812d81f1b
SHA1 dcfe7e05080f071296c249c451ea5ac2e75f8520
SHA512 a2d7a07aac04391d7ad7f38a992f9af96bcdf5956b8b9b3df2e4ef60b1c1735879c746c8e8bdac42ec61f1a871ec0cc100a4aa2562a84e54f442d8067dea23b9
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UN:FQRQyi36YOcPbLvw2gAf+PN3ZsgKWH
TLSH
T138667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1d3ec2895dce9b00a9645801549321eea88fa37952099c3ef428adb58f387887
MD5 b89f1e0c9c4d7e4edb7196be905f8c07
SHA1 f77ca9790e24025c0ffb41cd4e82cbce48624f74
SHA512 1e5e7bdd903963a7ffee330a8eac898652329b8660374b18c39fd65d521394cd4db70ff6a4f6f1d37111647be076eef19a84afe391108b0309e4c01627753281
SSDEEP 49152:268Qg55nhceWu7PNU3/SSsLUX6WH1aUh:UthLRc/bsgKWH
TLSH
T170B55A33B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 783e9224ff9a9a2539f4f944dffb4c14eb59e9dde0d98468f862df9ca9606d71
MD5 637976073b038b2549e0a247d5aa0b23
SHA1 e50e3138595521d5a90f9e06afb0c37849238e89
SHA512 2a83359d9c0f62e68d8ab2ad515905615a5e505703ceb6511bf319914097de008cb6597f4af094a4ea75e66811e26cb4af741fb1c9cef85eafca52aeff2c60d3
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk993:Zy5112gYy5azzVvt69nLKnhZosgKWH
TLSH
T152167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c6e9315159909af5f127b768cec1d9035dc197493591ded2a326282a0654c338
MD5 2092dabcf0e8f28315f9d0b6f0072776
SHA1 6d11e930fb1412c821e2a21dd8967d0cb63c8d2a
SHA512 3e644ee8f76964592fa4c4ec7f9cab3c8398cbed251e4da80b7ad1083f194b7f9901873546e5eca1a69979ef1735a0b75efc426a3a68515c4f001373a270c820
SSDEEP 49152:FB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glMSsLUX6WH1aUh:ru6Jmdxd2dBsgKWH
TLSH
T1D7D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 84ffdfac2aa21e2479d3cc35feab507528ac169bb336a17686b9d59856487fd8
MD5 1ecc8d4a9a69573a56c02d8542e62fa2
SHA1 53403437bac83c463e3de417f2077abc61434d88
SHA512 4ca33366ce438e01286456d518f8e4b402d343b0b217a05ae37972caa9e0c45ba135cdcc00c69cef9c20349fd0092b27bee7c60fa04207cd4848f0d4d2a455bd
SSDEEP 49152:D1hpsNoJpF1A63U44CwH7R4xYSsLUX6WH1aUh:DmifPWROsgKWH
TLSH
T10FB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 73c59944da86c711eb0a77d307b03c03b3825efb2f182b4f10e299cae336ad84
MD5 c6deea79c4d83cfee7c40f7ad407cf7e
SHA1 fc2fd7f0bce001ac0afe9bc4eb8ae8920f82b9f6
SHA512 e49652490f7688436a60cf40dfdd5c3cb4ca84f98a72b6d41e7d8ceb03db173605a437bfb05fafb5059345238d1da945c5150f15d9d06b4602e79a2f19b239af
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHqdSsLUX6WH1aUh:I5dKii610sgKWH
TLSH
T15EC5BF13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 da05cf39cd0957212801f0ff2e1e470d35697f25b5f74e70ba1f4ba5f4faa832
MD5 d6871e85efa1ce0004ad35fbd6d6c0a2
SHA1 eb7d70b7219b7cf8231744f9344852b17c0ec6fc
SHA512 59dfc957db4d930b4c56a6347d5694b1f2ff9dc93935d7619f1c31a107daa33318bfa0fee1aa1c57c64339ce9beb0f3352bc27dc31fdd50ff240f3f4eecd1382
SSDEEP 49152:ChtSn8EApI0fig3giDn0AP5wcSsLUX6WH1aUh:jX2imphSsgKWH
TLSH
T17795BE13F2D900E8D05ED178C7568632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f07520b96e03431dcbfd0f9b898c80a831faa3f5add091df21cedaae3284fea8
MD5 ba3ffed941290c38f268b9771bbf6bc6
SHA1 ed22eaea898b888aa8c8a62b8cd5e1244ed516ef
SHA512 1dbdfd8cdcbde8b83bfabd291a3a5fc76c5b242941f16d58803e99162348ae0a8e3e167a8e918fa0cc9cb99ca58a328cff046d88168a5ed247563ddef12595b9
