ed339d0c55c6a7dbbb6bb1add906b37112660271d69e37e0aa3b86de5b5646cf

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
Size 1.5MB
Sample260820-s1xglseq4v
SHA256 ed339d0c55c6a7dbbb6bb1add906b37112660271d69e37e0aa3b86de5b5646cf
MD5 4bbba6fb9a947cf77fb02168588638aa
SHA1 1265b2b4a75389b15265dc9f964714356acca498
SHA512 ea07a63170ebc9f84cd11f1f3d0e5d4850354ddf6292b8cda7f9e78294cafa42f6182f8ff01195387e7895707db16e2d128271df5de90f088631f2ed79c223de
SSDEEP 12288:N0qzyuyKaBwM+pJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bt:N0a2aM+SgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1ED65F102F2AD7CEDE0669235897541A1AB31FC315750A5DF62E17B252E322C3FD3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1068	elevation_service.exe
1300	elevation_service.exe
4660	maintenanceservice.exe
6088	OSE.EXE
3760	PerceptionSimulationService.exe
5560	perfhost.exe
2760	ReFsDedupSvc.exe
3420	SensorDataService.exe
2836	ssh-agent.exe
1576	AgentService.exe
4076	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6dd746c238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0fe7badb930dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7c940adb930dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092dda3ecb930dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b9464aeb930dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001823fdabb930dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4260	2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1576	AgentService.exe
Token: 33	4076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4076	SearchIndexer.exe
Token: SeDebugPrivilege	1068	elevation_service.exe
Token: SeDebugPrivilege	1300	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4868	4076	SearchIndexer.exe	100
PID 4076 wrote to memory of 4268	4076	SearchIndexer.exe	101
PID 4076 wrote to memory of 1504	4076	SearchIndexer.exe	102
PID 4076 wrote to memory of 2372	4076	SearchIndexer.exe	103
PID 4076 wrote to memory of 2896	4076	SearchIndexer.exe	105
PID 4076 wrote to memory of 1656	4076	SearchIndexer.exe	106
PID 4076 wrote to memory of 200	4076	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4bbba6fb9a947cf77fb02168588638aa_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4660

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5560

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3420

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2836

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0a87b68134ee8ed7300e6f45dee7594e9af69047711af42ee412f68ed4c39223
MD5 7147ebb0a9923ea11213c81cf2e34a63
SHA1 733420b966785ab6a67b56e347c54f03d046c697
SHA512 b674e0191df19eac73b5f5002055233a4fe144dc9dcb7e1434216eca0113d276c47bc72219ef1627ed216813fc361235dedb8ef23588f930901532906c265e0e
SSDEEP 49152:pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxns7lPJ8V1B3lK+Eh:/3q6sjB3U3l
TLSH
T185D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b9f62a44e448d8c69a2190763f9d910906fc6b4fb12fedf1ff32fc16cdb82aa2
MD5 4df7d1b5b4c8003bdb47611ba917b8ac
SHA1 f0e62ecc2833f032b58ff7b68f71af3fd475e2c0
SHA512 b542985297f64845c7ac0d579b8f9919abee8c182d6b3d76975f06c8bd8a4def68155a0d98f984817e2064917f53a93b63c87036d351f66cf3d9f44f53a49531
SSDEEP 24576:0XYfDtczAfgAW4PJ8oe9sg3r5B3lK+ubh:ztcW7lPJ8V1B3lK+Eh
TLSH
T10875F128B7E408FAED578279C8A28511EA337C514764E6CF03E499291F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e41c73f29f53cee06528c650fade7aacbb3dbbdd2819e98c0c8bca866cd8aa75
MD5 602a1d16b3ea979459c320782802d6d5
SHA1 0dcdc8f64e852076dfd6c2c1a7c74a4415daf1ff
SHA512 d1a61bcb314e5478366b0ff3ee342abcc1c82c20dd8ec91fe681869f9130eb43883a5ecee7fffaa54d3495ee36f4afc3f125f39d3666b53cee44e9eb1c17dc48
SSDEEP 24576:80Le5ji0hmxWrM0gAW4PJ8oe9sg3r5B3lK+ubh:8Pji0AYl7lPJ8V1B3lK+Eh
TLSH
T125859E25F6748331D073C0BAC5D2A69EE97130825B3089CB4296D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 35c028b4d325cc88125e72ac9d8c8c6dd068d8b2e77aca84c7918981f193992a
MD5 229a029db4fd4141de1ff6a4d44aaf8d
SHA1 09230cd03a2b7a270ab3f6dec3b5cc28cf38c812
SHA512 05601ba6652a1255061ea03c4d26aaa8f4b22a0f1c552356859bb6f27c4f42d57a70f4d282026c005b6514f432243c150bb28bb47a8b4c0a268f4467d4280b36
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyumgAW4PJ8oe9sg3r5B3lK+ubh:J/ezSC6vUzPveHjyh7lPJ8V1B3lK+Eh
TLSH
T173755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 208351824418093072ea95c9b52d2e566d7d2588f34ec0fd9b3f635c261a4a60
MD5 b9455cb11e72c3e68efda7b44e3347ae
SHA1 8b700d758d6be6d2970fd308737eebfe9b3c6600
SHA512 ac59737ba82bb205d50042d7f823e236c251c4d0c97032b797f23c48592de07101ac7d4cf4737566edbb329659a1a64c9ccb95baf8b213859e6b459178e90d99
