d29bb5b68976907100fd974c4278aefa69a18d1f99bdd3be9a5ae591659f5bbc

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample260810-w81e1saa39
SHA256 d29bb5b68976907100fd974c4278aefa69a18d1f99bdd3be9a5ae591659f5bbc
MD5 7142be36072b612033c269b9e0ba64cc
SHA1 aba9501d15da8c68cb40a80dc32f980ce310d63f
SHA512 1ff46fe1c209c1c7bd3e03301667f35117baf8d5bc0e699aa6465878e40903a22817c92b08a550e9cad886de3eee6048fdd5b18450d6dff17231bf58f617299f
SSDEEP 12288:OVgR8oWJiqkoHg9UeLTpoyPcLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:NP5qkoHgyeLTpzvNyBo4kx929bL3Hnx
TLSH
T1B775AD1AA6A843E1C4B6D1388952E53AF9713C96433097DB17D17F2B3F72BE1993A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6464	elevation_service.exe
4220	elevation_service.exe
1972	maintenanceservice.exe
596	OSE.EXE
1888	PerceptionSimulationService.exe
4716	perfhost.exe
5996	ReFsDedupSvc.exe
3292	SensorDataService.exe
5164	ssh-agent.exe
3172	AgentService.exe
4268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\54cc57e5957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001965fb35f728dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057388034f728dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba77dd72f728dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bc37835f728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af73a634f728dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000782ae134f728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000457a5236f728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6464	elevation_service.exe
6464	elevation_service.exe
6464	elevation_service.exe
6464	elevation_service.exe
6464	elevation_service.exe
6464	elevation_service.exe
6464	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3148	2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3172	AgentService.exe
Token: 33	4268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4268	SearchIndexer.exe
Token: SeDebugPrivilege	6464	elevation_service.exe
Token: SeDebugPrivilege	4220	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 2968	4268	SearchIndexer.exe	101
PID 4268 wrote to memory of 1752	4268	SearchIndexer.exe	102
PID 4268 wrote to memory of 2432	4268	SearchIndexer.exe	103
PID 4268 wrote to memory of 5056	4268	SearchIndexer.exe	104
PID 4268 wrote to memory of 1428	4268	SearchIndexer.exe	106
PID 4268 wrote to memory of 1128	4268	SearchIndexer.exe	107
PID 4268 wrote to memory of 6536	4268	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1972

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5164

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2f8986ae76407489eb5a41a6650d2b155864ca650a4e6316763050b3e85d98c8
MD5 e60e0f34421afbf21ca980f667de7696
SHA1 51d976bfa29abcdffa06fe1288f9907a6926bd25
SHA512 54d00befab0b3bb4f467a9f1feb0ef174983bbfccc3444b51769685aebb8f2611a9c36e78950dbb694b349f67e7d2a78e888635ca14481640aeb77f23cc3c44e
SSDEEP 49152:hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTB+kn3Hnx:n3q6sjBi+k
TLSH
T14DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3ae545e8e9e0c4052d9f94055029e8ac55c9c4cb4d4ca002c90740cd96a2bdd3
MD5 33fe23743e6f81d33bfe3317bd268cd2
SHA1 995399a2907474fa94919d3806c7506fcfb41cdc
SHA512 d2907e9e5a3f13d437256dcadc90b00b85868d3450239ef63aa809d03fc8d465eeeed7e7fffc628656394c9e6fdbb2772037ae44a6d92144b447c2bfb316d1e9
SSDEEP 12288:Z1XLsswWkxy2lRq2czACLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:3XYfDtczAJNyBo4kx929bL3Hnx
TLSH
T15165012867D409F9ED6B9278C8A2C511DA33BC4547A0E7DB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 365a6eab30d162a78d26a2fa50a5fedd678d65510d366a69fdec646f15c04463
MD5 7d6c6ba191f5f6c32d7d150cf8d7a1ab
SHA1 b3cb2d58faadd0c7683c0c56031139bdf894184f
SHA512 50ec72e1795ba287115a3e7b0ebc76bca0953f53395fefab41ec919549bb557c6d4a6518e40604ef43741412577f6c7c81f9881bc069dca0fa400818db4f6b69
SSDEEP 12288:0XZNYVLeyUji0h90ZD0wxpGZIVuArHsLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:00Le5ji0hmxfrMINyBo4kx929bL3Hnx
TLSH
T12E859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 33d4a0cb07dd3331ff79e2d02fbf5451e172dc21f782fac823b9b05af2cce967
MD5 0ff5a4dba01ffdd315edb99be5e2d984
SHA1 826e36e3a23cac30318e9f98d086411968d0e0ca
