5a256cd754d93dbbf4a76aaf8cfdcfd11efc75f6fd92d56825ef0f0b0832569f

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 774KB
Sample260831-afhtlsvsgt
SHA256 5a256cd754d93dbbf4a76aaf8cfdcfd11efc75f6fd92d56825ef0f0b0832569f
MD5 fbb0894e8d3fdbc2e72aec7b31246577
SHA1 e98d09745203aaaa88704e4af5c3ae9fdf29ef87
SHA512 49415dc3d0e8efe6ed4bd867b3fac5186272a51f4a41d5ba0ef5bb71c6ea73ad36efd41494913e1af9cd1a39d63be2a2874fb90a1abe73e591746bec3cf6996d
SSDEEP 12288:LLm8toECjKaYwZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:HPtKYy3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T150F402127B94E4E9D2268570D19185F9EF32FC30C7358A2B25687E277F366E09C39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6004	elevation_service.exe
432	elevation_service.exe
792	maintenanceservice.exe
2504	OSE.EXE
4572	PerceptionSimulationService.exe
4628	perfhost.exe
3312	ReFsDedupSvc.exe
1468	SensorDataService.exe
6016	ssh-agent.exe
4184	AgentService.exe
4436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1b70f44ae05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac0b39fbdc38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad8cf4fadc38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000771dcffadc38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f75b5a3ddd38dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037a3fefadc38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c8a9ef8dc38dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec36983ddd38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003ccbbcfadc38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6004	elevation_service.exe
6004	elevation_service.exe
6004	elevation_service.exe
6004	elevation_service.exe
6004	elevation_service.exe
6004	elevation_service.exe
6004	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6000	2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4184	AgentService.exe
Token: 33	4436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4436	SearchIndexer.exe
Token: SeDebugPrivilege	6004	elevation_service.exe
Token: SeDebugPrivilege	432	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 5336	4436	SearchIndexer.exe	100
PID 4436 wrote to memory of 4940	4436	SearchIndexer.exe	101
PID 4436 wrote to memory of 1360	4436	SearchIndexer.exe	102
PID 4436 wrote to memory of 2864	4436	SearchIndexer.exe	103
PID 4436 wrote to memory of 2592	4436	SearchIndexer.exe	105
PID 4436 wrote to memory of 3148	4436	SearchIndexer.exe	106
PID 4436 wrote to memory of 3648	4436	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_fbb0894e8d3fdbc2e72aec7b31246577_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7d63be1bda8b25535794d48e84975d0138ac9d11660eaddc30ec05d788016605
MD5 7a174d925e56ea20d1f1e9fbfc563848
SHA1 319fda1e916e5ff06667cb9049e73c9e57d3633b
SHA512 bbff3a4087789907200f5086d246de1b763a34e7a388c1375adc8bbe9ffbe48dd7e39c47c3fc97355675ef968b595198f32c789a0d3a8167fabe583976ede48d
SSDEEP 49152:6b+632BuPkFKRrdE6ohvstBhuXjfS4LWxntKnAX1tIc5foj3:s3q6sjBy0Okc5g
TLSH
T124D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c650e992b9760b398d8f8c3485aa4c89ad3eec3e0eea2409f72905db4fc473ba
MD5 a2444743465c60b64bfc93644d504ddb
SHA1 15182d19f3cb0d22a73d15ca6457418fe432482e
SHA512 fe6734645c0738d183e663590c0435edfd71828a4fe076b8172e091c323332f10f7721fc114dc8b31f4e4fff2547644b4705a93299a0bd7d899e5f9b28f0282b
SSDEEP 24576:0XYfDtczAA3KnAoIBlEq1tIgAWz5foj3Z:ztcTKnAX1tIc5foj3
TLSH
T13305012477E408FDED678238C9B28406EA33B8514770E69B03B499266F377D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6bc11a59c7d3413757c3e67807b52b0f90ff7db220ab6bb894845d0a3f8314a0
MD5 8e0ab0b85725e71ab0a8697ff5f190a9
SHA1 b80e3edc9aafc1b3818c75c399435ccbf2b46704
SHA512 d49a5b0dc75acf4dc8639e1761eecf2d0c802dc59a2a28bec7b63ae3b1bcc2e9db5aa5db32499b4a68728b915558320f3fe6af2f703453abb37a6ce1dac9d373
SSDEEP 24576:o0Le5ji0hmxxrMV3KnAoIBlEq1tIgAWz5foj3Z:oPji0Aj4KnAX1tIc5foj3
TLSH