SSDEEP 12288:xBSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:xBSLexL2gyX6WH1Mr3nQzh
TLSH
T18FC4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F509F04D293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6208538d70efcd5d868b9b8fd064fe89b00395ed33f3c4c7b6c190e96c439144
MD5 ec88bf70a57a2f5e4c314c7b5c57e676
SHA1 c5d6f92062a5954d637f6a8560ac1697410c3231
SHA512 7e30ed441ec90f8be403f811535fab0b4fb692972027f9007cb2269a1b17ffd0856459038831635a3233609b23cb5e833234a1e2cfd581d444d718a455cc1616
SSDEEP 12288:yGSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:yGSLexL2gyX6WH1Mr3nQzh
TLSH
T1FBC4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F509F049353C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9fe323e4424b14e99f7fcc77b39125f4396447712df4f29cc1e879cd9d1cdd96
MD5 3800b02434e55ab284af7d931954c737
SHA1 80eb0fc948048a4e2085b9c15836039a11438f1a
SHA512 f2e5c5a903ca826b03b94bec0d93005e0bffb2d71f8d69a4b55a92685d019c70099fb39f00a763d302632a9dcc2edc64f90a0d5c0625a806f3b82d1bad3a999a
SSDEEP 12288:dwSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:dwSLexL2gyX6WH1Mr3nQzh
TLSH
T162C4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F509F04D293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a145fb8c14fc9dcf9324ccfa345555dbd32a0bcaedc4d81684866d0cc99365f7
MD5 87c28268d2c93c82990243f7d44dafb4
SHA1 5a2c1ac6b3cb1161803a22978ef4b028ea0751f0
SHA512 5c4e1938325ff938d834853c7daca684a499de497d632a0b6dbe8bc071c5299a5cdff839c3523594042923b93f586646f73e8af703ae976847e954c8fb2bf430
SSDEEP 12288:PVbSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:ZSLexL2gyX6WH1Mr3nQzh
TLSH
T1C9D4239A3AB520DBDAA7C0F8C9A70158FA52BFC75A7253CFE600604D1D783855D3CB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 deef1223a085515e54a2aaa5a5c31b6af547598fc8f0caf13c5ed7aadaeb84ea
MD5 a6e90fe412f8a8c2c1658f87c17954c8
SHA1 bb629c15deaf507a54d578f1f88d14c76f4bb856
SHA512 953352f91979b51b9946a82a8f99ec7cfb0ba3c71b4bd7721b8f269efd6f8786285bdf13c85c07060b8dc87a44f70e82a4308256fea469f1af2b8439e1fd94d6
SSDEEP 12288:njSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:njSLexL2gyX6WH1Mr3nQzh
TLSH
T106C4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F509F04D293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 04970b1f9b2cdc075704fb91bcfd32e16d0bdcafeca824c1396e2b50d926f817
MD5 425dd46b20a681c3006abffbecf66723
SHA1 4561dd75d8992c2cf4268180eb04aa780816dbad
SHA512 3cd2a5498d7900082525e92b2c921e223f693d85105dda077cac157303714362bdb4aef70f606f01496df04e1960070f3ab640b0adc25ffd020c0915d797aa44
SSDEEP 12288:V6SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:V6SLexL2gyX6WH1Mr3nQzh
TLSH
T1CBC4239B7DB524EFD7A780F889D7019CBD02BFCB6D924287F509F049253C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 03cff74a0ac8ec97c391fca88f97094c81a605398ba76d22f2f912caac08c80a
MD5 2b2a307de4d98308cc5c14f5798c96a9
SHA1 c767a5d2d199bf81aa5722a3fce9674cde12a8da
SHA512 26a126203919437854b565bfa106e6c97d39b550abcd58ec840e0f0d74c62f3e68d56ae3e03fa555bf851ee66f92dcfa0ca7dde8c5a11ad3045b09fae2d42220
SSDEEP 12288:/OSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:/OSLexL2gyX6WH1Mr3nQzh
TLSH
T16BC4239B7DB524EFD7A780F889D7019CAD02BFCB6D924287F509F089353C24B591C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5696b04daafdae22d77d8bd668f31fa95445091696958e6f6f87bc3815e88eed