SHA512 f232310bba29ff79736761c0822a687e5d22d0562a8c5e47abe654bd824e2b371183784113b5a47e7337f19620b41ba72b1d869f13b021395d0505703ec40e41
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuiNyBo4kx929bL3Hnx:p/ezSC6vUzPveHjycB+kn3Hnx
TLSH
T19F755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 afe721544ea980a16a9500bc3013bab6cc1bd7264931a0bedd6b29760c5e02ce
MD5 04e33b978e341bb443cbeb9363e9e8b6
SHA1 8c69c1a91dceb0eb61c2e800d00c3d32e93a95fa
SHA512 1b66d17f4f274b26182f1ea79895e4ddcd389ffaa07a29cc97016eae26cd6f8b6d12cba1aa9b9620d1e4b0ed598c7f024e1f9f7e9dcc313d5d9aeca75fec7187
SSDEEP 12288:zVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98uLDAptNyvUgXZ32dT4ePc7N29CD:zVbqPb88hv/l+YdNyBo4kx929bL3Hnx
TLSH
T183559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cd44a1e46e514dc5d9bd00727877f87ccf001b089a55b778f3c3c488ab033988
MD5 f2efca4dbbe6f3b929f57f2801d046a3
SHA1 87191fc419284ccb7d546cb803531d7ba174da81
SHA512 44a35fb4cae18206b3559e57b859ace5f9f1c519a2736360fbbc94ccbe72bd429131207959a6db681a1baf7f25f6c0f788b2fac0551a8e37f9b41b1cfe1c7177
SSDEEP 12288:Um3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UmMNyBo4kx929bL3Hnx
TLSH
T1984523124B0C627AFBBD3E70745E8454CC35BC8D0D95DB98DE62ADBB58BCDA2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4b54104d0f117dda2bc8b8d70445b57aaebe364480c0e7de5258d9913c468743
MD5 07270072cb87b75d9a0a575cb91c783c
SHA1 3454923b0e0f0ce3980a97dc852a9654c2ea3e91
SHA512 63caff33fe139c261c542ebbbd6f28605741370229603af375e267a92111cc2ea8a5bd01134650e74cab7ee3427cce0ed571047dc2ab7f52c4241ba35789b6c7
SSDEEP 12288:0eBNUbTVO86UmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0JIUlNyBo4kx929bL3Hnx
TLSH
T1E265CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 af12fab341ced357a07268595d5c72ecd927d510c65431e3eb1143db892d499c
MD5 6770b815efe506a36f89b7011e3a3bff
SHA1 bc8ce9be0c5ce3e81fed723316c385cf252ada12
SHA512 325bcf0223ca37f3052e2c1acc0bc72da11a91d0913ad3f485ac3e397cd68dcafc7155df723f37000520263ec42f840da05a5afab129c86fa1d63d28742f9084
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH0:CQvGAdlCEL8c/DRNw5CX+k
TLSH
T1F5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9f265022e72d9bc41f38655f083e34bbbd9f3e866f172cacd329d0907434c429
MD5 dde49963c8c0712f66ba4dde9fbdc4fd
SHA1 2c5f39577f5046f81cca23fcc551eab3eeaf05dc
SHA512 b6125ad91bb8c90c4bb5a310b91aed39eea1f52ebea9fb4a8c2c7f5743ad7f8258d041ff8c35f712287eeda2ea32ce1de5ac3b0b56449f0c9133e70da9bdb986
SSDEEP 12288:qAwSfxL/2Dc3XDLLmt0LDQewsAjILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:/OewsAjXNyBo4kx929bL3Hnx
TLSH
T1E875E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 82a900f3bd47df0a36882ea38010f2ee435d45df63d240c975f2beef64fc41d1
MD5 27d1098d94ce2bda47ec5b9d041c2d84
SHA1 00df6ccd532432170747996bca3c9ec7c14d24f6
SHA512 dd5b8dbdd906ab85e768efd50771208f8e07f178f495dcae5e532a87ec3bfc1bfb36ccb9c322e2c8d4b3e92656a391b165cee7cfbcb18f9835709b3b10abbca2
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8+k:8UEtQevvqc2W1cpV2tI328
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fd5b4ad0ab237c33015727654416c3277b6696a7d53e5ae6520ebc5add58a87c
MD5 d5ce708193355515e0a3e1a9fc379129
SHA1 bf9d27c64f49abb42707eeff67851d878a1fbd2e
SHA512 ddf0b5e86dbed5b666c22fd5bb35d366f25f9d06cdb1b9180e8b63ed12b9ab0be79039408aa7e98edf368f6493fc9d812bd92104bab9e559ae02dd708fcd3cd6
SSDEEP 49152:tCbRquA/m2yL5zTfFiV+XenmE3/z4B+kn3Hnx:KoquVjnmz+k
TLSH
T1BFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 84eabc8b684325523c00d5771d7e037e676ba81371d7eee8aa554e2b1c26c40c
MD5 bc754f4549af770643a3b8ccb6c0b7d4
SHA1 7c39b8dd49155b5abbc1056e2b45819b4125d2fc
SHA512 63440182f0578410ab37476ecf9ba066567325accc995a27a1e801e45044c02f61567fabad02ca7d426b08f75ea3b89034c2c84979140f2e2555b17e49ab2824
SSDEEP 24576:OAhGL3IFoiwtA5l7S53uNyBo4kx929bL3Hnx:OAMUFoiq5VB+kn3Hnx
TLSH
T1BF35AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 047aa408fe8d29f8215b18c97a067537a47d194dc0b220c46a93616183de0610
MD5 1213da4b53e854e3aca10f9f03017b7d
SHA1 a48d44063c9ca39a7e3cc46efcf92bf92fc6016e
SHA512 44153e5aec9fe5d72185257f88d88ff005da1b0c44679052f300559c81e2e479c880f3a93173597aaf16cdad150ff6995589e1cca7deb7fbcb6171d134c8a1f1
SSDEEP 12288:Rmw5HEjsChNzBFgl0WDm+CdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Mwu6OWTNyBo4kx929bL3Hnx