T1CA359E26F6788335D073C0B9C5D2A68EED7130825B3089CB4296D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 646a7ba42b8d1eaf5aa42294c371b9cf1fab8d6f43a3817f76fe439b1b7ad768
MD5 b223399e11da1a69568f574fc931529d
SHA1 2d07d9e09e7b565844da77b2c42f1e6d5b724442
SHA512 360c7a4821bb8f38d13642893368d2202a822dbd45f104351d95b7a5f06ba332616c07e09aec9ca90698fc1fc0fb724abe5c84ae06772c786cbbf83d3842beac
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuj3KnAoIBlEq1tIgAWz5foj3Z:M/ezSC6vUzPveHjyMKnAX1tIc5foj3
TLSH
T14F756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 303a6da5903536c642cbddb6c09dfdabfe2f56d7b4b598003a2002b593e8a2f6
MD5 b75f6cdbaf78688a54e76194707833c2
SHA1 e9b8546355c3fd324e54bead5c339dc408e27f53
SHA512 fab19e2e9d1e62d452388e384dfb19eccd96bf8ec1ad7dde5fce17838c180df3031130fd5106ece3d3935c4420885102f6f2d1d84dc550cb0232858539d59785
SSDEEP 24576:oVbqPb88hv/l+YM3KnAoIBlEq1tIgAWz5foj3Z:oVO88hXl+rKnAX1tIc5foj3
TLSH
T118559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4f6d42ae512b2b517867e81e386f451424d75800c9e4a4b94ab84ec48d039b98
MD5 2ba026987a434a8d87ce751324f22d34
SHA1 69f7a8c7fdb7defa3129345ef7e744f974a719d9
SHA512 c74cce4725975192001db24e8a073625d82fbe8860a2561616f08a1b74545b648a3ab9cde66382c44ca2653222a4ff94513606dd5a77a5c472b8dafeefe85d5b
SSDEEP 12288:1LvZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:1Lx3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C8C423217B5C182EE7674631A2FA684AFD75DD70453A48232036FD17B63CDA0A83F276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 83d09dc86dc7c32d1100f1653f7f86443b5da2a38026992d1a7ca0cd41539b16
MD5 e4dd5a9fb81bce5051ea5c014b61f671
SHA1 72c74723cc1220cd2499f8dadf4f5b0ebe33804e
SHA512 87665b73e8361262c106c3f74c4db32544eedf1f381e5a1395476372c6244b5bee341c2dedb5a6a67ee4741af8206fca06bbb162992e7d28f1028b3e45232bab
SSDEEP 12288:ieBNUbTVO86UCZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:iJIUE3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T12105C037AE28FCE2C27A8D7957918640EB7278304B6293CBD175C20EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b04b3da8db0416260de1ddfad607c6f464c7108b0db27ab94ed5877db93532f1
MD5 baeaa72d284b0f1c63487431f8416bfd
SHA1 1682ae5e0c26e476e46f7921e1251a12733ac883
SHA512 902ac8024550d8f7accac47027725648a311840346ec65ddb25ea74290e213fc8c9f7b18b6221dd32bb4eb3680963fe03705a53ab72ada64174f8ee2011197e0
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:3QvGAdlCEL8c/DRNw5Cz0Okc5g
TLSH
T143266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6820741be9bf593aaccb957f5ab3920fb9afd92f7f3b4640c5521cd32457944a
MD5 662978f6bac4cc7c8ee8710bc1bc6c07
SHA1 8bf013db108243f9d3a34f5502e678af15b61e2a
SHA512 b8002cf2abfe835ebbf06c27db2a44f20d3208edb9e77e6b84a94f7cf0fcc6ff93a4ee7f2373afbfc67677fb39b0894e783a02ad0e94b49793c59a42edc3aea8
SSDEEP 12288:UAwSfxL/2Dc3RDLLmt0LDQewsAjoZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:p0ewsAja3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T19715E031FE74E436C27B0DB21B76C716687CB9204B6119C3E3B88D9E59346D22736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 042e0d427dd5492c34ac29f6e624e746ca52f67e9182e5cd55535bc8e40417ce
MD5 36706e2abaf43e595fc000000227760d
SHA1 fe1fa0d1060a5885ab4b7126310db4a7d3d1a0b7
SHA512 876da4e75b319b33d0872013321e731863ceb505a39dd17edfacdf64391820eb48480909d415f7384213698e7711fed26ecaa956114c4e8a4f3d305e7ec22f85
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHdOBg:lUEtQevvqc2W1cpV2tI32I
TLSH
T1A1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a1650825bc9037054973e5513a0de4d512a03bbe96648509b9bde68cf79d35a9
MD5 1dbb8a864af13fa12fc4e9cab2a1f09a
SHA1 c0058ee0f238ee02d71f3774bde0d13c5bff0c21
SHA512 79c378c3e39b6f0917467a3e71a3c50f1e5336c17e6fb837d0e7e43e18bb96a7b9f24a271db4b18b3b8e49e88e2596390858be5899f93f4e493875ae85f5d21a
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zIKnAX1tIc5foj3:JoquVjnmH0Okc5g
TLSH
T1FAD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 58d1b13e45debf3da70aaf962e762fce03542e94f7e38df1633be0b4f2f11291
MD5 b2c6e4417851ff258f5fee7f1fc0226c
SHA1 d6d92faf359c910511a2dc5c8d2a36f361f98f49