MD5 8f2505a2136d86a7cf50971c2a5051b0
SHA1 aa1e2806ab14b26b9f464342d92614a9b858be62
SHA512 0fa406b9961a737a0a26ab5924d241eca0d97e9d49e630ad54efa08b8cc4690a0e70530e2eb7e566e7d824dadcd1abdb0fae379a7c63348733af0f187233ce12
SSDEEP 12288:AiZwbVzzFEoS2cPvymSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:DZMRzFVSOmSLexL2gyX6WH1Mr3nQzh
TLSH
T1B7050299B3A018F9EDA7817DCD564905D6B2BC5A0BB0C60F13A4326B1F373911C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 11f2026713f69c0399d32c5ddde20ff9df855fea3fd6e13f314e98a3c5751736
MD5 487ec04a9eb116f556f0fd8c44100a32
SHA1 3afc68dca1d63e2771bde56422297ce2ebc19881
SHA512 58d0e947f546995b35d98954c3db67d2838455c13c28805555d94d7b6e9622a45017e72b7c53351bcf20ee256f64be5f865aa746d4e02cfac1782d5c93acfc71
SSDEEP 12288:JtSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:JtSLexL2gyX6WH1Mr3nQzh
TLSH
T161C4239F79B534EFD7A680F889D7019CAD02BFCB69924287F509F04D393C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 cdee0d086c1e00a39da330316810669408c5baa5f1fb82a178ec3a7e3b568001
MD5 cbe7dd35464ad56b6927cc480a9d20b4
SHA1 1bb610748b7ba4eb308c81f0af14b117fb959167
SHA512 edf3d745908f13fc5f2767b54d70ed4c23cd1dcffb9e6ba931828e25e9fabaec4f84690ccb19dd54abc12453aa67a4cae795f68193dcc72d91e95cdf738272e8
SSDEEP 12288:O5SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:O5SLexL2gyX6WH1Mr3nQzh
TLSH
T1B7C423AF79B524EFD7A780F889D7019CAD02BFCB69924287F509F08D353C24B591C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 cda58251ba51950c20ddcbdad524110a2365b35b37e578ae31bdaadb26398f69
MD5 cc58d78ed4914d882d49a75b014c35b3
SHA1 cbae5c5e2a4818c736db7bbb9f2b6a76f4c6ccf8
SHA512 f41e951f3da521c144b6db616eecabda419dcce6e90745e5eebd47c51905f91e044f6cfa0282add34fd636630c56c92ab220f88678aa10a8aee19f9c99b2ce04
SSDEEP 12288:7yPz5L8ySdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:2zyySLexL2gyX6WH1Mr3nQzh
TLSH
T118F4125B76B130FED1778178C8A20A05F772BC730B608A9F5364527A2E372915E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 350451b1d90b0bca8b4c267f0c79378fd4369c3a9119967c13c56bbca841db3c
MD5 de861b17ad8cb2a6f3b8969e8bef1f7e
SHA1 337992d136d238697a6941389da0018a4899fb22
SHA512 4d679995865e34c6094036d1bd07c8722bdab22e558eeaa5a588035c27f76c64996c4b8f0b2e37d56a6d5553dc37ccdca9ba81b1caffa1c16aaea3a8a5531a59
SSDEEP 12288:2tSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:2tSLexL2gyX6WH1Mr3nQzh
TLSH
T190C4239F7DB534EFD7A680F889D7019CAD02BFCB69924287F509F04C293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 331b79cf81ac8ade2ef039649d4deff715bbaa90ca10e53cdcaae3d78a327f77
MD5 81d1f1d786a5cc24df8cd5f9ec04b0e1
SHA1 9f03dd41dcbd462b7e680e92012f4ec236bd419f
SHA512 2b5204e9cc97a2544b0d7748210668a6fd9596164927eafe8a8d9213703abd5eb67b55efe9da271bc4aa7822b2037c3483379b4173d4d753bfcc551256b69bb3
SSDEEP 12288:9tSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:9tSLexL2gyX6WH1Mr3nQzh
TLSH
T134C4239F79B524EFD7A680F899D7019CAD02BFCB69924287F509F08C393C24B591C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 29711af2c2edd590c2b68f9cf83abaec5d7cfb2f19752bee27627bc71c2b41e6
MD5 4519afab300b36d4b221ac414d941d4c
SHA1 8dd6bb1936c6f8f123154f4141a321e23bdf7a31
SHA512 65ee77148b8dab58242bfdde53d72368cffa4f53fe5a832875498c16a21b21b79e2468294d8c017789d00b1c7475add10f9d560b5cf34e0dfe02580ad82f156c