SSDEEP 24576:JVbqPb88hv/l+YjgAW4PJ8oe9sg3r5B3lK+ubh:JVO88hXl++7lPJ8V1B3lK+Eh
TLSH
T11F559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E77BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c24e0cb0d33780cc9e84f696864506752965c56715c388fd68e864c0b7bb8895
MD5 5a0aee171b8dd8edaf26b275b033821c
SHA1 77c6aa5c32c9829c681b2b8f19ea3075bcc0b62c
SHA512 b2fe5693bb56a043e0da77bd9ba3894814f168998df94f8716dbd38fcc1d7456f0a566c0efbf0d0b0807d963eece3893ffebc6ab20264c0461876cc6972ac6dd
SSDEEP 12288:SxDJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bC:SxogAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T138552358DB7460A3DECAA7B3B4EF653869193C62D70D98CDB5A1350D0A34B8AF4CE311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3a4dbb46650c1bed311b123523af889972a8475548b3d25f90d00606292c57a9
MD5 0cd2588127b3c5a1237de67a9bb166bb
SHA1 d2af613e0cca343c500ecfb6c2cd2acf5731d528
SHA512 62463225e9be37f661ebe1107915c19f306223ebee7304d4d27ec28c6a32dd821365127d6eb23d6853b74f6116819470102787adbc95732dc039b58c46579a94
SSDEEP 12288:ReBNUbTVO86UsJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b6:RJIULgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T14C75CF3BEE38FCD2C67A9DB95A918200D77278314B12A3CBE175820EDE236D15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c3868037f36fc8353eafc3a43ffe5913f9ef210e3faf711e628f7336a4414e16
MD5 3ea0edd4a490a322873038d5ee066db5
SHA1 328af85d08cdb8b5524b7500df60edd78efcfe7e
SHA512 bd14b74cee751c470f221f88a61f576d1cc1763f3b946ad3e3657aee4e3e33b1db703d2fab27852d9b929474abf529f41509ab7b37e0360f3695a95d65100175
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:2QvGAdlCEL8c/DRNw5C0U3l
TLSH
T12C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e250fb5fe572a9dbddb2e9bd8bf4d39b97a64e50b6bf1ba0ea4e9cf6f893d5fe
MD5 d4640ec57d0146acb87f44e7ab0137ad
SHA1 3800e68882ede639e87b6d76f64c8684ea2990ea
SHA512 a386ad49384a71e7dd3d9dc5e51fa9f8dd173d3836db90539be7b3d281fb377d71fd5b4ea1ea808bbd4ee606075c3ac1a5195b155e16634b3161a12f62cbba6f
SSDEEP 12288:WAwSfxL/2Dc38DLLmt0LDQewsAjSJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4g:rRewsAj1gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1F275E030FE74E032C6BB0EB22B76D716182D79204B5519C3F3E85E9E59302D2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb7c4f8bead39a5c20225ba00f846e8a271f990af0a45f98a5de2823fe97d0b2
MD5 8e295363d054d2e1951746f14f585f91
SHA1 ee3210be8e9aa42b0ad344bb539bb42be1072764
SHA512 bc06f9b2d77112ae8696b3d448eb2862f580b83f3d2e27c81f9d4941fec7611b615c06a77ac38edd29276e24c882711b9067017555fc8fab15d784a971aa3796
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVU3:jUEtQevvqc2W1cpV2tI32VU
TLSH
T1A9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4ee9f23f92a5ea6a5547d3fe32d820aa67b20a190534a72efff14ccef54fb49e
MD5 0b62fe2b462217ff89db2a21c70a47a4
SHA1 007b6dbfac64149e483046bd0a3d8f459cf3ce1f
SHA512 5b4b7fc0b2c3191e7b1053dc5866994b2e97ca18aa49d71570b37e9b41c970947da3ef16275113be93fdc1d7528c071fa274a01059c4219914d78d9f7f05cb1d
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zV7lPJ8V1B3lK+Eh:QoqtVjnmQU3l
TLSH
T1EDD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e84e333a9bc21aef65e05b352c3ec291d5f3d20958885b996ceedc97eb40c67d
MD5 00ca6fb409812f9b535e093d2e5048ce
SHA1 99a941053cf80d14421c1a540262fdc1a1850104
SHA512 2417d159a54a345505dd9dedfc8f5dbad3d3ad1d247445cebf1cbd282570b7681c7e0f271e8c07a36bb7339399ec93e03d8991fd576332ebf29a176a6d07aa7f
SSDEEP 24576:uAhGL3IFoiwtA5l7S53igAW4PJ8oe9sg3r5B3lK+ubh:uAMUFoiq5S7lPJ8V1B3lK+Eh
TLSH
T10F359D80E7F955D4F5B3ABB899B69170EA76BCA65E31D20F2160911F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 65bdbf392288d611b25d983427beeb76aa3d81471e9ee7b6087241f00958c34f
MD5 6dd920b032a4d8520298b1c13853c65d
SHA1 6f1a27338254d1bd1f6954d6ad63bd4a728c3809
SHA512 37d195e1e13c4de063cee70466708d74c84bc09341e88dd05825a4d82ab71f55e88b852121098c3f71afac1eb9f45eade27db9894292e8c32c4d64cc7138ab41
SSDEEP 12288:Imw5HEjsChNsBFgl0WDm+C1Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlKd:lwuNOWBgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1BF65F14977A40CFAE9A7923985978135F7B2BC122A25DB1F13A0C61B5F33361BD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 eafb994083c3d7679ddc9b8f9239406e8575800fc5ec80768c3ea17e6cdfa1d6
MD5 7ee4c3020ba376fbfdea5d343bb6e106
SHA1 9713b6259c52f56a82569f26ca031b0600e8b3c3
SHA512 2ced1a1dc00f45059ab99bfae3b143dbefa70130384d5a10bcf7d0854080be6e90494c6f79c1b8603a4741a09781c78c47d86d5cc8c3720f8d569a1d96919532
