c5ebd9d40219886248d8ec3fdea59dadc47812439a600a99626f57bf25857223

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample260811-lbpl5sbm8s
SHA256 c5ebd9d40219886248d8ec3fdea59dadc47812439a600a99626f57bf25857223
MD5 df56836d0dffd2016e1b761dfd1f8f73
SHA1 e39f49cef7639968115c95e8b2007a591c10df85
SHA512 13c93b5500978182f1c168c747a0e825aed0185bd3ecd51e8770e2856dab4868e987b4fb364e2eebd14a27fc842115eb00ba77ba6ac2a1ea77eedad6d660dfdf
SSDEEP 12288:LVgR8oWJiqkoHg9UeLTpoyPccLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:OP5qkoHgyeLTpz4NyBo4kx929bL3Hnx
TLSH
T13F75AD1AA6A843E1C0BAD1388952E53AF9713C56433097DB17D17F2B3F72BE1993A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
940	elevation_service.exe
2188	elevation_service.exe
1512	maintenanceservice.exe
4600	OSE.EXE
1792	PerceptionSimulationService.exe
2552	perfhost.exe
5700	ReFsDedupSvc.exe
6124	SensorDataService.exe
1152	ssh-agent.exe
480	AgentService.exe
3944	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\46d1e50bb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009423e1e47229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036ac9f217329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cefa2de37229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce7f85e27229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000881b4e27229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000610f02e57229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1576	2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	480	AgentService.exe
Token: 33	3944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3944	SearchIndexer.exe
Token: SeDebugPrivilege	940	elevation_service.exe
Token: SeDebugPrivilege	2188	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4764	3944	SearchIndexer.exe	100
PID 3944 wrote to memory of 4404	3944	SearchIndexer.exe	101
PID 3944 wrote to memory of 4528	3944	SearchIndexer.exe	102
PID 3944 wrote to memory of 4260	3944	SearchIndexer.exe	103
PID 3944 wrote to memory of 5956	3944	SearchIndexer.exe	105
PID 3944 wrote to memory of 5732	3944	SearchIndexer.exe	106
PID 3944 wrote to memory of 2428	3944	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_df56836d0dffd2016e1b761dfd1f8f73_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1512

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 1584 1568 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 1612 1772 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 1612 1772 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 1584 1568 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9836e48238f9d761fd38a9a761e09ba950c41e7532a0d3be85ad77f1d1479c3d
MD5 a06e493a0007193709b30657ea776654
SHA1 4d91b8a417215e58e098b8b1535882855400e116
SHA512 9d7e24203927f9d90216b3a81b8bfc7ba32b162778fdaf7804f62633ba2ae408f40c37c6391c329422c812b65e187c52a77689f31113f07e3089010eacaa8580
SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEB+kn3Hnx:w3q6sjBb+k
TLSH
T101D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d12e2bde14ba465c71695427c070c85816b392a1579d39ed6421e0c80a66af73
MD5 16a8b3fd7cc1290144ac732188666d66
SHA1 1de9584b8a5b0fde23f9afa615d76073e559af8f
SHA512 8066fdb5b9781aa5f20def0b68f6519ba3d054ca788b410a4dc0694147348b18a49890ddbc2bb4d36dfed243105c83f2ba6c2f25f0a04e1b7eb321e9031209aa
SSDEEP 12288:d1XLsswWkxy2lRq2czA1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:TXYfDtczAqNyBo4kx929bL3Hnx
TLSH
T13C65012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f0513c80b3a0b99bca89164ed1a5dc5f5ee41b5e02fdd28f0ac4ed58dd2f7521
MD5 9b6adbb7fa446fe1f2774192a3b9dc2f
SHA1 d18ad0da14a260fb9991c74a3ed734290de0e060
SHA512 b8bc08212624d54a6817ec2ea2355f1dcb3857a4f5cd2e67214debeaaadfd9f7e53a0c734b79410f8277eeb8678390dcd8d41a9e59c77da2bff923811d35de82
SSDEEP 12288:YXZNYVLeyUji0h90ZD0wxpGZIVuArHs8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:o0Le5ji0hmxfrMjNyBo4kx929bL3Hnx
TLSH
T1A3859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 64bed7c982ed9c72dc26de1a23474ccaf923c7367078aba87c6af03b938439cd
MD5 f84b68c26ee2bfbfd34627c05b5b9512
SHA1 5f42928a925a2bfb712fc582dd6f2bd539ff05f7
SHA512 16a22e0faa0ceac0d10783d45f04c6578ecbe636c0e957187cda42b2f8208ad267ce9a46e4aa5fd6c8ebd965ac44d9ca0d89caca8f072ea318fcab2ec17144dc