SSDEEP 12288:lyPz5L8ySdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:szyySLexL2gyX6WH1Mr3nQzh
TLSH
T1D0F4125B76B130FED1778178C8A20A05F772BC770B608A9F5364527A2E372915E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 bd2222b47f8b4e0c31c449f9d5ceba35c79035873aa8fbffff956b5c9fd17f5d
MD5 09f52063e529a4fa2e635304daeb711a
SHA1 7e9c07ebf54ce08b5c75b11cc2491fed65c3dc6a
SHA512 406dc013df451f955a4dd3fb90ff86aa53eeca857f864993834eacc22a3e3fb9dc3dd6b6c0e5e49daaa05a970b540840013a56018c32b8a74a4f6383fcaf70e8
SSDEEP 24576:4TDaLl3z0zDgSLexL2gyX6WH1Mr3nQzh:4TuLljvSsLUX6WH1aUh
TLSH
T12F0502A9B3A018F9DDA7817DCC564905D6B2BC5B0B70C61F13A8326A1F373911C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c0fb782567ea7c4589dfb1b7c4e0a6580a5cd4a4d5f334ef74131af21406e311
MD5 9c3d47da21140da67a8f646c48b5e968
SHA1 a186d6fc2129042b6becd14f3bba289e7906a017
SHA512 91539bed428f463720c0d49cab7810b97412859dadb4dd84b58172c924815020564a4d167184a87712955eba7483b19fc7881731b7f51ddc7b559b5829eb88b7
SSDEEP 24576:93vd9CHKy7GZ0SLexL2gyX6WH1Mr3nQzh:dvd9CHKyaKSsLUX6WH1aUh
TLSH
T1F225CF90F3E410E9F1B78A758D764511DAB67C9A1B31CA8F03A8655A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 eeb57dba4e705b637938332363a82048f20a7697b1ba8bfeec12f6890d9c4e77
MD5 4b173baff8d176cef9cd3a1863646542
SHA1 004fbe9f973e5eae55213b874ff63ac546a10d82
SHA512 f37f9d0bdde122588065f1c8d7c7e3281249044b6c711b3dc8db20b93bc3671cb0813f7617a8872334c82964fd2d118c5ef38807909307ea07e1a18c8bd4c62f
SSDEEP 12288:IQSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:IQSLexL2gyX6WH1Mr3nQzh
TLSH
T1F8C4239B7DB524EFD79680F899D7019CBD02BFCB6D924287F509F04C293C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b913fda23a8832e412deba4ec70553440539d26a25635b3cbfa2d1151d4175ab
MD5 af0f8be636de779e01b76165f9affe4a
SHA1 01d878a779543b7b2b9773474c89310eeba86167
SHA512 5aa975dc4e03b2915e335a58d5163b30780e529385c01cdf9dc3c01cda60b09bc2a728035a24928bdc5659e64e9961b8b18de0e5a93a68b69c238fba421612ac
SSDEEP 12288:2SSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:2SSLexL2gyX6WH1Mr3nQzh
TLSH
T165C423AF7DB124EFD7A780F859D7019CBE02BFCB59924287F509F049293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 61b2d955287330beaffd8480883940c7a37e7595d8db634a343649ed7bfa9d0a
MD5 fa9df1ee455460707948f94e7c7f1e88
SHA1 f25267c29247379f9f21315e145fb5b408e12b13
SHA512 8221a32f91bc2f895d0b16037b0f5cab9e4224750f693d922d9a517689b029704607d046ec42db9bf75026bef3b806485cba4ca28e01c39b0468ae8b6e371ae1
SSDEEP 12288:T3SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:T3SLexL2gyX6WH1Mr3nQzh
TLSH
T1EBC4239F7DB524EFD7A680F889D7019CAD02BFCB69924287F509F04D393C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 554da455873a0922c7ff3f1cae5090943189fdaa3fd10b08c6f9c7fe44e5cbe3
MD5 ebda759bbd79e5f4c0bfb0334b12389e
SHA1 1a7ebe160a8efab2b322b5faf5d2959443289354
SHA512 d7dd4e6e12ca05918fc89758ddd8c9a3946119437bd35a932ff0c40945cb989a6f8c70ebac28a781ec3c9a286794968063f6c8a137275b13a037ceed62817498
SSDEEP 12288:btSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:btSLexL2gyX6WH1Mr3nQzh
TLSH
T182C4239F79B524EFD7A680F899D7019CAD02BFCB69924287F509F04C293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 ac1365b31354a6aae8c04d377de14ac06dbb0f64f0d32eb22be4385c686638b2
MD5 747e2c9a57cd1bc91653e86a2c3ffae7