SSDEEP 12288:6dZ1IyiJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bQ:0Zu8gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T15D55125963E420F6D9D7937AD8E65614D7723C63A33A83CF226422191F32BC6AD3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 01ab544111b89eb771df89a83f32913cd33628fe33f2c8563a23429e79b5956e
MD5 7ce83b13e668efd3a3427ce2ef32fd23
SHA1 b5bd6f5f6db61883f595a7d5dfe898e1dfaee153
SHA512 c25964656f88344e74d798f266a0b016e2edb3df7c1a4979450fe70626da2e76f325a43377c407bbae33bd6d3f1b3630a52f053d789704827d92f2174ae5e87a
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:8QRQyi36YOcPbLvw2gAf+PN3bU3l
TLSH
T1B0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9f9ae10849b9c45a325d407a21188c9f83034fb568c1b9e6eddd580b61533ab3
MD5 bc5b804668cb36e82195ba3f33851a8f
SHA1 7c835fc29137dc8ba0fe02eb5af6dd1b07639324
SHA512 8868781f9b2ca1096a49f350604e0c9b48618b0657b3e83e9a86380020717f793fc9a6025e3b9bc589520c4ea64e96d490201b4e9400f9a4ca694f2a637ac9ac
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:vQRQyi36YOcPbLvw2gAf+PN3bU3l
TLSH
T169667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a50aec8eed08aac6115fca573f462e211be33a40b0ffe1154c2b6d7107cdd959
MD5 31aa921ce5caa91d343eee0677cb470a
SHA1 c5485905dc9d019115d6fa2a59486e7497d43835
SHA512 4a0f07b6b884f9253980400bada467f2a19b3b3db6008d97e54d82fe326481e06ac037eada08b3a415dfe523653880f199165d958a98b4906b07f5c350402e92
SSDEEP 49152:y68Qg55nhceWu7PNU3/l7lPJ8V1B3lK+Eh:wthLRc/NU3l
TLSH
T133B54933B2F600A9C44DE1769F4A873196D17C718FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8fce534f8a9e0e4f425ac229ecb8992e7f9d7e1c34e55e8535d4416eda8c7e82
MD5 faf784e1018db66a343dc145371991d4
SHA1 81c563d0cf7caad68ff78a051fe0c0774c84b4d5
SHA512 b5fed88aeea0a47cc315d6fd4e7dd9cef7d22455eb4177eca43bd1796432bc83e73122a8dd59c9f4ab296280fa6ee5a4d466d19c3d812c8884cdbf2ed8c67e8a
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99/:ay5112gYy5azzVvt69nLKnhZSU3l
TLSH
T137167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7bc2d514aec110d1ea8a16faae676f2c7d5556100232a5b0b1a863ce6811bb97
MD5 9da69f61ab69b6c12cbbc580fe92fba3
SHA1 a8aaa75efd6c943ff46598cff7d5e8e0453129eb
SHA512 5a1c26f3b93267031f647d5b503e1c33793da571409ee808b88ea12a4019cab23059e2a79759b3953a0c784ffe3691da201b56682ee29d56f2f02dc52e66b7bc
SSDEEP 49152:3B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glP7lPJ8V1B3lK+Eh:Zu6Jmdxd2dDU3l
TLSH
T153D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 daf03c139be496f7ce371c730839345a924a4159de23ca9494be963d33aa75af
MD5 2349645602fc735c51965c93395dd0dc
SHA1 af1ad1dd116afa899df218720e7daee2560fdc40
SHA512 0e12e9cdf5108c7dcd142c8aa100201a1025c71c59346a88a35310331ec3bde322a0c3c2c59b2e1fc56f62948eac88aa77d6660173b2d747bca0198864633a6f
SSDEEP 49152:L1hpsNoJpF1A63U44CwH7R4xr7lPJ8V1B3lK+Eh:LmifPWRQU3l
TLSH
T11DB5BE13F2D900E8D05ED17987569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 364eb873e27504259c8ec4875ed96d2f9b1bd5f497d3b4d04b12beae97832902
MD5 a59688a0224b51afc2355d6798577cb3
SHA1 4f6619940828cd0df11d2abcc4ae227dcd191cd1
SHA512 a8cb3657c3980f1946ef831500f980ae3520298ee4ce9b7d9a8a049ff91cfa2d6e19a9db0cdfb7f76eabb20fff0924f8aedd691581db0fd77b7536cd8275c6ea
SSDEEP 49152:3SuZQIY0Be2KcRVtOnks6NMHq87lPJ8V1B3lK+Eh:t5dKii61GU3l
TLSH
T1E6C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fb1af79f5be86387b06a858fe33436dd8640efaa402c924168a93d0291a78919
MD5 06c990cb4522b465dc7678c29f246fa4
SHA1 f0b68e8ed2fdd53ef58581bc78796d88d4424088
SHA512 235cfae14981a719f10dd7af076d3dd7781f6eb6a016922eeaebc4cd08182093665491c5f7c34c22b9501c3fcb5b9b032a008d1aef4b1356eadffa949575e01f
SSDEEP 49152:zhtSn8EApI0fig3giDn0AP5wf7lPJ8V1B3lK+Eh:yX2imphMU3l
TLSH
T1EA95BE13F2D900E8D05ED175C7568632E962BC120B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b4a203f1accf4a30ef6abd774aba580a3617007ec626eb2c5994fba443d6d0a2
MD5 14a01b66b148badbcfe83ce13a93e201
SHA1 7538419f39248c9ececb4051cdd787a22a14a7b5
SHA512 fa1a7884435718e7a64a22abbc620d552b2ff9208c170a08c78c364c055782fbf64689f5a4867cfba0365dba1953a26de549e239aea2b3e632d3d1e0e6b8c889
SSDEEP 12288:P7Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bE:PwgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T146552358EA7550A3DD86A7F3F4EE617868183C63F70E94CDB6A530091B34B8AF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0493e615762789a628e4d155f7ea3eaea813c43876941ae6d96c1ac4c72ff8e3
MD5 a3b3a5e744861d2c3f7a5ff28534d6a1
SHA1 6e615e77eafd741fc77716f34adb304063c950e8
SHA512 779f9c903aca45b25e49c56204bb245fdb8e3f2f091aec028768c324dbe14fe58ecb8ab4b33255352c4fcfcc218ba40fc0124890c93887746d8c39caac5d5124
SSDEEP 12288:HeJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bE:H5gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1E0552318EA7550A3DD86A7F3B4EE517898183C63F70E94CDB6A530091B34B8AF48E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9c1fa02a98a6875b97c8fb44ab4889df4fe1ed4a983b6a8cb0b97ac7b4ab4624