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWn6q8wyuxNyBo4kx929bL3Hnx:1/ezSC6vUzPveHjyLB+kn3Hnx
TLSH
T1C3755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9c2e43b712c2debca70f5a1987cf9ddea558f767350be79930aea421a9b328b3
MD5 adc91a69b72e48ce8fc01a2ebdc2a02d
SHA1 bbc7229bbf0e4d11d5aeceb6a272105dff1a4de2
SHA512 6a53293e0b984babe969bd802d52b41cd6496e5b737542e6d95a875704a0d9f467e244b0a8890d20b001b3ef791ab8b0880fbb73ae8c16e0b98ab5245aca312a
SSDEEP 12288:GVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im985LDAptNyvUgXZ32dT4ePc7N29CD:GVbqPb88hv/l+YmNyBo4kx929bL3Hnx
TLSH
T161559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7f82ccd54c2a03fffe584b610b155bde1a9ca1abc66a956db1253877643af654
MD5 5d7921f65d9a35c689ab537be43933f1
SHA1 34f6513dbfe8e94942a2d8c00f78c2e2c710101b
SHA512 fcd96434e2e34e7afad8f96c9a670ed74b83cba61860a22f0b2a84cdc2e7ce13a34f6023ddf39992df06e5d76ed33c623f0c77cb5e564c40bd54c75250d6b379
SSDEEP 12288:GmwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GmPNyBo4kx929bL3Hnx
TLSH
T1DE4523124B0C627AFBBD3E70759E8454CC35BC8D0D95DB94DE62ACBB48BCDA2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ed3f8fc80bcb69af5bd850cddb007820b8589b8625b04a9e8ea5e994afe591a9
MD5 61ec0a0ca1c468fbc10016321b88b4d9
SHA1 3dd74830905c4398fa3e25f5560156a697381c01
SHA512 4871243ba3efb1e7b1390627f68bc114ada7322be28bdd05afc068502289a1aaeb9ace5bdfc81a43afb9df48028a8fa3a4ad50c72ceedbfbcb4a9c4040e0c00f
SSDEEP 12288:reBNUbTVO86UhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rJIUeNyBo4kx929bL3Hnx
TLSH
T1BA65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bec54a5c32934bc29c5a862dcdc4dafb8cee4416315c3ea1ba4b64e4255cd784
MD5 1ccf03d164f4731195aad1a4c7e4c228
SHA1 56951e2fa155be973f42c61c13d17fbc5d31741a
SHA512 768ea70767ad291fb224aea69f065e31989364149cd12acc3a029abec89a91f598507d9d3b3b4a8bccdc5653203751b04fe1039c28e5aef66ea4112df933c3ca
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:rQvGAdlCEL8c/DRNw5Cm+k
TLSH
T11F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 08d579a192ad41b004321666b9c8952486aaf454116c77556366e8541bf128ab
MD5 12214bf41251646dda3a2335ec0f069a
SHA1 20b48feaa46b756e82e12fa32ff2f06c0be26ea8
SHA512 160e43f2257505ae8541da2bad19a3fefd6e52cfeb89c847167a53abc7ff069b40e96d63b1be59833acb6fd6a3696ccb15fbdece6989020afaa4fe9a10d3d2f0
SSDEEP 12288:7AwSfxL/2Dc3XDLLmt0LDQewsAjvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:kOewsAjUNyBo4kx929bL3Hnx
TLSH
T1EB75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 372b02bbc6ab01115d03172c8e246d86bbd5a7d7bc3bcbdfd50961c9d6b77759
MD5 b5501f4a3050b89564b844a1d6ebcb66
SHA1 c1923e94a729a7164f1e54d3cff4e912b2766c0d
SHA512 5a09506ad01beb4073034426dc40fcc47c79c560526d397ab37b4193027dec90516faa3fc0ef109fcfb1638d89c7d947345194e4a69f8a5996cb178847d06ae1
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHB+k:5UEtQevvqc2W1cpV2tI32B
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7754202a80610225bd2aee49d84b8b7e9173dec6dc77e737a49c29087b1b1e3d
MD5 18f40a8056d0828ae9439bd0cc9c9a4a
SHA1 5ca7dd60cd8df06f9a1b2384c7c35cacf1290268
SHA512 3b806678bb2c3b32981010575dd720f919c3a1394fceef4e0806c53477953f3629a9597daba98a7e013c6486e7592df935a8831ef943fc6701e78b231952d370
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zPB+kn3Hnx:joquVjnmq+k
TLSH
T1C9D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3f7168ecb5bd0a37c1274935550dff9a3018f01b9dd9d6f5cdab4893ddff5493
MD5 98f02141d8020a20b2874b1a71467675
SHA1 cb164805dd8522edbcc12f38c33657a691743eed
SHA512 f98c867901d9895f959e077feb42c090600fee2c5e902c151bc28a612ba8e53d62b74f48b1cf4df3c59256068d77eb98baa8494da04fd759760645d92596f581
SSDEEP 24576:cAhGL3IFoiwtA5l7S53VNyBo4kx929bL3Hnx:cAMUFoiq5SB+kn3Hnx
TLSH
T1B0359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d424927f1a153da2b7d4eef51ccac4ac3bd7d20cc08d2b168c3d3e6b21f87486
MD5 4ac60d1eaaaca85d6127544f14a0743a
SHA1 9f338cb20665f4772aaeb8a978252650141c707e
SHA512 56d5ff07cbc0fbb483146e043d93a68973495423e84e7f16f95ad256534a80abe057b63581cd11b6ab0f90ee3e592220564430aa7cd667547a1e489e5a4c2c36
SSDEEP 12288:hmw5HEjsChNzBFgl0WDm+C6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:8wu6OWINyBo4kx929bL3Hnx
TLSH