SHA1 51a1729fc5858c36bb9384f59bc81620bdd1621d
SHA512 a54e16dd7a0fee382e42453029d8f20a32cd0e68f91019947872365ee431a0b72389bb17cdc205cf05fd50d35893ae45456f84e4d28811159dda67c7d0828695
SSDEEP 12288:bQSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:bQSLexL2gyX6WH1Mr3nQzh
TLSH
T1E4C4239B7DB524EFD7A680F899D7019CBD02BFCB6D924287F509F04C293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 1b74d97e07f44e11905e83880ee56a7e1795dd940358171bb55b518c9b4bec02
MD5 11e70912cc920afcd71a07bc1ab3d90c
SHA1 012abab844b73ec936453d62f40d97e108e71caf
SHA512 9e0ce652be9ee704849fd1cb1811b55beaee0068588d4f9eb711dde55ee5165fdb710a6b3f4558213791921897c1e062db33373b93f56a7151f1582cc31042cd
SSDEEP 12288:p1SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:p1SLexL2gyX6WH1Mr3nQzh
TLSH
T1F7C423AF7DB524EFC7A680F899D7019CAD02BFCB69D24287F909F04D293C24B591C54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 2990663881ce49c76bf15bd7fb5df4d0ed67656a4f1152311286ee7a22a81c75
MD5 13188257b66589e7156d572fd60188d9
SHA1 cd24883acaceddc7638db6ac8a281cef10f5bbfd
SHA512 9f18c100f852916374f842f72b888d25ddbf9547b0106338f2dee0935d4ed0bb7233e470b66293b49ec92d54c1cd9ed2a59f3c9702d9e9b66051f5366e79d865
SSDEEP 12288:BjSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:BjSLexL2gyX6WH1Mr3nQzh
TLSH
T16CC4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F509F04D293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 b28fa9374c4238fbaf9c55d22edf146e74652421e2bce889017b7edbf7877292
MD5 b08940eeee1b91868e588214ef3a1ca5
SHA1 cb1edecf72972933c2a4f6ce514cfd0129d5b8e3
SHA512 dfb58ba71e90ff1fdf4239966676a01d876404d097de9d0c9cdd52d1eada9f19c93287ff633222c14ed5014016716d306279122d127a385775638fd67f448489
SSDEEP 12288:7ISdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:7ISLexL2gyX6WH1Mr3nQzh
TLSH
T16BC4239F7DB524EFC7A680F899D7019CAD02BFCB69D24287F509F04D293C24B591C94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 613e655b0231ad2838de310b1abe32c0a771999c9ad94a70b874e93b3a751ad0
MD5 5f88fc106cd2f15ca7d1fc6f8ef7039e
SHA1 845f2da9cca06dd160dc3c1bf137a4915d4a5167
SHA512 cc74de32e9755d078660ce8ab604ef792a0b56a04d2abbe21b1ae59aafd759db1ee7a4d0990c7f5abe957711e8cea2da04dba416fc0526c6c78eb5d3603d6a16
SSDEEP 12288:cjSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:cjSLexL2gyX6WH1Mr3nQzh
TLSH
T10BC4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F509F04D293C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f4f72ef096ed70af0187793e6dc1f2079f75d259a4b67d57ebcabdb6285db7a2
MD5 51744a6871c75903a7c25cbdd5018a4a
SHA1 4fac807a401d10a6ac364b672bf602b75b09e710
SHA512 dfb91233c11e0cf14e7e2d90d41eec53146d7b7c69e63caa53128a59d3bdf191586f6d8cbb526a06ce954497725adeb62b7e1ff758fa5da42e7483c3a24890c1
SSDEEP 24576:NfwvUk9RX6wkyAIJSLexL2gyX6WH1Mr3nQzh:fMnYIJSsLUX6WH1aUh
TLSH
T19935DF29EBDC04E6E1B7913C89B7460AF6B178591B31C2CF125A53AD0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3709b1aa2ea368a34eafeb0dee4e70cf403f19da74b2a444ab5fa48ad60967da
MD5 a3ed7b6dfa1a43f898358b28cbc99b08
SHA1 f3e6f4442ca78df069a54ccd75d7fdb9881fb8f9
SHA512 0a9cefdb92b1f46e658f983846c6aecb7d81c4a1c96bc02c7e2aafe58a28f1f2b4572fd5cc76e68f90ad6c795cb0a527f4358cb06bf1550c88fce623a562bcab
SSDEEP 49152:yYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08SsLUX6WH1aUh:pySzP5sgKWH