MD5 9640a229bf1625c1c6c2f3067d0da06a
SHA1 4add7e9b31624d47c1700f3593e610d240a5e6e9
SHA512 d59752adab1b0aff6fa297eead6f330d0a11f4b020e2de0fbf425137d5504e9c322fc853d593f7f57daf842d1d317bf0c84adcb76837926b865716327a31f931
SSDEEP 12288:ZkJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bN:ZTgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T18A552358EA7554A3DDC6A7F3B4EF117898183C63F70E94CDB6A930091B34B8AF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f3a335dc703d1576c2c114e8a05b0b3a0063c8a68c9ff9dca4c0150dd84397ea
MD5 5b4e2c142b145e3554cb93cfa3cc4a86
SHA1 e849bf3ace9330480ec65e07ea0021d1f3e03654
SHA512 a057e2882e7b8dcf6072c88c3f032a2d7bec15a6bb96f0fbb3a43e164464aef5886281312d4c7f108ced21b4153d509e62a334e60e4cb8b9e2709214999bbebe
SSDEEP 12288:AVZJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bE:bgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T145552318ABB950D3DC86E3B7E8EA5134A5653CA2E72A95CFB650340D0F317C9F89DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2ec9557d4b4ca08218f9f6b00ef14ed7f6a058143a39656d5c725e2149a77d9f
MD5 c9781c82fc74639f70ff2b266c686735
SHA1 13ab53e4239e27f2e5028c40c73538bad5d6db54
SHA512 8614e7764d1b2fc114f1143fdf17e18e47fc5df8c2583d590e3705ebbc0641ab0b485ecf4ff597a6bb2dd9324b91750224a4d1b3453b473895beae6d5d1c8c82
SSDEEP 12288:zBJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bN:z6gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1E6552358EA7550A3DD86A7F3F4EF517868183C63F70E94CDB6A930091B34B8AF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 565e91786bddc4412ee2da2555650cc7ab029b361bfc68ada94e1aec57aa551a
MD5 918a8526f3f3841c81c5b004e209ac0f
SHA1 e40563648a3b9f7873ca8dfb6d7b2cbea5bcd9dd
SHA512 4cf78656c96b597997bbdf0da6f17e6232c5f7b2f4090261e8a402195114d9c6d0a9758b38996ea43d01bcd15b78a6809d4b7f63cfe99e8b3253c61b35120a0e
SSDEEP 12288:5qJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bN:59gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1BB552358EA7550A3DD86A7F3B4EF517898183C63F70E94CDB6A530091B34B8AF48D624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 181acde362a78b4b164821b25c95778653ed61d62aeb9adad934ef4196f2ed2a
MD5 18da8debde6a47ee348ddc790855562a
SHA1 7ee59b9a9d5b1ce095b42ee13c5ee4853752af17
SHA512 b522c19fd4982bf3b3671160ea5378169bcbddf311d19dd98f19f7ad5117a7505a2ced23d1f4f08205e3a149f135b7e471945754400aaa801f441f1cb9fcd69c
SSDEEP 12288:WmJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bQ:WxgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T107552318EA7550A3DD86A7F3F4EE517898183C63F70E94CDB6A930091B34B9AF48D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 bcd094960bfe10ca5f6de48250ff3b1075601d302c19fce3c40142f136e164d8
MD5 be1baf3ec5556063afc9ed7d2fdc1ad9
SHA1 a030a07dc95450300dbf8f7a37ccc0aa90becda0
SHA512 8dfe3e88c68b0eec31226d4142979cadfbe6500a8e8b31267b49b59f028fe110c7e42bfed31091acd3872d838e524e949a9def77440e7629ac68a7b5e1ae7a08
SSDEEP 24576:fZMUzFVSOZgAW4PJ8oe9sg3r5B3lK+ubh:fZMUzfN7lPJ8V1B3lK+Eh
TLSH
T1FD750194B3A018F5ECA7827FC8668915D6B27C664B60C64F13F4362B1F333A15C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2cfa6aea448a9e5cc85bfa30c487b6ecf8b33984b560ae4846212994164b5877
MD5 69433bd8fee4ff76ff00e0ea827fdec7
SHA1 43232c70fa32c44c613867a77a9b9a0d2ea38a3c
SHA512 97eb50713e460d592b539859f3628a9f88194ead876f28aad31d0f357430a7e9c2460db949d9ab20a6d18ea064d9ca1aeff720860500b6f63023a68c4b24392b
SSDEEP 12288:wfJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bs:wMgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T138552358EA7550A3DDC6A7F3B4EF117898183C63F70EA4CDB6A930091B34B8AF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 266b7d7c50c8c1acbbe2c139593fc26d8345b0857277ad40f02d72cdf517c44b
MD5 2406899d906e1ff9884dd7ed3c60ec63
SHA1 d4fe0ae885ea4e519b1337c4a74dcbfb2f36c284
SHA512 dcd6d23ed7d70a8b4b909dc35cb053011bf096f81e98857574a674da9dee0022b1fa75ee19a6b5007951362e1ef3aeed13806524d344d8e6310854381cd33de0
SSDEEP 12288:jTJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bV:j4gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1D6552318EA7554A3DD86A7F3B4EF117858183C63F70EA4CDB6A934091B34B8AF48D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 35d56506ddd97b31ecae358fb689b772537bbf85072fe8c497c593741f3f2b74
MD5 1d9c259aea1f22246b74eb1948052cb7
SHA1 53ff0d9db6b4ca10fdc7b283a6648a241f48f8be
SHA512 9e25039df7dfac663874316c80eb90e488b474201bf44a1e069616e44b9b35fcde5cbd6b4f9b7601bded5ceb63d9426bf20f852ae55de8f5a65c0e7a2fd0e3bf