T13865010677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d404268ec4539b350eafa450c2b39bc87dc7d46d727d9bd585864d0f2d8f807d
MD5 159b630b786ddb8091b0ff09b48fd374
SHA1 f3070d6dbeda9e7d2af6df78910a015fe1ed3a50
SHA512 4b583552f5d3bd1c120e9c16c3e5c41e8e1ec2ed8644366864c63a017053704e268851c4d3921623f0cfcf0ecea35ec3cee3bef73954b954ea7549a6759d39b8
SSDEEP 12288:VgZ1IyfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+ZubNyBo4kx929bL3Hnx
TLSH
T18F551216239831F9F2AB2678D8E58505CB32BC461B7283CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 df1e3e3a6849320f6ff90ee720966592f2d1ca1dae3fb01948c662e744c57eec
MD5 1581bba2e89dc5e97de71ca73931eda8
SHA1 1de25c788d45a583ecff712e82b6ed6d4ef8f7ad
SHA512 d78b3e52b7534142556d775fa542bbe3e49cd021f6b7e675cefc5ae0976ca0ef982068400d8e19e92b9ecf21b6a60719b67a2d22e6d07346ae079d01d1051e76
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UX:ZQRQyi36YOcPbLvw2gAf+PN3n+k
TLSH
T18A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f487d76452f3f51214da118837a2bad6ffbdc86540223b5e6653b42f200d994
MD5 2f6db4886ab378f5a3faed0530a27690
SHA1 cbafc0deefe01ea009cd88d3ce35be9015fc1b97
SHA512 a1c15ab00c8ef54bc18aa3b16d1320c35649c903c9bb775f4584217c4eb9f5518399b5377a79c2e083643b9c307b583b51c97c2750bbcace15ade70f0e5ade94
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UX:jQRQyi36YOcPbLvw2gAf+PN3n+k
TLSH
T1A1666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5aa2e4631baa857806fd8185f4d0afd21a2a8027f6e5bc181d31b61a352e1767
MD5 650c8b6473fa1f6f882754edd351163d
SHA1 a93644a32871917543ae5dd71704c1fe24101531
SHA512 c430b4233b3efcd2495c47a9d8aaae0cc29b27fd51bcdb0ea3b6807642c459b8af8d21e86afecf0cd9d8cc9eb8ac17b0e2d00a522533a5380bd7c14c4d949f4f
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0LNyBo4kx929bL3R:y68Qg55nhceWu7PNU3//B+kn3Hnx
TLSH
T1AFB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9d22c6fb8cb0e3465573fa39d8e71b752af2bb3c59419816e7325add7f7c01b4
MD5 2bff0ec2ef558ad0c981745e7a3dbd67
SHA1 2cc8bdf426ddf43cc861f8489e53bec0d74294c8
SHA512 27e2fc64d07edf5e2bd4df23306abd280e99136cd7e52460a89f12c66f7aa551430a3357088be92e970b265c68129269880c9b71964cafeaf3aaa167efa73e3e
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99d:gy5112gYy5azzVvt69nLKnhZ8+k
TLSH
T163167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4bdc24807fd0961d1bf712122c552267cb81ea25ba462f90694bca33f29967d1
MD5 26b86def8ec26081ac400f4ca0eaa4f4
SHA1 c367b51c1ce0bf97655d198806e26a10b635e41f
SHA512 fa4b2e8edb26cd7bb45d0a7dcc401a550ed08e61b3dd43f10f7b2d841a7a3a7553224042d9ccaff00639b5c2b128b38c540f61e62ef0ebce0b838edf78068322
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJB+kn3Hnx:Cu6Jmdxd2df+k
TLSH
T131D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4d0445af1bb66c11fc99245e350e0fb942a109e650892bfca128cca1711c31c4
MD5 99b52ae68be211c1605473d3d861ceca
SHA1 3d5cb650db3e756ceac8cad69ea52d4eae0952d5
SHA512 060d85cb4025e1fc854dcf30794f15ef4904cfa446cc5a927b36219ee9f9a4d9b9a39c60224089cec41c9490664848a8c76ae89586b4736e8efe8e8d17d53397
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4x1B+kn3Hnx:fmifPWRq+k
TLSH
T149B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f0f2eaecd44a41142bf6e9707c807856376b402575493e6c49409d9505f8e9a1
MD5 d5c90bc7cb160a263287ba48f3865112
SHA1 dfea43fb02bcc3683096ef68ce54ac13251564a2
SHA512 5f04875fd9d07491ceea7b5f243ece88dd6f34768c321b79ab74a5218f33ad303f66efaaff7c73c05e637c3226cc2abc2a149a177fcb516ceccff1be0de3e7fb
SSDEEP 49152:DSuZQIY0Be2KcRVtOnks6NMHq0B+kn3Hnx:h5dKii61I+k
TLSH
T149C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9e5017ab8afeb94f8bb0e47293a6f1a3d650050ac2dd9f41217d20aefe7742d1
MD5 5d7a27d2720c8bb096f7da2bddedabcd
SHA1 85064dbc750c4be1e9b1898fa5ef05ea2a5cbee9
SHA512 d7ce3f40b7bf687250ab2ee7f4f8177b9ac94d07c5e0b0516c87cd5c955b55ab7c8c8f2e216bd5c81178c8e1d1ead07c8e78e5cb70e451b74c23d772d81bcc23
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5w5B+kn3Hnx:PX2imphu+k
TLSH
T1CE95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4d6051bdc88840ab25212fb9467afe09eea542b14cc22e1c78adea4d0107e5ab
MD5 a4a4accd57c439e2d990e39e519e9e03
SHA1 434754bdbede1eb45d44e6496af8d40bc7df9497
SHA512 2e7c3b0d97b05b87b8f445bd73baf734b0a66b5953f3567011681d00511333f03eef71d830d8b297ea31a7b8012e65b83ccbd0f50dbc48383e0b98d062390c94