TLSH
T143066C96A1A801D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 11d27158dc72fc9fe693469068d9206e62bb1c4a61432dcf39737141f75ff913
MD5 cb7a0309c249a23196944fd12fe7310e
SHA1 3f6ce9ed175644f6cd2fc1c2ef85b8106bf04907
SHA512 088383eb55385d476c8e5cb627066e54704f618a1526212d2aa7ffd2dfe120164af9073cd53703bd8b092ae425f9e6cd1f1fd8b04cb5c364cd8ee708fbfcfb0c
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY2SLexL2gyX6WH1Mr3nQzh:147JUQjTirIhCnDHUPfF/MSsLUX6WH1V
TLSH
T1EA65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0f9b08077efabbca008ac662f99a05b68948ff3254bd94005dbdf298909bc147
MD5 01ee95b8cf3d779060745bf30775a022
SHA1 2ff13997e26f85089b3a49754e9eab00eb1b031a
SHA512 78871e62ebaf8b92ac35068256f9781301dd876c681d422baee262a4226b11429ecb5aa9dcc15fed9c31813e36973d6eb99bf6b554f472c6cb2f664a8e0e73c9
SSDEEP 12288:absfdSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:xdSLexL2gyX6WH1Mr3nQzh
TLSH
T1A6E4015AD2A411EAC1AE91B8CB960644F7237D5687E1D3CBA2C0F07E1F392855DEDB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 900KB
SHA256 b86d6acbbd970b1c851287a46f4f51a158ae38dc821d82f1765671a61313fd21
MD5 26c675242c3e3aee830c3da2ece5ed14
SHA1 3bc89f807fb1b09ee0dde0c1117e9c7a5477efbb
SHA512 cb141dab4f01ff703ba777f257edc84b2138eb35765fd572534a6ad5d51d41b5ed6c5eb17b1d7c53a1903afb10d869a46883fc612ca95dbc7190deab75033ab6
SSDEEP 12288:y3/Q+2U3fgOLnsdHSDYCWbNTEivkCvsd92:y3Y1UPgQIyDFWZIit0d4
TLSH
T1FC151710B66BD75FC6A940321E33C2CCAB707D42EE059B0372C9472FD576669BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 584ac697c0c662cec404c232e8cd463888906a20208f1d37002f060d06c25a79
MD5 a935fc59b18c2484f63df3a43731b806
SHA1 cb89b9c3b179cddcc1ab3e77a96fd662410e38da
SHA512 6374958a5d502dfa045ce5645c0d9f55fdd0d7d0994872932ef600fd0a980944c57732ad184cbef294e99c161d4caf3b3e6fe3c99a417c25259ed22456bc1344
SSDEEP 24576:mF+I2RRqe1mwucKAGJBE391XnaTCVJnIIIGabUy:m0NLRmwucKAGJBE391XnaTCVJnIIIGa5
TLSH
T17D4595816437A3DBD0FA2172072A5B4CA764EC07B7495F2763C8053AD82BB65B1BC2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0b7942880c13458c2cb04adb913dacb817807bd27f5baf6e278f13bee1edaf19
MD5 777e6e0dd2fd1ba12fd8d7d42b0203e9
SHA1 a2abd9714d8a21eb77c5be602efff65c9de80470
SHA512 1e1e1a06d46c4fc1c66bc7428aa49a9737bac9004b7d8561c8d4f11b6124cfa1b559c507f62fedc0240f640d54f0bf9490adf289531336aa3c44943f634d75de
SSDEEP 12288:oz7lSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:WlSLexL2gyX6WH1Mr3nQzh
TLSH
T15CD423AB6AB5349BDAB780F458DB01687A02FF875F9181C7F504B09D243C6CA9D3C64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f1ae86e308676b2eccff6c2ba8931d53c7524e4256548b71cc3c1dac3a9b4a41
MD5 3ade9cd8858049eb02081bd5e5168efa
SHA1 aa34ef25aac55d478db2e937db27799edefa2576
SHA512 c4e26026cb442f899764a737d98d74e510580f4b431bdd7c4014dd80430dd45e732f7481bc71847df7540f4c59f0f55cfd3bf946e1b6e55c72162a5a4a9c8684
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYvSLexL2gyX6WH1Mr3nQzh:rgb4mBIBhGF2SsLUX6WH1aUh
TLSH
T16B65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 74c21b776feba4329f865bc5e33b6905ac93e3d77d8a0d52a4b5584a78773481
MD5 25a182bb3f80bb1137f62a6fdcd28923
SHA1 b805ffb69223b8580f5c0b70dcea84db0863aa0e
SHA512 8a0eb335d3f21b4acb3ab01ede26a7337eb976058d392de832f9bc6e9843c745aee08588658cc479fb9e4ff6482aef003925e1a951624067008b9fb013137cc6