SSDEEP 12288:QyPz5L8iJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bY:hzyFgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T128650207B3A130FAD5669376C8A61A11F7717C3247248ADF63A0163A1F337D1AD6EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b3cfeaeeba9ed2d6dade18c4a197d9081b3c7b533f2a31d68f5c364356e5bfee
MD5 cd1b0b5fda06445e715b810d6c4ee165
SHA1 b5ecbe54b406785a99e541f0b96d8e03d7878b97
SHA512 4ce5ccd1ad12a297f77aa1e147406b89aed783a87fec3e81409e05c1a530ad693c24e6db11908b0146d3fff6257796cfcf5daea40c2d6c57c2ec4eff1187df00
SSDEEP 12288:BfJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bk:BMgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1E3552358EA7550A3DD86A7F3B4EF117898183C63F70E94CDB6A930091B34B8AF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c2feda3cfc7b0bf820220a1232b94c2cb4f5e8081a93ac97c5c1b8fd3d2f869d
MD5 e45c4cdca62a91f31d63eca7545ead63
SHA1 69e54889959fae34bd5e8ff834462e732dc228de
SHA512 a200c04b92e7c9c2979cd354610afdf78058e07b52726c86435e4ac63688b144e4e6e487672fe6ff62960193d60b9e81ae006030eaa69a0b3a041fe522f44c85
SSDEEP 12288:nfJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b6:nMgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T144552358EA7554A3DD86A7F3B4EF117858183C63F70EA4CDB6A9340D1B34B8AF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5050e0a5fb52a54529e9994dba341778df080469db655db28876174de3dcbbf8
MD5 d790f2fadabd6554ad32f052821be91a
SHA1 8b577100fc388afbb8dbd60de2610b713af89cd3
SHA512 41e1332dfad8aab9fe3eac9e98cc1e3de5950730de3dd3f1bf1a8f73aef8c972850b3f473cb25fba0dca0f5817a7218aeda6167f110ba84b9ec3ff059269b3ba
SSDEEP 12288:6yPz5L8iJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bU:nzyFgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1AF650107B3A130FAD5669376C8A61A11F7717C3257248ADF63A0163A1F337D1AD6EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 bc33699be7a01902b365f95860f8d0459c79c20465dd5066f336d6e873472ad6
MD5 a5ff18b5b79746df2c58c2c225c1f545
SHA1 4e086b32b9cd8a7016e02fc35398ee05f87a9075
SHA512 1992756c682f243eb85dee78e8cd05704ecf5632c463514cfc84d7a854b330ca65e35880f3ffbeda92ee541dca7cba3e1e0e4bda3227ab17f490df58eb8771a1
SSDEEP 24576:DTyaLl3z0zDDgAW4PJ8oe9sg3r5B3lK+ubh:DTpLljm7lPJ8V1B3lK+Eh
TLSH
T1687501A4B3A018F9ECA7827FC8668915D6B27C624760C64F13F4362B5F333A15C2EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 43a00ff6d3a28ba162a6b0f923419077ffa1cae7ae492106835cc3cd09c73d95
MD5 4cfb6a28e2b3917377765b1e17aa3ca2
SHA1 c9b446fc15905c7b275758b761deedfcc3229017
SHA512 5dd895f5330be56727364ec9bacfc69edf0e9c5666c7356c48a8a58bbb85f9921b07b4a243993e4a5159a2e5038dfcd40e67188c4ee87fc318fcce6769e7dac8
SSDEEP 24576:d31d9CHKy7GZngAW4PJ8oe9sg3r5B3lK+ubh:91d9CHKyaN7lPJ8V1B3lK+Eh
TLSH
T1D885CF90F3E410E9F0B79A35C8764511DAB67C9A5B21DE8F13A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 851d80cdcb446d3bfc4afeb1b1bc2717d13796ca7a04728c6ec44b0736576d19
MD5 cf76969ea108ead6354860fe537cb463
SHA1 1d952b8d714e8e8b55918aa22a79aca2f5150294
SHA512 8adcf1834b15e4d85cc6a69174463dc4ddf39fa3bf5010a414433aad68a47fda5ee35d51db4e7ac130d77056c8a27ba3a91245defbb7eabf21435e45c3bfb16c
SSDEEP 12288:2EJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b5:2zgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1E0552358EA7554A3DD86A7F3F4EF117898183C63F70E94CDB6A930091B34B8AF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9c7b9c1ac608adb495596a3c77eeef647ab3a6ed7fa37ff42e1356b18357b208
MD5 b7b73fe15892aee87c3a3f08ceae8a17
SHA1 68d95fd2edb475731894df62f42c5398d771b096
SHA512 f1f17726a2be7377f54f091749232a3a290278e0987bf03a70f0bfb56834c4b4eba470db4f602a355315ec403d6eeac93dcb6236157538da83358d9cbd921e58
SSDEEP 12288:5CJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bX:5lgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1C5552358EA7554E3DD8AA7F3B4EF517868183C63F70E94CDB6A534090B34B8AF48D224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1da14f31395bc41a39cacb7137c1fec50af46afc935b651f11b50ed859f826f7
MD5 480ea17243c4abc1fafa69ba285a81d3
SHA1 4b15d2934a4cf57248e0186330836e34d4f2c7f2
SHA512 a80f947e2dca10c174379a16d1bf0012d5f002696626e3d8515e3e6e252e745adeec539d42c03fde17fc9f5d00cc6e4b520624c42fe202d4278594b43bec3a0c
SSDEEP 12288:t9Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bT:tegAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T121552358EA7554A3DDC6A7F3B4EF117898183C63F70EA4CDB6A634091B34B8AF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a2e81d6f22c3f6bc3189924b4aa76e47bc6897058cc0fff78330e41e4866bc04
MD5 345e56567fc02db09d8d4e18a520aee2
SHA1 ec7cf805e165ab1ef3c4eed2793bae7ec862b230