SSDEEP 12288:W4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WnNyBo4kx929bL3Hnx
TLSH
T1F84523125A0C627AF76D3FB0644A8458CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 75ba700569393d67732f234d7a5074798e566713c6f6317f92c1de8726be5eb0
MD5 843b37de4f963aa70fe8f2a7efb0e19f
SHA1 3da232450763badba97cd1f23dc4525fca73fd51
SHA512 4e701393d3dac3e257127ea304b4aa48574220e1e81b0f85995e9d08736866205296bd3f9c73f768e47d9f9cb53943f0ce9467e633e8d4114d575093f8312547
SSDEEP 12288:zjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zwNyBo4kx929bL3Hnx
TLSH
T1C54523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5730eebaae2b6b4f119993c4b49e12614261d21a11cca84b6ec81b63d29d3af3
MD5 351a40f9126f4bf544b67ea279af62cd
SHA1 97dea21744b3e40d2f270fc54541bd26047d7f86
SHA512 b20fd7ff9b1247ae4cf218ca5818038acc8abe641193c32b92071d0e57229725ac231c3e8a5d3c057631f71f72718478b9de56fc705ce068b6cfe605c8a8df14
SSDEEP 12288:sJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sWNyBo4kx929bL3Hnx
TLSH
T1C64523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f7da653cf54255faf7c0247a95e532c2e9db66d311baf94d572d540cf076f179
MD5 fdae09e495901d9adb2c9b0491e4cd62
SHA1 c5581e13b53ad0ee171bcdab46d777c4a8eb78c2
SHA512 283e15c74e8928212329bcfd2705574a808ba03afd377e0f5b9e364020372c2fc60c121f8d0563dbc70e50d26bdbb294e2c3872941710df1fd4e3dc2e67a34ec
SSDEEP 12288:3VWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nNyBo4kx929bL3Hnx
TLSH
T1B34523125B5C12FAF97A7BB098568054C835BC8A5B7197DFDF124CBB0EB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ee93de71aae8029110adec818e2c1b138e6322401061b2c82a838528fb3d0043
MD5 46d9391b48c0d0ef1b1ec067eb99fce9
SHA1 2b9353deb8dd10d6c4d0c6d76f0fe8bd22cbf395
SHA512 aeb036c16a156e6bdfbf33efa44c9efbed39f8171b3ca3a3795c4413ed43c4a99d400a800cd0726934501d775dc65184f2149832a9d51a4df25d245a125aa7f0
SSDEEP 12288:CuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CdNyBo4kx929bL3Hnx
TLSH
T1D54523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 813e00aaeddcbeecfb8f36e5d5c89c2ae38343141f84c043a2dd4d0161bcc418
MD5 2931ab975176d29092619b5f3ab1116c
SHA1 864c37e37e6e9beb987ed71569061bf0e080b116
SHA512 1d7752195497b9b232a227c5363743f534a2c85ea2791110d6a76d042134caaff94a67a4ac63210e42700723df87ba794e833f82277f66fb99aa6b16bb140c8b
SSDEEP 12288:x3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xMNyBo4kx929bL3Hnx
TLSH
T15C4523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 41c5bb25e829fdd1518fa78ae63ee85c45e941fd826634cf480fb1a900ad1f8d
MD5 5e4772c2571d7a87c03bcf50e2d8cbfd
SHA1 fd5efbee4ed513c6491e53ffd5c59d7f15473e40
SHA512 a6dd0ef9d47178361d3b64428c184a24fc57432e0a78b05a4e569ba3d5fbb2d4cbbe68a1f67779ce3c033ea6419f0d90fb68b4c9d991ca2ba41b085bc3a275f6
SSDEEP 12288:YbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Y4NyBo4kx929bL3Hnx
TLSH
T1214523129A0C237AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 268a1b4a17beff31f3df58d4135c2591dfccd44753439bbfbb527cfedbc59cde
MD5 736411762850ad57731cf8156ee02843
SHA1 85a365bb2477f015446d8e9d902d6379f76a4f53
SHA512 400896daecee4ff17102f299fc32d3abcd7b7c1efcf15ce151ee3652afbc8fed45dc1da4af5fced117a7dc681d456d9149f5fd866611ea2af97bccc0a4b855b3
SSDEEP 12288:MiZwbjzzFEoS2cPvyDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:vZMXzFVSOQNyBo4kx929bL3Hnx
TLSH
T1A7650195B39418F8EC67823DC8158906D6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3a6722d96f886acd68bb96e077a37aaf203b5324bd5871b3812d20d29e25de15
MD5 520e6b21007a77904c0e694d78121174
SHA1 6e26a809bf9ea0ec8847ffac3a6497cc06b007fe
SHA512 1c16b1d0ee63d75bdd6e23c963f365661f51e60c425c5db56e9502c485cc1ce62f2d2b42c385db94067cfbdf1187c0c7753bd7f1324ffe8a181bb19dddbf1504
SSDEEP 12288:70LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7rNyBo4kx929bL3Hnx
TLSH
T1EA4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ee45edcbffac0651961a40a2cc98f2121c8cbee45934f70d6db712a48faaff72
MD5 cff9d66003ec2de24bcf1b25fceae52b
SHA1 5e675b4ae17d655a16607a516a3676eaf2b18ec2
SHA512 a163107ff9cba41012b73f36de0e4d9b1987875f2db5977e3cb9edf5ca8d9d7bc71561635f8c70c90975674e43599fa5b1ee2b1e8b326149c768240f96206a2b
SSDEEP 12288:NgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NfNyBo4kx929bL3Hnx
TLSH
T1AF4523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 09acd207f9d35e1ec80e31827c3e77cbae8a404c583ec4771e8fc4de6c2a9aeb