TLSH
T19265F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 87d53f4768de267d0f4eb8a141301bc52b369044672de87c2ae12dd5df5e1e9b
MD5 817471f23e38f58fe03ba576514dfbed
SHA1 3d6af5703bb9a341e7d053fc6882e049dd342304
SHA512 044335490d005afaea78becfd6c4c9ad6d7dd891f18427b9fa2b13c4574e66e8928c3085304ac794ea08c9b6d78ba80a08454f80145d51708a89673aa60425f6
SSDEEP 12288:ogZ1Iy4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fZuwNyBo4kx929bL3Hnx
TLSH
T1D0551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 50ab4242630eafaa27f3d35dd6e8a513318e25913c946261ed7d518628ee7b81
MD5 3f3f84c3bbe00b9878e8efc09ac9ec95
SHA1 0dcd52c4d16a18614afa5d88371886e7e123c96c
SHA512 9f1324d05685a9a2dc0cc2ed8cc9af0dfa1d590ad7b402160c172fba0ed0d80b775ecb86d6fec88da987e2f6b7939de3e9c6c6f651d8ca3b246117431589b5ea
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:1QRQyi36YOcPbLvw2gAf+PN32+k
TLSH
T1EE666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0691d4f9bf6c2e8007c01ca14ddae88b2f178a9bf925c887c14b7c415deeaa79
MD5 1c8185b8980c6c1d644538cb1eb2fbd1
SHA1 5d512df3021ab77344c16dac8fb9918f0abfa90c
SHA512 7a59caeb85908a9ee189d8eb140eae696fcf38f6e2e5cd7f18a585fc868667c9d72c03e7578ce017950d33c95dc446414d4f11744414730543be9ce45252ee1e
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:nQRQyi36YOcPbLvw2gAf+PN32+k
TLSH
T183666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4beb4c7c0a25a38c826fd80cafab673183fff863fb907e86c09fffdb4fc0db23
MD5 799f36971d454e31125279b291f89071
SHA1 0122a3c10b10617fe21286932cdf7755bd74e353
SHA512 1c8d32277e572f8f0592b6d5cddc91f4444dfd03b431c4b35c10190d023d54667d9dfa85b041e057d3142790488c37747caa1f966e9a572b9377f2b730055172
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0gNyBo4kx929bL3R:d68Qg55nhceWu7PNU3/oB+kn3Hnx
TLSH
T105B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 761a5607ba1b3d6183893ddd528312becac13068308faf8d0be73b1f672883a3
MD5 2d3fe28587242e0ae3162cebb10ed621
SHA1 5720a300f6c62e2d1bd89dff31b1e3989c111a60
SHA512 922017963dc36c0da332c9959080e42385082ef247e45b2c6488b31828080a27b4dede533dc9120881602fe1eb53dbcf03a02f5fe34423e1584622ebb3dfc4c6
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99h:8y5112gYy5azzVvt69nLKnhZR+k
TLSH
T167167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4e161d8cc125b51888304c3206a6d0a5e19a7f5a5d4b2430d46c82a7162fdb6d
MD5 9a359146446ce194b4e73466731fc0e1
SHA1 e5307acc18c87a065db0af5757352284c5efe3a9
SHA512 61536286bee4a15cdd6ddd7dc8ccdb9f8ee6e74715b2e04907c28cdaeae0753d1ad3447af7fd42c3af661a45a511eeb16c7fcdd12e7842096ecd5763f65692fb
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl+B+kn3Hnx:3u6Jmdxd2de+k
TLSH
T180D59D13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3c988c6295e34db09a71252321699b829d219bc933e42787d3488435ea5c9e72
MD5 048c0a570c2af8a262b1fb6956fe297d
SHA1 33759992c6d79a56c8de1e66b85bc77aefcb5532
SHA512 108787f54662dd2dc004c61384d49b4a8ec81efb6869a538db50b89b2d2d204ad780dc2b9eae53bbe58e97c470b3837f5490451f7b77ed63715fb857b29453ef
SSDEEP 49152:g1hpsNoJpF1A63U44CwH7R4xSB+kn3Hnx:gmifPWRz+k
TLSH
T190B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d87bf4869cc5d3f42b6e0187a90019569ce5d48f2da1d28dddd9d9562ca206c3
MD5 db51dbf30b110ca3d52b9367b04c2fc3
SHA1 4696c616d7315eda81916c3980643729734916a2
SHA512 32ea0d42032e493b26f4b1ead9785d71e5eebfaa00312fda5d798ae21d8c1ed04f69793efed556aceb687aa0cad22b99d1890aa64f4588743348d8b532779b5c
SSDEEP 49152:YSuZQIY0Be2KcRVtOnks6NMHqDB+kn3Hnx:C5dKii61l+k
TLSH
T1D1C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2ffd087aae088dcbee95f3084078e4b613c2d469bee5198a7013374061f43430
MD5 949c580ca8ddc228732d4794d34dfd1c
SHA1 5df00a23680c0fcdbe1a49f37045a137f70962a1
SHA512 3e74d333492b63495ba81dc3a96b9a55e602062ed8c10823e519302b222037b9e9046c1ee9a1c7bb3ef0b292defb91e2823d2d88f3ef352ac6ae07baf0278eb8
SSDEEP 49152:FhtSn8EApI0fig3giDn0AP5wuB+kn3Hnx:0X2imphv+k
TLSH
T10195BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d907b7fb4dacfb01d1459c45db09c5d601da29cb214ab4b0e9a90e3fb24f37f8
MD5 a66b2dcca2d7f10c6ffd9cb0cf3c1221
SHA1 2c14997491450121e73e906ba4edff06a49c4ec5
SHA512 ba973cd155d9d06813bbef8e2637e5642b428029a8cdd232764acf70e2ae27f5be2b819675317e1f07ac6c106dc1b6affbeab1feb6794aeba1f8ac240aef6043