SHA512 247d94188de06b7abc74ea34fc8a58a271c5ac85c4158a235190e3ceea76de918d97794340597a85e791dc6303ee79a7930d024cdf5a822aa9b061d3995b1ed3
SSDEEP 12288:dfJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bT:dMgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T101552358EA7554A3DD86A7F3B4EF117898183C63F70EA4CDB6A9340D1B34B8AF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8f14c24062a9ff2290907237ef28391d2340cd636f9006ac5740f7710ca02c8b
MD5 73b50ca1f554182a5a322f463300df21
SHA1 701c7a509942242f3ad7b4e3a76c0d5a82b38a47
SHA512 1307639983d5acdcaa60f63b61218cb9279a9140d5a31d6c6bc6c32f7f6baa8e208f41ee5994769f843b230d81ac8468435dee87ab670c006f78137eef6081ae
SSDEEP 12288:sEJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bC:szgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T175552358EA7550A3DD86A7F3B4EF117898183C63F70E94CDB6A930091B34B9AF48E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 92d5b8419f188cdf32e2883f1666868418f81bbb03d92e998950d7c540272aac
MD5 149b196276833e451eb8fdf832cbd6b3
SHA1 092d8b6543d60ee01d1db66ccac0b92522d8fcdc
SHA512 e2bd076a834c0e5756e9b976e1326dae20f5973dcc293030301db3f1eace119c24180b1607d4ea1b685297c7b22f74098bb3a6572437dff3be2f05e0057ed9c4
SSDEEP 12288:QnJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bX:QkgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T16E552358EA7554A3DD86A7F3F4EF117898183C63F70EA4CDB6A630091B34B8AF48D614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8a70de25a2d57d85a6824565768a71b8f4e7fc9aa7833419eb4d17ae7b1dafb1
MD5 5350e8901c0d5dce16458611b5a63478
SHA1 596f97dfbdb9c2c321379ad22c860f4e56f4fe1b
SHA512 14ad3f8fc3417158dbbf979b83742fa7570123d1646f56712ea7bdcbceb3401b619a1f68501098de6f7f02bc4641def2d1d1696673b51978e24eee6513705c29
SSDEEP 12288:ZBJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bb:Z6gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T102552358EA7550A3DD86A7F3B4EF117898183C63F70EA4CDB6A930091B34B9AF48D614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ce8ae0e10b9be9fbbacc4ba189334ce854c6badb0c43dd36c6d59c701b9bfdbb
MD5 b2154b864b4c338ddd99317fd1eff0d2
SHA1 d02d170ccd4da48dc8e77e3c53265fc6dd48bbb3
SHA512 eb93b266f3e2041e319d8d8e1b4e7e59dca1a87003a933e4231fc84cce4c7bcfc470e8a0334b2d332b8289a8dd0881a297bf543120158d7732b80503f21aeb0b
SSDEEP 12288:V8Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bK:VbgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T158552318EA7554A3DD85A7F3F4EF517898183C63F70EA4CDB6A634090B34B8AF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 a5395667aeaec32503bf9110fa41e4012eb782ebae4bb924f61e28576c4fc36e
MD5 f7db13ae46ddb1790db3f28bbaf6cdd8
SHA1 378aef24170a542f862e46e92efdf20845f40158
SHA512 3410c1de33f11204eb9801931e0bbd0947aa14e870f5eadbc76735ad59455d0409b4fb0f7605ed2d37137d2f5e762364e971a75e0a8f96414a3d04e0cb26d7d8
SSDEEP 12288:GBJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bu:G6gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T147552358EA7550A3DD85A7F3B4EF117858183C63F70E94CDB6A530091B34B9AF48E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5eee801742d1d4633b1a51a3c6a068d67ee9b6cf72c373271a8041c475fe1288
MD5 4e36015c03f96eceb20c627425ec6154
SHA1 ee2d9830496de82773cfedfccd46a6ab9b3f881e
SHA512 f5a3cc388a0e8d7a5e040b7003ea3fc9978b9b6c175b6a7a37faf092fdd87d0610b7d84cbe5e1eb15e183972a205a7af8d7c6e46869030d7c35f9c5ca6b79ba2
SSDEEP 24576:nfwvTk9RX6wkyAIIgAW4PJ8oe9sg3r5B3lK+ubh:CMnYII7lPJ8V1B3lK+Eh
TLSH
T18785D029EBDC44E1E1B7923D98B7460AF6B178691B31C2CF129A536D0E33ED4AD39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 963163c5f224c26a97e4c22076ca8f1cd0248a37df9862e90cfb4e6dd67c0cab
MD5 c3b5d6dd05139e9963c3b6f9a3f2600b
SHA1 6117ef9730e247e9926d857d00ec5974ac49c952
SHA512 bb1eb618050c429bd7414ae9cb496178cf7b34f8ce899655394f44bc61e33881b6142b55f9c60e60398b8a445768024c58e2ac89b3006e874108241bda14a5ee
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/7lPJ8V1B3lKZ:NySzP7U3l
TLSH
T1AF066C56A1A801D5C5B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bb983c2813a49cf086596ec0093021ac0b6a504dd6db8d4e34a910238b70509c
MD5 fb493987e2b6f5e46c58ffae780bf241
SHA1 c9bf072c2a757f644240cc29c2da29156a80ca68
SHA512 1a123612aa63b791834a08b4b8368cdb6e22466973bd8b164bbfd5d5cf6877827bfa37ff62d690198c6eaebfbb3f8e86d5b8dc4b13a6eda78535f986e5532d5f
SSDEEP 24576:+47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYpgAW4PJ8oe9sg3r5B3lK+ubh:+47JUQjTirIhCnDHUPfF/P7lPJ8V1B3U
TLSH
T17965AE1DA3EC01E5E1BA927885154A1AEA71782E5F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 800d005b5d4560f291694e8d86b172e38fe631923300a07c074709d832ce676e
MD5 bcacadd66fb5d696df74c03d7b2979b9