MD5 2178bcef3a9f6c8b7209f6dc13dfb114
SHA1 ff3ca8f84d82ffc62d82b8596cd343e5cea408c5
SHA512 2fb150631993a0760fa8463168c05d33fd263a2a191eb9d443db93c7f01fcc843cf635e41bff0cad682917facbffafc12effaede2ac9c8939240badafb75052b
SSDEEP 12288:VyPz5L8fLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8zykNyBo4kx929bL3Hnx
TLSH
T10955120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 68b4b0205147e4481988129e1b034dc39ba0c35703108bb02af261b8de251448
MD5 3cb3879f3a8053b3b46b77b455f6c0cf
SHA1 7e39dac8ab111d8d9329ec7bb12f5f4463a970a9
SHA512 210f311d0902de6baea57ef17e5ae7f5dab31706b79f17e73e8f393078ab019f62919cad94bf4353f61c49623725b0c7e2506b24ee251d580c17b310e7d2254f
SSDEEP 12288:+0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+rNyBo4kx929bL3Hnx
TLSH
T1C74523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 835abc6aa2b9fcf3f2620121e185080d383affcb02f746482f01e1d78019ad49
MD5 29b823b58b964a43d7722bb2965badfe
SHA1 69b318c9a3982f10e6d3f24373e6ea9a437bcfcb
SHA512 091eff350edf2f2f433ca92345aa805c3e4dc27cc76055e613b0d6f4265b8bbbadafffea05ac8c0144388e89e267ce4f81bd51e31cdd332926215be837dac60c
SSDEEP 12288:i0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:irNyBo4kx929bL3Hnx
TLSH
T15A4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 486bbd203193474bf7000df0866708c3aa3d5088d46436eacb9938f2137b6898
MD5 46bf4f09bf44e62cb0fa9abbf07c8a9c
SHA1 bbed2bf67289c35ab3b21c0a3d401c23719b6018
SHA512 27c4c5224328032c12ff785b57df2dde38667007d01d7db922ec00d16fd255cc9fb452671c2a2cfa60071cae09ae3a0f2e649f64ebc6116dd38beff83ddf59c8
SSDEEP 12288:EyPz5L8fLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:dzykNyBo4kx929bL3Hnx
TLSH
T18D55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9b527263029dd5546346ec99c2b7458034a31f04583bec062d1efee02c765a6a
MD5 f7babf1dc8446a8b85d8ad3b65a90355
SHA1 79cd626906ab97883ac54e2a05619592dc9512a2
SHA512 06ed50a618066115ad2e96093c3a7fc7d1e915024aa61c514f219cb9f6ba7a0640e9f14de1ce31430d19da8e46631f677daf709925616be226f7174583d38b49
SSDEEP 12288:BCd98WYoaLHF3z0z04PDvhZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:8TtaLl3z0zDGNyBo4kx929bL3Hnx
TLSH
T19A6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a8bb4bd8415fc4efa60815ca128b3b804347e073c6ca618a5e57bfd0f2d32b1c
MD5 b458d3fb3446fb20a9ed87540ea09900
SHA1 2556aa34db5bb39396d973aa4ab867af5dfd2b73
SHA512 f54665cbbadb0f35b77ac2762fa85b2779f97b5026ef4535b2d5d556a0c0f603a16141bce0f8236222803df34e1ccfcfe0e51c14387f3cf8672538f32429b823
SSDEEP 12288:yi4e7ARdTfgwCHKy7GLbbdIvyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:y3ld9CHKy7GZiNyBo4kx929bL3Hnx
TLSH
T15675CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e36e9c4f06134c40c9b51d10b3466138f6f4d55b5cdecc8f2695a71d0bafd034
MD5 b88d44da036beb85d4bace026fd2f805
SHA1 beceb87c498d3df6b5734100631ea39d183ec7f0
SHA512 6c5b63cf7f117eeb4be55ec332db4b578957763274051d099f2a30c8073c77afef5f94548373775d09080de800e2eeffb926b144c5b155023a5375f786ce3ebe
SSDEEP 12288:LpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:L2NyBo4kx929bL3Hnx
TLSH
T126452312990C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4f5031bf7e2a1e0a7dd26ba71bf5274c0482a15d8f0c392025768bd16be96613
MD5 cb6e3028630904d2b84ffb0628c0b703
SHA1 42314b0592d10b893c73c59d98d1f6b7e46fa96a
SHA512 581135a6753204108d6bb7de830cfde6ccea3ba8f4bcc9e8a3ed3254c06eed20815e9651c9f3d19f4f16caee8944979e7c3a78f4a549a2114ade2c82e9b4132e
SSDEEP 12288:Q/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QENyBo4kx929bL3Hnx
TLSH
T1E54523125A0C227AF66D3FB0644A8558CC34BC8F1EA597D8EF679C7759FCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 62a0b9d61c4f8b9c5c0e7fc1fb456a071fa70833d6ee99249781655768cdec98
MD5 48c8f86704c5291ee6e3529eb60d02f2
SHA1 c0d5b8cf700ea7a04f53de2db0f55818f9da971f
SHA512 2cfae2488f824732c6e58a21e4b3499ddca9085966ede31e5d76c026f987e96e63568a6316ce4127bebe5ba80649daab35ed49624ecc45de6b0a10da0b5d9776
SSDEEP 12288:oyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oZNyBo4kx929bL3Hnx
TLSH
T13D4523125A0C227AF76C3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c4c7ee30598472ec146c59d392a3be4ef4e04c2a26e736999b7bccc6f288a658
MD5 061e350356ac7db4f678dd0ab67f898e
SHA1 69086d25a47d9725a9548d96105370ed9a60dc94