SHA512 45461d1ec3a1e2f78b089e42787fe5580e1de90ee835fb2540fdff31a06a25135af763d2d6e6ca64cd6159796487a53965a0b94800d5c58af405cf1e727eee8e
SSDEEP 24576:pAhGL3IFoiwtA5l7S5333KnAoIBlEq1tIgAWz5foj3Z:pAMUFoiq53KnAX1tIc5foj3
TLSH
T15735AD80EBF945D4F5B3AAB899B68171EA76BCA55E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3f2799a674c2b0c5196696d047a439983d064309cef3a49c0bd0f16b118b0eb7
MD5 b9ab439e80320c23ca35d8ac8900b9e5
SHA1 33a09b96c4760ba1f9650ab9f166091b487d4396
SHA512 1c044de0d8bf72f36083739cb5fe17bae65d891d7b103be890c1ed29950bbdeafe348262d5b537bbb7330c1942fe68c54eac3e7096ed8f378cdc12e2b8c2f89f
SSDEEP 12288:kmw5HEjsChNVBFgl0WDm+CRZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:Bwu4OWu3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T17105F14537A80CF9E9678239C6978536FBB2BC112A25CB1F1370C61B6F376616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 159f88c86e07ebae4c2fa6463936c59aab6058398f28bc57d0eb160ed7a9a856
MD5 a36c2d6ecfaab1071ac1aeb213596c80
SHA1 50e7d9f9f9689792dc98df7c3ccff0e169f6929e
SHA512 e18327e080076c4f5e4400c086b731d63163e483a34bee2f43389d62cb5293587d85b62fd4211a19b17b90f957f729fdcf25e0737858e73e60f348f3e8e7221f
SSDEEP 12288:GeZ1IyYZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:bZuN3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T18EE4125137E824BAE2A34238D5F5594AEB72B861133643CF213586577F3AED16C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3947a083b9654523481ef81ada9e2e2818345354c48a907876589c8556ef5db5
MD5 2b787d119c50e2647276bc13472c3bc4
SHA1 4b27c384ea38f24b4ab72566c4740a9f604f49a5
SHA512 6a0877b0aae33969afcc2bbb55108c939b4fd45920d58c2cb8bacdc85b5b7a7672860983e750cbe3c741e081b4a336d68dd391be7e50800c715175e6dc0847ee
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:zQRQyi36YOcPbLvw2gAf+PN3O0Okc5g
TLSH
T172667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 92d6dd21dc61b2e4663b19d94484bcdbffcff23492c643e41c24f6cf03acbbf3
MD5 e6c1eb9b9540bcff7c5ba276b06b643d
SHA1 86fbfb9b9c5677361ba55b5440f785fe26d4e5c8
SHA512 9212842a4e6d6cb8600f228bc941a362df95192104c4f8f8aa57a3fd0aa0b48b5112df613d1bb48ef6ca74a5fbb3b57e204a163d1312fb0beed5065078850033
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:/QRQyi36YOcPbLvw2gAf+PN3O0Okc5g
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9910f93ac88b3b96da4bb5ae6920d75c1924de4a14c33cab8bacced63474a133
MD5 47ac20d743b4f5b507bd92a508fafc1e
SHA1 251484f9d2c16b2c37d438cb53019380053b236a
SHA512 362ea6cc3b637e55eabaaaf11f95644c6be06e692e04ca5878fced3c064ff013b7474b0255b2e56e73c5facc7a64d123b69b2651633698ee4f26955154cd9753
SSDEEP 49152:168Qg55nhceWu7PNU3/4KnAX1tIc5foj3:DthLRc/40Okc5g
TLSH
T1EAB55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 315fbf1bcc5b1ae7253108736bfc5cf0a2356e7733cf1692a9ccfb5f1bd9e53f
MD5 72038e829f09d02c6a12ef5bd7891ac5
SHA1 6888f529cb6119942f8d36e74baea7d97b7861ae
SHA512 375ce760a859f204adf5619b2a5ada467895083c20bf2953c4a45e6c9dd1a5e38e4eae64f1a5e932143d19418383f3ac4fce9476127200c308302dae0ff5677d
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99t:Wy5112gYy5azzVvt69nLKnhZR0Okc5g
TLSH
T1E8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 41075b46ac0614fcdcfcd580d8408719cf94979f92f86227895080cccbbc266f
MD5 c70735290d39f3d1fc63ef3b5b98c11b
SHA1 9094290c39ab7fc8259f67c76c88e8defd5c32a0
SHA512 68318d6eda7c59d23fbb461de98cc5d06f87015d9d99b1883344dbeecedf5f41de2fd21acb3c61eb7da6029466f9aa45d9b9f900c5c77a26ecd1ef5a419c33f7
SSDEEP 49152:XB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGKnAX1tIc5foj3:5u6Jmdxd2dG0Okc5g
TLSH
T160D59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5761ada920718046d00000401ad9d9038951bb636ac10252ff2692fe7cdf91cc
MD5 3be86b2a5a66b258b47319d05537c98c
SHA1 f875d4ee64e29933fe05b2df3ad879fdabb846e6
SHA512 11ddb6ec274c5d6e32e97756d5f6cb7eccc353782d046ad40c9edd2f1fcf9b58cd0bfb40797c00a678caba352467542afe6f9e4b59de617e74c6842bab5f81a0
SSDEEP 49152:G1hpsNoJpF1A63U44CwH7R4xaKnAX1tIc5foj3:GmifPWRH0Okc5g
TLSH