SHA1 d8b31126eaca431259279d9994653ab0e92cfffd
SHA512 7dc6c2280ba31d929b101c5c56d655e9c88be01d8feb169e6a8e0a60479a22c6157a8e363308cf730a2d0cf00ac7c8d44d241c12237c21ef5fe008b6b3defa8c
SSDEEP 12288:46sfPJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b2:M8gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1B165F119D2A801E9C49EA276C7964650B3373C6293E5D3CF62D0F53E0F36694ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 7e503908b7335c4706f91208368f315e72fca91440925d416cda5875ad138d3b
MD5 c2194d96d0f142e75229f0256d56edc4
SHA1 a50522ac0a62343907ed7cb3c4ade12ca86db191
SHA512 05525dfeb918e1d7ba2b11a12cba2e0858f5ef6cbfeb98cbf15c14d3986fbb83703dd9c68479abf6ce1f3a92fdf8931f3b48bdfd79720a2b65ea934883e15d78
SSDEEP 12288:m8jgJyy59DG6xjzeqJNTwvMQRxdaRRiu3oJAdtsEdd:m8wyCxuqU0anaRR7YGtXdd
TLSH
T1F1553850762AC75FC6A980325E32D1CCAB707D45EE44AF0773C8873F9576968BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2c34dbbadabe8483ddffeb805e953a916eb50831a567d114d3f38a78fa79f104
MD5 3b5cf952da22c918e6bf96622841e460
SHA1 ca48b74229e165fc4cb77b6daf69d2d0feb93383
SHA512 885924be225ea6b236a4ba451edebff9e38638c1a96d23ecae303cee6255de588f7989708ad6deaedd27aee9e9796e799f6c3ca9cbecef27c04ca1808e0b67c6
SSDEEP 24576:NS8KwiJ+7+qZ/hGpEGSuIHNSj9hs8pgHqjD34vKaODNOp9voF:7G2AD0JU
TLSH
T12375F781A137A39FD1FB50320329AB4DAB64EC06B7496F1673C8053AD87A755B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 47d9f17246a1aec8ca6c565f1b84252daa242bcf263c95314612db5c4825a613
MD5 ed54134cb4c9fc21e836e309fc8015ad
SHA1 2d4f9afc5ee85c350a2f64bc3eda21ac8f33f022
SHA512 4c77038a2d8174fffa6dd34a09217e3d1cc568b038d7732aba02ed66edbf91797a39080bf3360f4885c9c086c6012dc280bf019c45afd5fda48ca4d36a8b4545
SSDEEP 12288:Fq7XJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b4:cUgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1A7552324D7A89493ECEAA7F3A4EF9134251D3C62DB0894CFF595310D1A30BC9ECA9715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ecff39434c3f5a3675123e0f4f151de60de936a21a25fc0f7b04c3ddb4906c43
MD5 0b6a64a78448903effdb377c3f24df52
SHA1 d0581034f12a9632d53f79444a5c00898e4004df
SHA512 6f7eda114bc7858bcfe7e5abe9b7a81c9cb67758e49ad7f417ad8e370dfc87cc8702c7055fa903df07156144e7e7691929fc87cb7fd4f14bcde9cf5376d505af
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYmgAW4PJ8oe9sg3r5B3lK+ubh:6gb4mBIBhGFp7lPJ8V1B3lK+Eh
TLSH
T1D265AE1E22EC02F5E0FAE2B8DDAA4417D6B278125731D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c9dab4e1c3dfa6bbbe6eb0dfa51c350116c6a0e0820acd74944e9814592ad1fd
MD5 ca2c85b4abad949001e38e6b329de002
SHA1 6b80bce23b9a9f8f5a9318ea4f8667acde42482f
SHA512 8d1b3e0389568bfdfce78be57fe77eefadf48af3d3a2f6338c62bc83c23acee7ecb79585e5abee421ef43b165847ab928952b7dbb163356a328909e89e482e79
SSDEEP 24576:bG88u8FpJqH1gzria7/mZgAW4PJ8oe9sg3r5B3lK+ubh:67ZFPqV/a7/+7lPJ8V1B3lK+Eh
TLSH
T17785F165B7E001F1D87BD13889864663F6B2B8210364EFDF06A88A551F33BD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a22d9edcba6023755dfebf100009f1acf8bc6b119fade06641676300837ff41e
MD5 2a0815f89d39668e4f060f02e59ce590
SHA1 3870fa7ed851541b28c76f7c340af74806a4ba06
SHA512 4ffd71089adf4003a76f1ec81c1a4e85c9d70becc45355cb47042b6673cd2494fca9e09937f42b8cb7712f712a8e8ba10bbcfea66de147dc440e32a07d73e5fc
SSDEEP 12288:gHvUrBFrEjwaQ6Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b3:gPUr+NQNgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T15C65E12E66AC18E5EA76E27D85864619F77178625312D2CF02E0913E4F37ED8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a2ead946e5d141481fddd72a6c7153c76cacd70c448dd7d038683021a5bade9c
MD5 0500f9c655d7ec98890f76447472f845
SHA1 e92ed6fc58243ceb62a235b63ba4d5d1a2c2d963
SHA512 6f47540213784d042651b5138bef6d5a91b7f8cc52208fc4855297f501acc1933c2f812391c0624af5974d89a168b5cda5a187833aa6cbfec833e0f18fd44fdc
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj97lPJ8V1B3lK+Eh:CG05lO43bqU3l
TLSH
T1A4D5CF6E62EC11F9D0BBD17CD9C6460BEBB23815032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 40197ddf5348fea358508e8cbec8f2e4515a4c9b87a880132e81408ad70d2a47
MD5 053deb20f5e205e53e6144deb308aabb
SHA1 593ee1d4db2d7bacfbb180d8ee770efe47f7fa03
SHA512 b5b42fa3092e5ca6124a9b458b602af566ce385c43ff57960c51200d8bea1d69855493d251648e7e3415cc48aaac3000b7452da68162cfed3f4cf5a6306af57b
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/gAW4PJ8oe9sg3r5B3lK+ubh:ja5POZ3BJt2pasx2+ml7lPJ8V1B3lK+C
TLSH
T10065AF5EA6FC00D5D5B9D17DC583461AE5B1342253329ACF122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c385d7635287901b9e46cb72699b4af4c472debdca60f39af062713a3093c294
MD5 834b2003aaf3900d1a1a3e84ff67fe43
SHA1 e71a44bb303936ec7e9412406dbd0575bdf3d522