SSDEEP 12288:fPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:f0NyBo4kx929bL3Hnx
TLSH
T1144523025A0C627AF76D3FB0A44A8558CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1d136211e5885895027972b2159d996ca1f7ad71f47b7bd9daa88259228608a3
MD5 e46506852cba416a7d80bb567fd7ade1
SHA1 a593f7d8eaeabf511ce9b45a6184f88ad707316b
SHA512 fe50e544ed5bae59a905c7036d382bfcc29e33e104ea3a1752e157106fb567363d302740f25b0d34ba5b3e95247e688e3203669e490824ec2ae308e8585ab5bb
SSDEEP 12288:0ULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0LNyBo4kx929bL3Hnx
TLSH
T15B4523125A0C627AF66D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 649c143236d70fc5bb6848b8a5be602c722bb3fcb5e72ff96dae7217c4a01894
MD5 15711444f1aa8ff9104b13fb74e1409e
SHA1 0b2ff8ac4f1c861ca2f93f52bed538ff0d60ff72
SHA512 9b516e2c61d0895799e53d04c21f9090e160df9a624a87a0d803d754ff5a9d29a5756bbee9b38f21a0678218e32eafc5925421968c1ed8ad6cbda324e286a1aa
SSDEEP 12288:h+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hNNyBo4kx929bL3Hnx
TLSH
T11C4523125A0C627AF66D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24F20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 936c2dc833b69ea4af6a4afb97df930a89e6e62de86512343b87a44463e9edd3
MD5 8a75cbea0e8a3d5c41e75e0ed2b4c939
SHA1 cc1d41b701c62010654ff9b9607ed9854f62892b
SHA512 d6ae673a68cf73fca3b0e23d98c8fab19067d6fa3bbb69d99de124eb0a746a863ec3687ad9b596031dbce1e2a7b96c7454c9c951f09160a465a53ed6fde45dca
SSDEEP 12288:DVxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oNyBo4kx929bL3Hnx
TLSH
T1BB4523025B5C12BAF97A7BB0D85A8054C835BC8A5F7197DFDF1248BB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9eb078d4b6f82f2c116107875ccc23d577d067f2481638e415e56a566d01cd1a
MD5 b82e32a59cac2980ee8f7b0e1677b886
SHA1 2b214c66788b1d4ba40afdac9f7c7d356a3ea329
SHA512 e5570f7bdaaf96f769fbdacfa7898f5cacf25b3ebcd3247d3c1844745ae1b776af7506c07ee311833da5ed4dd16840b9b44aa8bb39dc255c20a756b76b140148
SSDEEP 12288:OZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OGNyBo4kx929bL3Hnx
TLSH
T1FE4523025A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7f2f480e45e35660fa1c88b3d69e12b895f9716ff41d27f731f8b1fc9c683cb8
MD5 24fc5dae3fb9514c2057edb55d43f94b
SHA1 da0778fb43f21545425f88bc891569a8f8d3c9a1
SHA512 ed8a1a19de019d1e8c17f2137d8683c0406d2c2019d3747c27cfd8fafadf7ea0cc09ca9249812faa9bebbc40e7d1a058f49db04239b0d9588d6f258c0af2039d
SSDEEP 12288:pgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pfNyBo4kx929bL3Hnx
TLSH
T1884523125A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b32dfa36a5762947baa6b34c1c885544e118bfa3669362fbddf1e9e01b8ba82c
MD5 3a2e8f07b94619943b72ab0776a2019f
SHA1 b2c8c979d53e0a9d8e14ce38d60213122ceaae1e
SHA512 6d22297d6148420072642c95bf9180013fc5a7633cfa32c43f872f1f1f45d24038cf04a614254221d302a816ff65c024ce2f467e20d0857ddc1b0b71172b8a29
SSDEEP 12288:scLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sDNyBo4kx929bL3Hnx
TLSH
T1534523129A0C623AF76D3FB065498498CC34BC8F1E9593D8EF27987759FCEA25E20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1439ec98a9febc2d28bf91f09a2693ca9ae642a7d7d9e39b9e5d7eef6d808dfd
MD5 90b0eb5fc7be227072dca5583f9a80f1
SHA1 555d7a30bc3de34b7bc915f00c328ecf23953f8e
SHA512 070c0777ef2b3ef704e1119541af33510871ca0e706c3ca4359bad2c24b538f2a4648e9064d3f39558b93cf99c6e23d3a6dfad0e64f5b594cd9b192c8f5b0475
SSDEEP 12288:YiZwbjzzFEoS2cPvy0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:bZMXzFVSOrNyBo4kx929bL3Hnx
TLSH
T153650195B39418F8EC67823DC8158906D6B2BC4A0BA0C65F07B4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 44675e37edf6609e0663d60b69c2989768cf2eb1229511c633a02d13546f9824
MD5 840b3cc6eb2217cfd6e78a80f74d9b47
SHA1 c483ee601746afd32bea832d0969b7e8368dc786
SHA512 239651573f5aab109c9c13269ed617ca794841adbb662d7172e0ad664128f9ace596289bbef5f1f8e46c9ba23fa2345d19874b2a1c53a726f9211cbde392c0e6
SSDEEP 12288:zTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zANyBo4kx929bL3Hnx
TLSH
T17A4523025A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24F20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fb64cd9579d1b85a6eac72d7ca9440bc654d102135b74beea1a61873c3b11e04
MD5 626a6caaac6ad98bc5dadab3fd7d5c9c
SHA1 59eaa3e4f89d457883c5029528e3545a5e00b46a