T135B5AE13F2D800E8D05ED17887569632EA62BC450B35B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0e3f28614ac87def37cbfa0f1590169c21a2c2698db8554cbd03204c84fc7a55
MD5 7c57acd95838b28696ab53cf37f75d07
SHA1 d1faa3f55c13b87b554901c34cfab6a2fef680b9
SHA512 adc256eb38d7979bae1ac1ce20bea16c3d48d0049756ab09bffb535f323071e276b0a59a3ff2555e78491c3ccda54ddbaca2744d4281064fb5d2d99d54736d09
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHqdKnAX1tIc5foj3:M5dKii61d0Okc5g
TLSH
T177C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 55faac390ef48be64d2375abdba8231824ace4d5f0b434aacc0dcff92759ff0d
MD5 ef1170ddd13c6af41b31a7599278387a
SHA1 0803aa153b35f0d8e339dae00a6afce8f3f4682f
SHA512 e18662b05ba42069324449b6b0c81c492c83f845444b7bd519dc252eeb0de3b87face53fd30d67cf486e197ff5b06ce194939d6c8c7fa75e0c695d4912e2e601
SSDEEP 49152:xhtSn8EApI0fig3giDn0AP5w2KnAX1tIc5foj3:gX2imphb0Okc5g
TLSH
T1B695BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6b4dd3474051b044e478774d4a1b0c88c69a46d094132bc6b298900582314f48
MD5 7996284a6d000d4cee5de3b0aa81a0f4
SHA1 356ede3bfd683c5f74aa58e761ce59a46827352b
SHA512 6e3401072e57c75e40eaceac350d5de7352980abac96c0068e43f53cf8f1337bba4b861609b8006139245a70d2af56d4ed3646366f52fbd0c6446a4e45fa2b66
SSDEEP 12288:yXZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:yp3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T113C423217BAC082FE6538671D2F6548AFD74DD74453A4427313AA813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 bfc5c479e5f2fa6c7dbcaf6188edc24ffcc124e0de0efb546a4e2c50a5af90b2
MD5 7e30c5863e14000a1e49689121fc25ec
SHA1 70cc3f12fc8098564d2074c5fb57d6f3a8ea95fb
SHA512 c6e80bc3405ad8557cedab4c22e35bf9e06657d4010f5351b64b7798a985df37b3c4a85446f7351f58403a2cf6a516bb0d4c4619e6240928c0c549fd06c46032
SSDEEP 12288:NcZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:N23KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B9C423217BAC082EE6538671D2F6548AFD74DD75453A4467313AE803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c055b6b545e9857604c2618af4013c173c8607f1587b185bc8a3212d9c51d255
MD5 a81ce5353338dca436ba816f958e4632
SHA1 e299f21016fc0412a3ae94e89754856d0a6740ec
SHA512 023ddeb9f70f443ed1fcc882475a81a5b0ad092478d3a2048a049a616e6369ddc295d370fff244d348c8a3c087ec793a4321ac42a446a8143f1e5014a1126e91
SSDEEP 12288:xKZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:x83KnAoIBlEq1tIgAWz5foj3Z
TLSH
T174C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 aa7e7a90fa65b8ff3718fe062963d6f906a7d36ac7a898904439db4c3658536a
MD5 d4fab796d6f591bc662253769a77e16a
SHA1 6f849509912366fcc7eed57f891392653dcc347d
SHA512 4ef98ddd52ac7b2b87690f7ca0211b38edf1f87a9a994e7d394a3bfed2aa8182cb12363cf5beeee0d781125f370acf3dc4cc7223091ec264136f36eccb72df82
SSDEEP 12288:sVNZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:w3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1ACD423213BAC04AEE563C274C2F6544AFEB5FC708636446B252558077F39FE0283A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 9d5f4bd150de1139342c846c925d9aaab055a6acc488cbbb4acf152b08b05ac7
MD5 679fa3478259157949b6b6eee09377f3
SHA1 6a5d15c8c58892966d7ce99bdf00198ee350c5c5
SHA512 0b748c8dddb01eee33cb3ed074225bcc6278b2b7893e99c6293a82084ab6798cac1cf175da2cf7a34f204d5697ae325aae608302689c8de3d9987ec7db9d317a
SSDEEP 12288:AlZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Af3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T134C423217BAC082EE6538671D2F6548AFD74DD75453A4467313EA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ecdc8b811e9570688ea8b69cc18ed8e21666fad8aa2e37075617962c393e59fa
MD5 e60a9e548a8515c0176f2f594d86053f
SHA1 0395c6f534c7d64105c18b288dcf3b52250e5885
SHA512 9f89065b3d38c9bd4f0f1ac206a9f5b30e7c5e10eba69eec1dc1edf33ac5ff529efff3a9826bb4168fcc6e71551c6a002ba676d18fbe5bda7ba51e97f1304e61
SSDEEP 12288:YQZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:YS3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T18AC423217BAC082FE6538671D2F6548AFD74DD75453A4467313AE803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 19e8dd0e8e00df2a4e43eec2749abbc373912c121b402350c25cec71d79f8b4f