SHA512 e45786e3a09fa236e5b459e74b9508e7f3cd84c7a26e49558ef6adc832aa1ca3c41c0c2e417da1ef2553e8a54e3372ffc4682faefdcd2a0d52a073665ee238f9
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkhgAW4PJ8oe9sg3r5B3lK+ubh:hNc/zEOVHFe7lPJ8V1B3lK+Eh
TLSH
T1E0858B1623E901E4E5BBE1BE89779546FA71786553308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 18d1a8c4ea6375ff16a612c10714d37a2c72ee08b46e8fbc5594900c6385ae35
MD5 062a0d50affe18d81c01c3c52c5a4b6f
SHA1 cc31bc5c6c70313c541cb9eae6cef0d27d371d28
SHA512 6a7f5eb7b9eb5039b481a2783eb7a36ed432344ae916a22e312dee4e182a893b225c2fb20504017de3680cab5dceaa01fe95a0eb17039c9a6116fbce3afee7fc
SSDEEP 24576:GTkNvNnaFeYhJNtmZBmbgAW4PJ8oe9sg3r5B3lK+ubh:GTMwBtOmb7lPJ8V1B3lK+Eh
TLSH
T1A155AF2EBAB845E4D1FEC6B5CD238512E6727861173292CF5290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1f75a7615e90c560ff9c451dd90f39d244c996477742fdc197165d23470c58b3
MD5 891b7ea9bc8b8fe100a8e2ad05a3879a
SHA1 3c363ee591a4213a32162ab3bf9a5462f0884a87
SHA512 cf89e600d06debb962c1907d9f382f5d5b9164a8df08a86dfc11527f4b54e7a83577321837fe9f6e33a5c382b4314ab8ac8e55d468c34c6a0167ec08d571536b
SSDEEP 24576:LD3FHshBIYQgAQgAW4PJ8oe9sg3r5B3lK+ubh:LDVHeBIAAQ7lPJ8V1B3lK+Eh
TLSH
T10875E13DE6AC04E5D47AD2BCD9A38606E67138A9032265CB12D4917A1F3BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1068-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1068-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1068-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1300-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1300-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1300-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1300-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1576-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1576-138-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1576-127-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1576-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1576-133-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2760-369-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-382-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2760-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2760-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2760-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2836-370-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2836-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2836-113-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2836-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3420-108-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3420-101-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3420-364-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3420-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3420-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3760-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3760-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3760-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3760-366-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4076-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4076-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4076-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4076-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4260-312-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4260-77-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4260-6-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4260-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4260-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4260-8-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4260-310-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4660-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4660-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4660-38-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/4660-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4660-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4660-52-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/5560-368-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/5560-78-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/5560-79-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/5560-85-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/6088-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6088-54-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/6088-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6088-294-0x0000000140000000-0x000000014017B000-memory.dmp

Download