SHA512 e2decbf9c661e16689bf6fa8ea092a6a8500f4ba519903895d9ca075efa4b68844f04955f775ab28b408763f4a366eec3f1d3d7dbf37e85a8dd5fd93cd96847e
SSDEEP 12288:fnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fcNyBo4kx929bL3Hnx
TLSH
T1244523125A0C627AF76D3EB0654A8498CC34BC8F1E9593D8EF27987B59FCEA25B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2bdb01ac6f4d45e5d96e790ac9ff9e60a4a79723fcdba2b37fb0ada38cbd83f0
MD5 b31dccf0357b46112136edaba4d49283
SHA1 21eeb0633a851356b088bbeb37975b563ccf8a0f
SHA512 f03894bfc74d215ea70671e0d66b5c85b266f7121caa1234b5ccde68542a1678bfdc225009cb5b662286702d8a4a2b2d838bc8e145d09a5c7d609ec455aa64ae
SSDEEP 12288:/yPz5L84LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yzynNyBo4kx929bL3Hnx
TLSH
T16E55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 46458dd6ca4bc15181836a6e2d831e71c7355b9827c9b852bea1e4b0263f8595
MD5 ccc5652e88e629b2347c3942a55c05fc
SHA1 0c1a419b1b0faa5bf97e306474a54aa3e050a3c1
SHA512 d39dde5f76fc36630bb1a64a600cd1ba93d231a80b5f42eb488c564f05c41e1de12ba29e3ecfcf5ea6e17f5187e18778fc927cca80ddb5cacb60836b186cf2cc
SSDEEP 12288:kTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kANyBo4kx929bL3Hnx
TLSH
T1724523025A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b3e84d1215dc62798c018d6c522de93098efb4ab8dbe50ed0f12bf635841e2c3
MD5 dfccd78d7b70e9c28cba902887c26a55
SHA1 f1ab92d2386264a3146ec0377b3c9bedc0b6a559
SHA512 fd95ee974a41974dfc7a47b4ff99b59bba829f68f5cabc9a3b2fbeeb371cb07b74fff66ba4b8c53ab3f7ba35661646633e8c2e3bbabc67c92b42335d0d082f9f
SSDEEP 12288:dTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:dANyBo4kx929bL3Hnx
TLSH
T1CA4523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7c48979a486243b81471abce4f28808d77b44bf39d4751d94ec19f52f8ceffc2
MD5 b2baac28440a52422bdc3535b20d1e51
SHA1 f01d427c44ee379c4f3108c9e411df2f57e90d5a
SHA512 3a3e4ce02b298e7d70e5e80860f33dfc74248a1fe31ae91ce17ed83755b9574368c5539f95fb756299d613e0c8632ce4fa6d58d97c1daa6148a63f8309bacfb5
SSDEEP 12288:ayPz5L84LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HzynNyBo4kx929bL3Hnx
TLSH
T19655120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 83d8e0e4acea429fa259d0735a98a7f1902eaefa138931ff4cf9b52771db5ae6
MD5 98e832326fa4a0e2e56e77e3464a0c9b
SHA1 5e6529b9de456efd209d1e636e9136746fa2a91f
SHA512 bed35029580352ea883eb1eb2759b2f8717a221b4215a355e85e6fe1f46a2119298b6ce2db0121267ccf4ee7ad8f01e3f593721aa9d5503354d408a8cd2dd1dd
SSDEEP 12288:ACd98WYoaLHF3z0z04PDvhOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:ZTtaLl3z0zD9NyBo4kx929bL3Hnx
TLSH
T1C76501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 108260959711042448178efa51e133861d2c438b3c0c3fba1e2811248d0f1977
MD5 67fb1f05cb9798de7751c72cba4af148
SHA1 c3acbb0667adf4798a1ae026347b536e155c39cb
SHA512 2ddbb7b2818ba128a21b6b67dc028d9db38dafd095e6838e169a2b5a34d233c84eec44c837798db24b5f05ea93778542718f4583432119db5c6453ae9b0d070a
SSDEEP 12288:/i4e7ARdTfgwCHKy7GLbbdIvlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:/3ld9CHKy7GZxNyBo4kx929bL3Hnx
TLSH
T1F675CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cf530d23810f8ed530789b2f1b8f557b3a9495906305b7cad2a17b6818700d9e
MD5 18a192bf3b202b2b9b06e5b7744d9191
SHA1 390ac1df836e24611cb5aeffac88468f523f159c
SHA512 0e797b35789c4ec517d49c8ee37e45752a56cf166148184f1d4d3ff8f691353b8610970d9e2843ecf89869d75c4db576965cb27e4acf97c50d6646176cb00319
SSDEEP 12288:AeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AtNyBo4kx929bL3Hnx
TLSH
T150452312590C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5cec1c561cc6ddffeb3da6a75886a191bd4b76a583b53efc9911f2db422d81fd
MD5 6eaf954bb2ef01c906080af582bd8c13
SHA1 1f8a0f3c06f7bd06e00052d68c536319d66c16d9
SHA512 8a2dfa70ef1235e2cdb276de2aa35e61299dc27949a68b4311e4f33ca14bb506f74d00f6803a7de18933cbbae371f1b700d2cba0f08c9322fe4719291fb959d6
SSDEEP 12288:VYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VHNyBo4kx929bL3Hnx
TLSH
T1C74523125A0C627AF66D3FB0644A8558CC34BC8F1EA597D8EF279C7759FCEA24A20103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5eddf1467be3413b24868e2aa64933fe14479f513c457c1c23691c4b4a47ecb2
MD5 265524f0a7d2422831d7fcb25d329be6
SHA1 ea22901e76df2979803b80b2883ecaad5dd6a6a0
SHA512 ddbf4e6ad6082254eb248701ae8391a185557f2d40c9c1716843dbfc580ba2471ad2cf79ff952676ea9df05516b3dbb43afbae2e428219f12211de43a3619ad5