MD5 7fb1924530d06702af8c50da405be1de
SHA1 44f5db8fc934cccf64ff77652fef551a8b942200
SHA512 5f0d2c608c1e79daa583f162e9557c7147e0579ac902f448d57e34e5890e20a702991ed05958509a038a1ba414feb30f4721041922d49a33a2b19badd5b70324
SSDEEP 12288:o0Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:oe3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T106C423217BAC082EE6538671D3F6548AFD74ED75453A4427313AD803B73DEA0283E6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6fda47955903fe5aad1d1654d169bff3e5c60828550a72a93487634c04dd8461
MD5 a0f7f7f1ca168991213fcfba4837f857
SHA1 4cca7a87f849198078be3eee2caa6555c4650cbc
SHA512 efac1c831f87a15102bb8dac495d3102fa166c2f5d6ce5847571d64b7b9c764144b4176536ad3955d2aa1acae3b64862df3253e9312b630ed7d80f831f5fc4ca
SSDEEP 24576:xZMRzFVSOW3KnAoIBlEq1tIgAWz5foj3Z:xZMRzfQKnAX1tIc5foj3
TLSH
T15505F161739418F9ED63823EC9658906EAB2BC650770C51F13B436276F377A01C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3329c230f859d89dffa8c8a0c2789985628328f47339baf3de7a57eba360a743
MD5 f7ada5af3bd76e7ee05265c4e44392fb
SHA1 f6f98340aaa03c3533f8b9b5ca73d6feabec4e71
SHA512 a83eec769d5301bb5b8043465348a76a16e0a1879588ae1950f78975c85b8490f5e58cac2f94232a0343c6a0f7475b5dd6da8d8ab26f819b2fe9360d921baf1e
SSDEEP 12288:VTZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Vd3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T132C423217BAC082EE6534671D3F6548AFD74ED75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 324c52c6f3443a2b9df73fd656028f073474c37ba966db4136cc00d3311f67c5
MD5 5c479691f7f07b8e46f055ac88659571
SHA1 aac0fdd6db8e962331bc62287da1979e71ddfbfa
SHA512 07234039ebf003d188e47faf8b100fc1a2ada7c2a9c2b6a7b70ab84ca966df5ae634e969dfb97aef63ae98497d147036819016ded961698b0772a9b9243ef12a
SSDEEP 12288:vfZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:vB3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E7C423217BAC082EE6138671D3F6548AFD74ED75453A4467313AD903B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 21c5af8d42ced786c053934b6e6e2f924b85f57a1acfec21fdd1f748bb60c798
MD5 90e72ae42d0d3f1e2f4e5d59f0b4fbde
SHA1 598fef36176e229f61d44a0c19984bb5f2fa82ed
SHA512 74668cbda4e6514e6459b28835a8bf8e07523d508574676fb200027a3fe7bd5be786f0a98abadfddc14e63230745e5c2bfa154b05cca631c37ad183467e21743
SSDEEP 12288:ayPz5L8YZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Hzyq3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T197F4021377A820FDD1678235C9A21946FB71B831473589AF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c3dcd9714cbd26a92947a0cde4d0f03849f8827805e9a2308fe8d80fcf05dfab
MD5 6414d2fe874d7414dc66940d7e891ce3
SHA1 8528d1b4d0070abaf2e4081401494cd6a4a9eb16
SHA512 70ab5a11e9d23cfd80e91037a9d51e3e39e84043f9cb72ab83116a3c596e163b0e6bc521a39daba2b6a6def6bca792402defe7f9cb199c1cc3848bc62801ea1c
SSDEEP 12288:oTZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:od3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T190C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3f64ee92fc03de49f24de5fffc390ac1a4ece3a87e4dd49b610e6ba62ece979f
MD5 c7aa3aebd1444078525e17a06a20db06
SHA1 f8f6e63331563f9268115044cddb500c6694cdfa
SHA512 d7df5d8fab001e5c4cbbd97ba8adece1545605157142216479e2f0e23a4b2e8df6ccaef03dabf75ccc97bb485523d92ed5f64d506a51a25c896b98bdc6922a14
SSDEEP 12288:+TZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:+d3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T106C423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 18e9db7c3f8ec4ed89a16463cea52fa68854a07fd774a05d98038f97aa8c21c5
MD5 31e7812b624ca6f549146c04669ad670
SHA1 962dabe0d5c9bc89362285f427696428635aefa8
SHA512 f3aaf583d9ac585be1d4192d18c8ce97fd932f0a3d252d7505d036205215cc55c79fbf810b09f8eec852069fae5cd41e44031b667245f8bc0c031f2f2cbca556
SSDEEP 12288:dyPz5L8YZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Uzyq3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T11DF4021377A820FDD1678234C9A21946FB71B831473589AF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e51f27f7c6d9d5e1697300ba5cd348b58e3ac1be83da905fca62f414e87eab18