SSDEEP 24576:5G88u8FpJqH1bzria7/mmSLexL2gyX6WH1Mr3nQzh:s7ZFPqVea7/XSsLUX6WH1aUh
TLSH
T1B435016676E101F1D47BD03889864667F6B2B8160360EBDF07AC8A551F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bff8f2cecdd5c59ff4b592f48231b449285e5cbd4777567e9ca50215c444487f
MD5 a768875e21bc00a91862adf083da7620
SHA1 178d295f70b1e9baf22f7bf97fd69ab0899c0fc1
SHA512 cb1ca91edb517eaad0fda9731c2c468d9c9ff60d836bfc492ffc1cb7f24c64c4cfd524abebb565e312482afe7245b31c04786c9261f1ff4c4af6b0f575cfcaab
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6SsLUX6WH1aUh:nG05lO43bgsgKWH
TLSH
T19FD5CF6E62EC11F9D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 76ad84ad4b748ca6f3b43b71d516da3a77e80670daa41ce0daf3afedae991fbe
MD5 db01e5b3b266155715b7f440bd9d127b
SHA1 1a53585d98102b6ae35891bdabd7966a0ac5cd88
SHA512 dd2ad3b7275883aca733530551f9b349b9d938bc506b53921884626a82202ef693f6c45ce95fabb0c45ddf993ad9fc3a4b570eb676b0388e06488af6506ea7e5
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn8SLexL2gyX6WH1Mr3nQzh:Ia5POZ3BJt2pasx2+mSSsLUX6WH1aUh
TLSH
T11365BF5EA6FC00D5D5B9D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 150dbaafbde8136f74a7d95dc0b78cdabb36d2b955ec0350f61ebe0734c1ca1c
MD5 66569f9b6ceac0cd7c562849e0ecf7fd
SHA1 0c247deec44a974732481a1a130e6108dc4eef7d
SHA512 3b8893faa2f0f76be9dd151ef405889e154ea4cab005269f7d4ad873b2d354ce85764cc0de1035e1a14097aca1ac397411c0146cd4d01c3814831862280a090d
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fk+SLexL2gyX6WH1Mr3nQzh:6Nc/zEOVHF3SsLUX6WH1aUh
TLSH
T152858B2623E901E4E5BBE1BE89779546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 79151b006db6870629c36af731e69fab9ab4edf7c7903fa41f22111c2edcfd98
MD5 61da77e5f78452c52727ad520b852cf7
SHA1 b1ca304e0d9c1bc658b85700e3e53708d52a3461
SHA512 38bc36808f080e8533dd28b3c71b6e41c5ede7c165f660efae15675bc247c40b77f6588e51fff43d022c7f1222dd179be2e249672459ca52de256d334980de61
SSDEEP 24576:jTkNvNnaFeYhJNtmZBmISLexL2gyX6WH1Mr3nQzh:jTMwBtOmISsLUX6WH1aUh
TLSH
T12255AF6EBAB805E4D1FEC6B4CD238516FA727851073293CB9290C13E1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 dad56bcf055847103e8a7b68d29d676200b6f8b8ca641255690b6c8a075b13e6
MD5 4de0fde000123e2c0591a07b3d0e01b0
SHA1 d54bb85883a34176abbbeac9d9f75f6db87f2231
SHA512 c71269b9e19e5a703dbe865e7a0e5858efd24e15107252c96c6cfac610dc8ce50f533665979fef2769f37abffd8126cfef52723fb603a51b022a5d8783033d27
SSDEEP 12288:3HvUrBFrEjwaQKSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:3PUr+NQKSLexL2gyX6WH1Mr3nQzh
TLSH
T10A05E16F26E818E5E676E17C8982461DF772B853171292CF02A0817E1E37ED8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 8fa3f2d2461b0465aa01446edcb51a84e83a4c224335906feb1fa9a44d8d3f92
MD5 4077747399787d409b369a3fa7da38ea
SHA1 ab689a38d6767ba440aec5161b438a3db29c6bca
SHA512 d593cad3d42fe1871f4f5d090ca1abb680f6539fef8cbb39af96c54db302b689f140fec1954ae3b16ccb8d114fd2eaf5fb6b9b5c2c1b5f9413c42f355ca52bbb
SSDEEP 24576:PD3FHshBIYQgAhSLexL2gyX6WH1Mr3nQzh:PDVHeBIAAhSsLUX6WH1aUh
TLSH
T12625E17EEAAC04E5D57BC1BCCA634606E77138A9032256CB1294D1B91F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1964-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1964-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1964-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1964-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2268-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-367-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2268-109-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2268-103-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2652-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2652-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2652-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2652-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2652-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2692-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2692-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2692-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2692-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4608-312-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4608-7-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4608-8-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4608-316-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/4608-0-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/4608-78-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/4608-1-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4624-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4624-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4624-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4624-278-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4692-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4692-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4692-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4692-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4692-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4836-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4836-123-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4836-117-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4836-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4880-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4880-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4880-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4880-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4880-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4880-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5004-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5004-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5004-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5004-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5004-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5004-383-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5156-374-0x000001DAFE7F0000-0x000001DAFE86C000-memory.dmp

Download

memory/6024-68-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6024-74-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6024-295-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6024-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6092-80-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/6092-85-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/6092-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6092-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download