SSDEEP 12288:ulLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:u6NyBo4kx929bL3Hnx
TLSH
T1E84523125A0C627AF76C3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c0d0e175c6cff51ad935d94f1fd77f45d5eb798e32e36bcad855e29071e47073
MD5 0dc920a2a58f0288b8b1f8bdfcfcafb9
SHA1 5f4caf513e375448bbe851874cc2f8752862a274
SHA512 028378bf4fb62bfead1238b6eee41331b9c013356b0af315487af5af90d686f8eed5c9f0d615a29ed9e5ac879b887a1d997dd0ee4ce4882e219540902c3aa614
SSDEEP 12288:lTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lANyBo4kx929bL3Hnx
TLSH
T1B74523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b79ec122a746d96cdec57e0427ba4b1c7b020ca5f8527640035e826a1c852d2f
MD5 2667a8a58e1c75b31979bf465a9ddcd7
SHA1 f912427cf8ef3b992144c280340aed6b87cb275a
SHA512 0c4ad2538a795b871c56848a8b9f68cc3a559d6144507f3dc5d1063d6c568cb859c3860e1f2c5487afcc17d1a55092a244b84827fa4ab4c75f25bc351d7efdec
SSDEEP 12288:FeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FtNyBo4kx929bL3Hnx
TLSH
T11F4523125A0C627AF66C3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24F20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 86c7f8351d2e73bcab941ea23e4238a2014ed700914e6e6dcbc4ba7a838fc892
MD5 571396e85bd18a62ee3efcf77f089017
SHA1 4235f046047cadeb8bf3baa283bbcac5654d17f7
SHA512 6e6b2ddaa681dd216f90c4eb84105de178b94ceeb2b6ad414872e155a774f400741aec930e6b31e8fcf41ef9b1b5d620db11cd85d58412677aa988b4afa4bccd
SSDEEP 12288:ZbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Z4NyBo4kx929bL3Hnx
TLSH
T12D4523125A0C227AF76D3FB0654A8558CC34BC8F1E9697D8EF27987B59FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 feee2274ae85d1a35f58215e015a2f28fa9e0ad7933fb903d5f9cc671526a340
MD5 68d582bd23449a10e44aa83fd3a749d0
SHA1 c3898f432a832a3daebde51c03869ea2482b3c6e
SHA512 2bee50c8f854eb34212cb186102b6152231e743bd48cbd82dde3d415ba39958fd02353372c4cfff7ba7707ba6b86e87a2d3b65a572eedd5be4a82205570c9e0c
SSDEEP 12288:tZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tGNyBo4kx929bL3Hnx
TLSH
T1894523025A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 237c85efe951542d5a04c4b95f67655bb8f80872b489f3b1e56bdf9517a59e0a
MD5 1821a9f833c0c64f79b2ad6d7e95a961
SHA1 f3b36b230d2deeabbecc7615437b98f2a915ffa5
SHA512 f970280df3a5cdf90e0594b962c331039d5776a47565155bee80baf0d902e10b04aedf88154cfc70e4b8b314d9c59e4ee7b0fc43ad2df23e5b3e59126cd63c0c
SSDEEP 12288:yWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:y1NyBo4kx929bL3Hnx
TLSH
T1AC4523125A0C227AF76D3FB0654A8594CC34BC8F1E9697D8EF27987B59BCEA34B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 a97c2e67f27afe8f86abd9615915f2b2c15582419af0ad35e1b26cd580fe40e9
MD5 31537aaa66f8b03df74bc2ece64d509e
SHA1 6c25c32ed089073dcc8d9b92eb2316966cf3f5e8
SHA512 a974d1fadd576d00c81491bd9f526fca50e714cb280e946594b51697419e91811f9942b93efab1de10d50e1d145992a329285df1b460cdd695826fc4d7c6b7a7
SSDEEP 12288:YZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YGNyBo4kx929bL3Hnx
TLSH
T1054523025A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 30c7c13dffb307d7e7130c1528bd47a5cb3c50bd66b376b955fafee7cd5eb24e
MD5 fb2b08ad2207add2545b9e59bb7f7be8
SHA1 819ed7f47cebcccc7a96a2b406b9155b1dba3f95
SHA512 cb8c0fa4870773b7c8db970c4fc9172db5a42926b69a838b53359c93b2b0f865b576e49cac321259cdf44eeca91e314314d0cf39f635b00bf5209acb18b9eadd
SSDEEP 24576:rfwvqk9RX6wkyAIsNyBo4kx929bL3Hnx:vMnYI3B+kn3Hnx
TLSH
T11C85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7b34ba698e8758dfbfe51bbb3f9613ec8acf43769824841da1214a8c07b210f4
MD5 a2bd798df2cb7519cd8f62d640a45aed
SHA1 bd6503f94c155784c3f4e6f05f48303e9788d4dc
SHA512 61ff0801083fdd88d4a4c89e992328bace467137ca34fed45ef586ad2ba00f66e0f187b975c64ff04721e108314f5eb7cb200a4d364351c59fa5132e296522b6
SSDEEP 49152:8YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OB+kn3Hnx:7ySzPW+k
TLSH
T11A066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f8efa8ec0420f3d07bc47c38fff70f46545c5f2cb88dace804ad5aeb343f183c
MD5 b8ca088fe29090336b632789fce2e487
SHA1 2528bf06b19af00bc85c1881fb671f473f1349e2
SHA512 c82758671e59ec2a5e4a0e9b1c6b6f13ba299b0fb5213c3ef17150fb5979e1c8d01fead11313d49c34972e6f22965e6d8eb2929bc9dea8a52517f949974e2442
SSDEEP 24576:N47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY7NyBo4kx929bL3Hnx:N47JUQjTirIhCnDHUPfF/+B+kn3Hnx