MD5 e063042ba15bf6d518398a5ba59886de
SHA1 4e54eb901937fdaf7867776db08268bc6d356879
SHA512 91ae69af6883c7cad3ebe8281d8e1b00caad92ba49a72928f3a4919cf2ff87e742d8fc818fffc137c11eb964627103b7e3a54815c4e537a9918bbe07460ccf98
SSDEEP 24576:JTDaLl3z0zDs3KnAoIBlEq1tIgAWz5foj3Z:JTuLljDKnAX1tIc5foj3
TLSH
T17505F160735418F9ED67813EC9658906D6B2BC690770C61F13B836276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 65bec93f906063f6aeec5086c698b1e8146dd5ae4b08fe3e896f80a3c2cb1418
MD5 f9376decd1f990a23482905e77c266a7
SHA1 c1404ee0ddd6ccf036fa04fb46fdc7658f7ea97c
SHA512 f11cd58df6658e3f9e589d3958e245556f13e0a69dd260154f5813002f370a4c61234488afca96dc72ccf2bbddb295f05ccd7dba8dad2fe1e81b0a0ba3fcf174
SSDEEP 24576:P3vd9CHKy7GZY3KnAoIBlEq1tIgAWz5foj3Z:fvd9CHKyaQKnAX1tIc5foj3
TLSH
T11025CF90F3E814E8F1B78A35C9765512DAB67C691B31CA8F03A4651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 93d7198f6865ed757349324d238773f6d5c40b71383336b6d8234dacb836897c
MD5 7945502c33f96a457a42170f51d1a1c9
SHA1 aece5637d071a9b40ce0790ab499e4a9c6005089
SHA512 b8aefdfc99ec270b33ddc47092420f8176661977f7facf8754fee72e602b01e8a26c6cd755309f82036cc90ba112f74211a01b27ae37b86bd577df1e37e2dee6
SSDEEP 12288:kqZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:kc3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C9C423217BAC082EE6538671D2F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 c13c8667d784b8fcf0e655b03c56f32e3c9dbed9bcdd29d37ccc57305f1aacc8
MD5 ab28a92c155687c9a2fd034219eab77b
SHA1 d96d15cc68434e61c03f942922a199b3fd44795b
SHA512 8b38b2bafe0d691ef209031f3392f7e50a94074fec00a17e3c0e40edb7bb19b2dec9c05822a590dea22a3abcdae23cac4fe0f7364fae7a420af4a32ce4998362
SSDEEP 12288:w4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:wK3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T13FC423217BAC082FE6578671D2F6548AFD74ED74453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9d6e5c3063b824dddd4ea7fd9fb8dfed5bfc703533795671b662340f42ae2af4
MD5 86bfa06670e3029c80a7040402791c54
SHA1 0b5f7c6d23e83ce36b4055c77dd44e6347ab1a24
SHA512 1beffdede970b5a88f2d4e29c520c6ed63a2b626e72b21ffad423964302ddf9b7ff5e2ef6dc6f3d19fe7a1b00447413c7098fa2674dcdf147cf9af5f16f5ac56
SSDEEP 12288:6JZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:6r3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1DFC423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 fa9a7852a0d1a2917005034565e30ba6cc3c5829e125b74f4ea9109431f7614f
MD5 56f4972fc27cecbc6dad714d1354ddba
SHA1 cfea73e1d8e56cb3eb73d9b90eb5b7871fc21349
SHA512 9519a8f852655a48c65333a5eb1c5618c5ea605ad9f841b74faeafc6db65ca1044257346f15386a99dcc591b95c4bb91d2cbb2e098ad55ca57649997aa49f2a6
SSDEEP 12288:wTZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:wd3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FBC423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 6d94f053566b39985f39c47e84b09f8243b346ab74b93bdb7bed7cf49010332b
MD5 6cdeb66b11bd88f208cfe355a22599a9
SHA1 cc8fbfbbf2c645fda2840b130ddaeb7398c128d3
SHA512 7c921730eb213ab7952efaefe3b46ca82a68d4f8f44b4151b0ba3758fc8e8e7e1973bc5bdc5a77df6d9ff2801fbe0d2a605cc57d78c2d2e19473bac15ecf26d6
SSDEEP 12288:AqZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Ac3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T19BC423217BAC082FE6538671D2F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ac9d89bee4ae69646eb8ffc747656c5de9afe484ce283f1a426e0cba28414827
MD5 727f6f23ca4e5282d4a4948360220cb9
SHA1 2c6c0ff290ae0c35db2ef696a58f06f7311ff921
SHA512 525343c894d6f2d1cd59466b61a9ed00545e6ac6339ad8a80d2ec40a5a40534d3c3163672ead570d8ce2148a2395c23ae7026b6c64f57b24dec8c8d0bd3aa65f
SSDEEP 12288:rrZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:rF3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B1C423217BAC082EE6538671D3F6548AFD74ED74453A4467313A9903B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 09485d49f1c4153cc521dab54df306fb4e3b3e84bcae40ec1d18dae76a2d0fba