SHA512 856b3615036580ee274b021815b9a65fa6e194a8b45430eaee73863bffe153be0e52c4e4f2137ec0edb9f4e12d4b4c197a34dc8fb16708ccbea2d176ac3c584e
SSDEEP 12288:D0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DrNyBo4kx929bL3Hnx
TLSH
T1D64523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3350643e54db86b56b92299d564c9305b270fba354d31ef5be650bd12299003a
MD5 fcb9ea39c8aeab7f262d99753412e9dc
SHA1 a7b89107934b6342a8fc87489dbfa201a6f81250
SHA512 16a35cecfd852c2f93b9c0da12c0fe36f8b5bc3078080ec58ea10d93b8174e58d0a5cd010843ca5d83da44e2c67056f122d1ae7915cde9b001f276bea0773e32
SSDEEP 12288:apLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:a2NyBo4kx929bL3Hnx
TLSH
T10D4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8f8f2e78233749ef1bc098f090196e0920a3ccecf333ad8c95fe0ee5eac2c049
MD5 b7fafe6b7d6c29f2f7ac20946781cffb
SHA1 0f74562e79f53baa84ab618c506f215cff524e17
SHA512 ab6eea2de4b1b01dd3715d4df3e426e1732e3a74b70365b15b5ce5db46114aba0e6d7805cc953e4f9ef38a87c7b7746af89683d0eb43ca3788710ba32590954c
SSDEEP 12288:2MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2TNyBo4kx929bL3Hnx
TLSH
T1D54523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987759FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9c1221cf52cbb868b7ea5bbd517ca1fe70a3bbb4af6d598a5ee5a71f30f68535
MD5 c6a77b232ec32aaf97c255e1e7a13b7f
SHA1 d087053cf8ec83f080609b60a2329b852759066b
SHA512 d26fcc87462a401b770ae0cf203e81b7887720a40b66d9fdcb9da1f037beb1e9498ac19fe0865d414566c021b057bbca706444d0c94e543ef4e0dbaa7931d190
SSDEEP 12288:luLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ldNyBo4kx929bL3Hnx
TLSH
T1574523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f996b432930902c0aea7d8cba45d2ee3a525fe0b25d23a91144bb14cccce4f06
MD5 2a71bbd4f5e9cf6227083fcd25af2d23
SHA1 f9bda4ef9be39d2ca2abf31269ff7880685c4741
SHA512 621247d3ab3ab5f20919d3d8a02b7f2ec3467c3b9bd3bb3f8203c4a6ed849ccdadb8b482be386f3233a589619df3da05e82f8d2dae5b9cef4e13bf887266a6f2
SSDEEP 12288:lRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:luNyBo4kx929bL3Hnx
TLSH
T1694523125A0C227AF76D3FB0654A8554CC34BC8F1E9697D8EF279C7759BCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 594240583cee2711c7b0091e04654bd04f09c272a2d95879ce6c24f414bd3715
MD5 257996078d9a13db7125ffdf6be65fea
SHA1 ac1acff8e52be4169667a48274fc5b84cc10d4c0
SHA512 6ec1772ebe5b67c191d5d5b7265e983e0a79ff556fb3be7364ce79bf38c02289643c06464ad6ef7656cb9f24b0e9839c9f8a73276fc756da34f4351173f84796
SSDEEP 12288:LuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LdNyBo4kx929bL3Hnx
TLSH
T11D4523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5f908f3b8ab9e5778c41ebb305397ef05aaaac65ed6b61adf57245fe91de5936
MD5 7250ce1c668227020e01fdd42ca4b6c1
SHA1 882858da379c5fdc9943603f6ff966ace8a2f081
SHA512 8a7492c5df0bc7a0af5c9d12a7d64252220ca048c9f36b43df5efa1a2c02533b0a727f5928b179f3b27bd5c3053cd811b2643b84acca24de0f1df7086bcec069
SSDEEP 24576:9fwvqk9RX6wkyAIvNyBo4kx929bL3Hnx:hMnYIgB+kn3Hnx
TLSH
T1D085DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 14acb0651cfaf9c893ae58624bd04c4798d187f5ddef624f84156810d3d61586
MD5 1b31e7365e78ea6fb1bff5de6790855d
SHA1 081592051de35dac476344149b937002a3d3c2e1
SHA512 cf9ff037da75be547f5578c3d73e015096b0da3b0eafaa26de8d149f0d75690383b54cbc01a64dfbacc7e6a7fb4c48b83959b9647c09a96b67e7dadcf28441e8
SSDEEP 49152:vYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZB+kn3Hnx:6ySzPH+k
TLSH
T1E5066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5e6e7d0524e66e4d42819daf92cc9150a57066b3f8ebc41e345ac290617fa24d
MD5 a6041a9df35da4dbcf0fa8e170656c9d
SHA1 a11baec32204c92b5ff1286cb74b0ce972bc68a6
SHA512 4bc5661bb241fe32e637c4656308776da2dfbb6582bff3384452523bd2b3914844cb24afd6e72e2521e0d236042edaed748811134a9ea7d6547265d2e75f098d
SSDEEP 24576:B47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYgNyBo4kx929bL3Hnx:B47JUQjTirIhCnDHUPfF/JB+kn3Hnx
TLSH
T1B365BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 08209e1d75f319da90f1d5fc9a1e4bf493f694ca561248254efb58d14daf4724
MD5 1da2c1fae2b1e8a00a3f7f023390b317
SHA1 ac8ea8a816680cc480457da990a707fb495f6ea7
SHA512 9c3e5f3af1069bb999928c605ac208a9c0e2b1be404f83fec0c51aa458d5a840c7df159a18c235b5fd02afb75c80df52ca9a33fca6821bb178da0577deb1100c