TLSH
T1FF65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1945afd3f129c7caef32ce6501756c4a6c484483da2a5cefff2f75f5b347bd97
MD5 961974607b6fed162c195dc86b01b903
SHA1 1a5b36b7c4d4b7629e873e744fb0803f0e586bbc
SHA512 575b1a5ee5e1d84d782d36e241d9292568f2d68e146c2186b9cae02802b41e45da55312fb33b86360179bf18b468a0a946f43ad34fe60b762c7228b8437122fa
SSDEEP 12288:7psfjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EwNyBo4kx929bL3Hnx
TLSH
T12755F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 19b5516d85502d5082e5f86576e4e599e7499cbcccc021fca3e6fbdd23aad171
MD5 089f3191364fc4ffc153fb99f7f196a9
SHA1 8a139308b744c086c4add055276e43ae60b66f2d
SHA512 2621bf6c0d6c2b061d37b3313230d8a77a6525b2411ed6402967136f394882c776fa2a68dcbd2e6a72e8162a52b57c5b7a459316feb33daf8d2aa074f5b94887
SSDEEP 12288:3ABnyU3f5hyUJg3JLHUJqvwEAFp31YjTsewKCJ:3ARyUPifiJqSx1YHjkJ
TLSH
T1DF350750766AC74FC6A940325E32D2CCA7707D01EE456F0773C99B3FC576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7ba00719f279d8c50139a9b5b8369c431661e204c2276942d543f65a6d63a14f
MD5 ad665b472fee1d6227f98bb919468643
SHA1 b66da8acfdf3ff40fbb985875a078b7a7df2ffaf
SHA512 9e72da5e6ef25ba6057c8e9f65e6da60f152026087da22773e5ac8cd8cd376f2969255911c3f218489abb3e5d35ac4f520b9818322218d8f024e9d8837ef5f83
SSDEEP 12288:oS8j2r+Q4lpduqgS37Jojo55p9SlFb/mgj03DNvX5/:d+Q4lpdu1s1NvJ/
TLSH
T1A875F9815537E2CFC1F7603207269B8CB7A4EC1777496F267388447AD86BB25A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dc0560e204111301639ecd6ea280e257713750afaac5e7d2b8a16b48bc9e8d06
MD5 d47af4c62a4f0d3963525bf44145f78e
SHA1 dfeb8c9906335fc645e08a14fdf8d79c6a81ce39
SHA512 1b5113b227e99b6370fb9b1d7400dabc35c2e92bca4c67adffd130346ba65cfd27f54550aa1cb3c18ce5fbe3761011327cefc42edaf36cd69a4655f6b66e1e32
SSDEEP 12288:gy7rLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3oNyBo4kx929bL3Hnx
TLSH
T1AA452312974C663AFA7D3AB0645EC124C839BC4D0F50D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0cacda5ff4c2fffc8b9d3d2afbae457463870c2ebf6717b58dfe00770212262d
MD5 f419085444e26f7d99d5ae3051e2c839
SHA1 b87dd021cdf6ea8ea85fc6f644d7bf3ea995e394
SHA512 bd43b920215863abbe2d1057ae80a519b76b25981875fa770423dad7a560d43f99f5445f6ac386110857227d5132c9d094ed42873be2814a18dd2632b5f8b995
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYiNyBo4kx929bL3Hnx:Ygb4mBIBhGFUB+kn3Hnx
TLSH
T1AE65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5b5eba3bad0e52706a5a83b0c9da0926e092294bf0c4c1e49a1401da6d26d0d2
MD5 c7ed5a59666ad84546cfd767434c9a37
SHA1 f92660322c316adf69422bfc463552f08b25ed77
SHA512 f3d8e3871fc65b6c9720ed60d741df94ef8fe28c81d009352cb37fc2ddb8dad7f2f802c2766f4ae95679ab81e84ccf1f7be5f46a9f53379e2524a6f73e25ea04
SSDEEP 24576:yG88u8FpJqH1Jzria7/mrNyBo4kx929bL3Hnx:p7ZFPqVAa7/JB+kn3Hnx
TLSH
T14C85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9af66921164299e914cbf53f0aefc6abf89370785560cece4f9f0671f6094e49
MD5 9620c0c2d50a65d235bad0a80fb7877c
SHA1 2ef6a986f3a07c7141116edb59c6aeae6d9d7705
SHA512 d2f085104a68d0be805c4f5b77f50fe78908b47b563a313f5526c0db2dde1a7e3316fcb3f16e6dbc04a7c008419cfb46276b69cdef3c7af8e3e6336540c2dc28
SSDEEP 12288:5HvUrBFrEjwaQQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5PUr+NQvNyBo4kx929bL3Hnx
TLSH
T1F965F11F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4336bf2f76606805d4f5f45f231ab618fe8ea7a2b9af13da9e995aa657b99285
MD5 b3c270687c343b246153b8edfa547491
SHA1 ca17630d3cb24e258a792fe54c0ee4aba4f20737
SHA512 62e9aa8f7606260dc6f333f70b2ee25eb582b30e116b3994644fab0cbd75b33ce7e6cfd250321cf6cfdd29c53babf535a5fd4d569a8b70526b35a1756afdca49
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwB+kn3Hnx:YG05lO43bp+k
TLSH
T1BAD5C06A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 930a44bb3e9e5afea91c9a5e1f30ee5237d855674cf72c50b03308ca147df563
MD5 01577e7add884d4e67a4432b75d5bda3
SHA1 000fd131489a11617a582284757763a1f25a7728
SHA512 b1573da449819e6c2f66a49dc2806b6e201fcd2628355cdd51e97ad3e08fc9d3c1fdf381282b27792d77fe2460b0eb7f7499a176982a2153e3303c50f3eb29c7
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnpNyBo4kx929bL3Hnx:8a5POZ3BJt2pasx2+moB+kn3Hnx
TLSH
T17C65AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ffd10e3403474837c44b6f0a24c629cdee6a5d4a0d9a6d025b2fc200de60531f