MD5 fb38925d40d43f4330266e3602e710cd
SHA1 46e95f6522bfd5844ef2ebc0aa804b1a34219bf2
SHA512 69384455d33052950c5fdebc7e0787ca75b17f4253a748ab4961463e7ad4bdd6b34f55dbe1ace7bf75671bc55c38d01df82620e03df83447f1e3ea9b71c6454b
SSDEEP 12288:slZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:sf3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T128C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 02374a95773f151f06cf07f5a5e3d32b5ef620113647669fb19c5604dc0dee40
MD5 7f4032e3ff024c9505d5942e20cd4a86
SHA1 f4df7b0d80995b67e9f20ee1d4b5228f6be2734c
SHA512 a7ed616edf1adda4f101b7670c3abea3eefc833a787ab4df019b550ac5d95c08a86907ac7ac32a145e33316e712766467ee5b463e9dd9ec13b226ee5717e2fb7
SSDEEP 12288:gyZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:gU3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1EAC423217BAC082EE6538671D3F6548AFD74ED74453A4427353A9903B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 1c7a2967e970dd894e756f1ef26dd65f02fb69e5a7c22ea32d5628b51e312fb1
MD5 6d77b50de2654705478a4e74bd477683
SHA1 871e073b94d6797721bd510f997d5f89bbdda1bd
SHA512 da9fdae8521a577975e573ed0ae9f963838c0ef1358a16ba9e26ce3deec449b089612b2d63389e81571f56bb40cf94eb86dce568cdffa51fd4de11d1fa760eec
SSDEEP 12288:vlZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:vf3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D9C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 1cacc9b23e5a372127d9eb9e3293d8d7f30416b6c1d2c944736575ee3578ee43
MD5 3cc5b9bd532e69a8fdba9d2506dc4236
SHA1 de869551e494d521ac3f05965be2a6a6efff03d9
SHA512 1fc59f940d25a6803324ec5b6200e9c4d8d326a2f86a33fd9785414e23ae03a2fdffd89fecddc2e13957a70bac11b04ef4c19de045b0ca6aa062422870c68219
SSDEEP 24576:hfwvUk9RX6wkyAIR3KnAoIBlEq1tIgAWz5foj3Z:7MnYIxKnAX1tIc5foj3
TLSH
T1E035D029EBDC04E5E177923C89B7460AF6B178680B31C6CF125A536E1E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f4e532b24db8dde88ef7299b4c6da6eae559139236120424351cb0e0e581674c
MD5 05ff866ca8fa00565d932e18416f51eb
SHA1 7c452f797a710368f449c96f7893020e0df50c25
SHA512 8841606a59835ca4f9f9c4b62477594931ab9af3d17c008e3e809e08fd6116574a6d56e1d73faaab3a4392c647729f86a60ae81403cac0b06c8fa2173bc77bed
SSDEEP 49152:jYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WKnAX1tIc5fob:WySzPu0Okc5g
TLSH
T12D066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8754a296b586e301109a554212613e78cc5b4e02de259f166c9e3df1aee18044
MD5 8f9136e3315c8b760013f7fe7fb28077
SHA1 440a72170e2c3a82c56ba60ccd396c8194b40d36
SHA512 c5d2a47b3cef588a09cdbc7d196bc2fb6cd2546f96a12eb2764e467087d0abb4b00591865e698a0652a36124236ed819919cc6afdfaf8a4c7f216cb54dd270fd
SSDEEP 24576:u47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYm3KnAoIBlEq1tIgAWz5foj3Z:u47JUQjTirIhCnDHUPfF/GKnAX1tIc5g
TLSH
T10765AE1DA3EC01E5E1BA827885554A5AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 75c504f63623835cd382b98a733bcf1dd436afe9ac98180cfa8dadf4a3c7ac31
MD5 8dea490e5a16ae3e994dc892930c3654
SHA1 aee3aac059163c604906729e5ed1ccbd550e72f3
SHA512 35536b0be5f2dba9543dbf5147959db7898d4c06c3c0fb78e91d45b718df5adc43c1fcbdfde89693601cc528d067d09c660204b8c4c9a23b0f472e78a64031af
SSDEEP 12288:YbsfjZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:/N3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T148E4F115E29801E9D16E5275C7A64A45FB337C2583F1C2CB22E0F53E2F3AA905CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 a634d7a816fb0b4c04f1e0745320fe34073a955d48483c9c33d4636c9c5dba0d
MD5 06369c1ca85c7e9e772d9b93361d3cfb
SHA1 5caf98b2e6fcb4321ebe97f676f822e72f186c56
SHA512 8f802c9f16c5f9e0112e7b6291a3c72b0a3d820fba1f52ba6819d2ad6ccb0959f1a7f081413aebff9a0db8cb1dd51836c2cad90d49bfe62ed2f73fd7cefcb5a3
SSDEEP 12288:rIJO+0U3fuG3TwtUIPpvVuTi1M3vgRaRDqwnmXJeqA+N27:rIoLUPzadIiuvgRaRDMJeB+e
TLSH
T196252810766BD75FC6A940321E33C2CCA7707D01EE45AB0372C8972FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 515KB
SHA256 8942c036f53164ae9891f52d7136138108ff255bdc389ce0daccfd4e89e96fe3