SSDEEP 12288:IpsfELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lbNyBo4kx929bL3Hnx
TLSH
T1F255F01AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 cbe5ae4399f7968284596be29f1be483bd8a2d31e2359cddeaae920208b64db6
MD5 21102c59a72dcbaa20d3760160d736c9
SHA1 57d0d5880fe5104c1ab0b28e7c23aae1f1bfea21
SHA512 134b6b3bbd08d29797e8e120cf50513c7f608f5d7eaf7833fc49fc2c341def7765f5f54e36d42f9c80c76163c5fb8283a8badbb2509afd75b0b5c7da2499917d
SSDEEP 12288:gvu+IxKbU3f6fq9kd8MJW+BYXD3m1P/K4HlIqASYtDMpD5qaW:g2Xx0UP6wRZm1P/dHiF9lMpDMaW
TLSH
T120454940766AD75FC5A940325E32D2CCAB707C51EE05AF0773C88B3F9576668BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 8ab06de28d17bf271e3b54c7dcfeda94ab0f27998327e07b5b5d8f8bceb3cee2
MD5 fe773d251e1242d6ec0ae66f167d5c71
SHA1 51221561cd543cd4e1366cf441f259b33d2f1f04
SHA512 03cecdda1f347b0745c8ae8ec69ad44e00dabdc6dd3af4d4c6f9019d32ca39c69b1326283721e33a69c2afe999da8030bf01e1b61baa435c42ae0ba2e9c52bce
SSDEEP 6144:4pU3IBrFKxxCtPtFRt9AfawgKXFas1M7Wfm11C3tMx0wBuwD7B2OZQYeu3Wc3mCY:4pU3IxPRt/3uawjas1UIwEnZolQnT60
TLSH
T18565E981A537E38FD0F7617203295B4DB764EC12B7056F26B3C9053AD82AB21A4BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 494374ffaeaa71122511bb783d3babaaf05d8cae8ebddf9a05145c533d3dd8d7
MD5 3ac6b8b34829a425a4f103b43fb87afb
SHA1 23e0fb6782b07a75c231aff9930c7bf4416158ad
SHA512 83b6cb839182a6ba441121734423b3287a36b7f1d65c681a6564ea50bec013a82a55fe8d3f61caefc24915526b781fb2dcb9a25aeda1ccde1a604dab4440cfc2
SSDEEP 12288:8y7cLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rDNyBo4kx929bL3Hnx
TLSH
T10C452312975C663AFA7D3AB0645EC024C839BC8D0F50D6D7EE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 22393c2e35ccd60560f6253d3604e449cabfc3e5fc895707e138d43b9adf7053
MD5 a927c1bde7403aa7f4077e0863b8f956
SHA1 0353fe3a66b1a80de5c6d91aef3b3b4e354088b9
SHA512 48b7913c42d238f7c186504c63a333e3509ddc5ee242c7e57ae9096fca5548ba636e7db94dbfa657e038ab239357a9de9364c0a70e87a1f86961bb0d070b67dd
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYxNyBo4kx929bL3Hnx:Tgb4mBIBhGFTB+kn3Hnx
TLSH
T1A165AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 30567b40836f06bced7ee9d9fa45afccccb651726cc87ea741c3cae6b371bdf4
MD5 3f13fab734e89b763e60351aa87559f0
SHA1 b2d1e67773ebe23bb42d657bb42cd430953105fb
SHA512 cae27b073d286b93e371b869c6f43c2f414eee85707558a9613824218d026bc174fb5b397fcb4c29ed1cf824c4b37943df9101e55fe92649f500590bc2d86d60
SSDEEP 24576:lG88u8FpJqH1Jzria7/mQNyBo4kx929bL3Hnx:I7ZFPqVAa7/+B+kn3Hnx
TLSH
T18B85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F33AE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 815996e28f0624ac53d1facc2e718c008e83f31d5f65ecc92e3f78bb330d1170
MD5 fd6f3bcbca6ff7f02c8d69669feb679e
SHA1 978df2f8b9b0fade8fb9183e30b89f2a16f6c73f
SHA512 59d373d962cc544bbade5ab99db2669fd12acd45c8f6e58e508b65be764bb85d774e0566d4c458b5a341422bf5c264c8a77e8701ad8f1be9566bfc90a780177d
SSDEEP 12288:rHvUrBFrEjwaQnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rPUr+NQcNyBo4kx929bL3Hnx
TLSH
T18665F22F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f94faea8d6ea2782f8f3587af8655dbebea1bf338deedd2dc2a4787e1811b344
MD5 ea8ce54417a2da7861cb27d2eddfe615
SHA1 a9b94d7dcf301f1f9c555977abe86e5360ce03dd
SHA512 5027118fc160e6d003f7a1b4c1cf3f5085cc0fcab102401536d5b8bf353ae00bf044716ba37a09d1eb540478a14be73a117a8ec614886b1d987beb1002ce645e
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXB+kn3Hnx:xG05lO43bk+k
TLSH
T128D5C06A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14b64eaa81ab4bc7ed46c57b3a09662ca0ea3b9fdb5d17726503cb159c76fa1e
MD5 58fec68ea26dccb75d5a15c2fe04c53d
SHA1 6d561503b93b663394ebf33642fb6ae9ee0f2136
SHA512 46bd9a96f279a57ec88c205ef614dcaa3e838c4a5ecb95c65a0e4aaa1234cadc40400596a17f80f91236cfa97e3d824c42f1484b4ff29421f0a41acea63d14b0
SSDEEP 24576:Sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnKNyBo4kx929bL3Hnx:6a5POZ3BJt2pasx2+m/B+kn3Hnx
TLSH
T13665AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d90a66ed575e7f3970f02c1018de7b253a23f76a94422b313fadb6c28dd4040b
MD5 d68f62df8369fdb9fee08a46caf9df9e
SHA1 8345c1b949cf3aa065f9e2912df1114e5069b606
SHA512 60f26570a140b2a32ba669540d293e7223dcd11c57004ddcca6cdd247de8040259f5e5904b56ff751031a374e482c36ec67b2ff8e5a6c7e23cf0ce858bdb5967