MD5 5893df6dbbe872e3584a87e6bac0296a
SHA1 efab8c34be5ed726cfeb64b0c8aa05552bf7d149
SHA512 525a46fd7d3adf06b832950431539d17f4bbace113cab9e21f6c732bfb6c075efb64d66be604691edbab2d4d02df4321eb9168ae8b0e669c973473655eb70f07
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkzNyBo4kx929bL3Hnx:sNc/zEOVHFpB+kn3Hnx
TLSH
T1D2858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b2237a838e900b3197b13a73d5983bd66f79fadd86dfd4b872fb6f1735385950
MD5 da7cd993462dbc1862674eb8e93aa100
SHA1 26c698bd4a2a0fb973bbaa7d96142952c2348fdc
SHA512 8935c57029db4b9f6720842b05d939425671280fa47ded512fbffc4b4486151e81c90d77df5100fc86e34c4ba06d8a61befa36433503701eae82928566fbcde8
SSDEEP 24576:XTkNvNnaFeYhJNtmZBm1NyBo4kx929bL3Hnx:XTMwBtOmiB+kn3Hnx
TLSH
T1CA55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9cdf7a78f519c607d6484572296fdfa4d2a7d90b964862ed89c6df2d4a03b651
MD5 b067a0e00031c636e19ad5258772634e
SHA1 a713e1fe33356d834660b8548f3ac019f782b5c8
SHA512 27b2df80842dbddfd17aaee487ae1f7d70b0d068e6fc93e8124047130bcb259b7dd78017a7c21833119ef95f96bf5bd885d7a0a59f1bb48ea9ced50485500ac5
SSDEEP 12288:gQcMxWDXN1Dp/fshBItT1IQgAvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:yD3FHshBIYQgAUNyBo4kx929bL3Hnx
TLSH
T1FA75E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/596-54-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/596-57-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/596-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/596-275-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1888-341-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1888-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1888-65-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1888-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1972-52-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1972-45-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1972-50-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/1972-46-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/1972-39-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3148-7-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3148-80-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/3148-0-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/3148-288-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3148-293-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/3148-2-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3172-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-125-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3172-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3172-119-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3292-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3292-345-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3292-93-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3292-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3292-342-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4220-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4220-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4220-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4268-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4268-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4268-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4268-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4716-344-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4716-77-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5164-360-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5164-107-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5164-115-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5164-113-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5996-359-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-372-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-81-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6464-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6464-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6464-23-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/6464-15-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download