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkoNyBo4kx929bL3Hnx:/Nc/zEOVHFeB+kn3Hnx
TLSH
T142858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c9dc94600669800420d9c000df64519cec2aa6fed9d0de33e83fa12617faec48
MD5 fc906a5dea1ba244d7eba928260ceeec
SHA1 f0ac1dac78bfabe471cbdff85dcb9ebb462b332b
SHA512 54e30656e5e3875150e379aaa69d2f5e0ba1da1d29dfa9fd4e0039a9a96f490ea4b3d46b127a5b7ddc989df98d5bebd981349cc1ee2143ef4470e7d0ad95ec65
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmuNyBo4kx929bL3Hnx:QTMwBtOmFB+kn3Hnx
TLSH
T1CD55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2477203b6c271d58926bd383584828f5d4d30ef5ff5dc6e39341a4a33a33e405
MD5 e6fa855b202426c6b441228dcac9ec47
SHA1 c90cc6d5130469cbfc800f3daeccbbf7d26df75c
SHA512 4e710acb2f1fe0cb7af5d14c3de829c82ce6cc9f9d58bdefe117f88082f036abe2e7c8f2a6c982368655a65226ec60e22f118824fd4f60674b0a21c9bc5e73b4
SSDEEP 12288:UQcMxWDXN1Dp/fshBItT1IQgAYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:OD3FHshBIYQgAHNyBo4kx929bL3Hnx
TLSH
T12175E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/480-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/480-120-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/480-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/480-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/480-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/940-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/940-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/940-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/940-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/940-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1152-361-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/1152-113-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/1152-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1152-107-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1512-39-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1512-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1512-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1512-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1512-60-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1576-7-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1576-305-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/1576-9-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1576-80-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/1576-301-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1576-0-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/1576-1-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1792-302-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1792-73-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1792-68-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1792-65-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2188-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2188-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2188-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2188-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2552-310-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2552-77-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3944-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3944-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3944-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3944-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4600-53-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4600-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4600-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4600-286-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5700-374-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5700-82-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5700-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-360-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-88-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6124-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6124-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6124-357-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6124-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download