MD5 0ae56ef086160fc7df9f8377a4b8a586
SHA1 e44dbf6baae1098b909ae64fe34130be173e9fc6
SHA512 2e1d2d27f7888d81a21d7262929964960d851aa6ea7c14b701c39aa7945275deabcd8c14ee7e9d91989dc7e6e82fae02d2e1f9d63b9edd8aa886f60d95f5a32d
SSDEEP 3072:rnEtzvUpzvMtPJTpXY/k+p/Cjkc/0UQV1/apZ:rEtLUpzvMNJTBYbpvcJA1eZ
TLSH
T15FB4E841A676B38FC0F66032063A5B8DA778EC03BB055F1773C4483ADC66666A5B93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 99fe53c86c4c0549dc9886bff5ba6bca8a34ac7446ab5525b9157309533d2acb
MD5 de598038673efa85e1e587a5e414d056
SHA1 5814c90221854d8ed9f9f4b0b7b5177be18cebf5
SHA512 9c499d8306ab0e31e81731180694c57053863f6c02e681beff79b07b47124affc671302b19fe8dbc16dd23d1964a8e8e3c8a3e17bdb7904e6b86c6ce8842bed3
SSDEEP 12288:G077Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:/13KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A2D42221779C0C2EE577467092FA9419FD39F9744B3584E33029A907B63DEE06C3A27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f8660cf2d9f5094b413b3e11f0046486d9286c063a82fbe0cf2c6d6aaffebdaa
MD5 b21123b3dd8e9a801d40279e3fcdd274
SHA1 60fc5cb027b83cec7cf8ccf921fe0ef8fe2f521a
SHA512 5657aff78f79c645d8839a0991e3379104a659a0b18770eb4ff4db261bc716f546f8b4c084d8009875574699dbcc020afd4f578b2fa9697c9e398f3d0c83e693
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYj3KnAoIBlEq1tIgAWz5foj3Z:Cgb4mBIBhGFkKnAX1tIc5foj3
TLSH
T130659E1E22EC02F5E1F6D2B8DDAA4417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7b2105f8358bfd4e9d97bb90723420ec4fc63a102b305c84af40ffc601663135
MD5 e6e5c34538ca3d18de5bc5041bb9a26a
SHA1 10922a0b0cb7bb7e3888af1343bb727c965183fa
SHA512 25f694d8ff9aa9e851d715deb88da81c663e996a4fd6f85572575d1070d56c566c4dd63c0feaee373561de7d196bab6b767848bed627474abeae5fe126c700f4
SSDEEP 24576:+G88u8FpJqH1bzria7/mW3KnAoIBlEq1tIgAWz5foj3Z:V7ZFPqVea7/rKnAX1tIc5foj3
TLSH
T19E35F16177E401F5D477D1388A964667FAB1B4250374EBDF06AC8A522F23AE40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ab985f86b50e532cb1a0a8eeebf9ea696b656abf9e9fe6dbeac04e2b851c73bc
MD5 4fe76ff7b5f2b533332475ba330b03a5
SHA1 e5cc5b65983a75d4f4ef0158b8f385bcc867ad1a
SHA512 0a9d880a0dd846f7d10e2e9e889fee1e8979e1a71cef586b92ae588daf77e7ad879471fb3963b1ce0c94dd86209fd8a45e6d8851bfbc7d1721b216288e5fa5b4
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgKnAX1tIc5foj3:pG05lO43b50Okc5g
TLSH
T1F3D5C06A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8de9027b6720f37b6240456e4f50088bd2ff4ecbdc1dad740bffda0aeeb4bfcb
MD5 1f75c154b2ebb24635eeec0b5840882d
SHA1 71a5408deac4df5b6fc9c910dcbe4cff8a0cbf55
SHA512 c97ec3bbe087e034529399ab6967ab051a34c64d749ad71e69bf72fd6cb7356e7440d10b01b3ddd2c7e1a751e347dd8feba8fb0a41c822611391f1bd6fd5de6d
SSDEEP 24576:afa5POZ3dpuWVM50JicR2hG0lasx2+47eidng3KnAoIBlEq1tIgAWz5foj3Z:ya5POZ3BJt2pasx2+m4KnAX1tIc5foj3
TLSH
T17165BF5EA7FC00D5E5B9D17DC583861AF5B1342153329ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4c89b4ee18658ca8c5d5287c799689ed9fe817a8f6f0b7c847138c643a823747
MD5 1e585f270d9a1a9a1ca588e24fbf1053
SHA1 87a1d74569c23027208bd8cb60fa4e535344ad83
SHA512 cf903bcb59f66ffb83f5bf16cd35d7c777f5a65e37d316ff0bcbef585610362b6ebbcc9b9a360ae7ba9b0d3a212e9ae155a6a6b39b96fd43e7ef288ceb34609d
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkO3KnAoIBlEq1tIgAWz5foj3Z:9Nc/zEOVHFLKnAX1tIc5foj3
TLSH
T195858C2623E901E4F5BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 92ee69b4636d9c670e122da09b712c3095afa3b2d03008d42c5c6c14bd9f2282
MD5 7f0b703e11a889a292745f6e49e06f07
SHA1 68189919805989566151667ef6a88d108ebdc837
SHA512 3e69ba15ff7423e48a4ec152392a1851ec129b3bd18e062b7ff5f1a562172b4b1942a60b1bd3bd8413077a94f3cd98f8710ae0af6746b5c2a7bdf30782888285
SSDEEP 24576:8TkNvNnaFeYhJNtmZBmU3KnAoIBlEq1tIgAWz5foj3Z:8TMwBtOmqKnAX1tIc5foj3
TLSH
T10355AF2EBBB805E4D1FAC6B5CD238512FA727461073292CB5290C13F5E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 06a02ce4425b89c5c807d069029a618d0876e30e07516f0451afbcd1c0199a8a
MD5 261e45052b44f756831a8f0464b30eb7
SHA1 bbe8524021dbce5833a49b9e44f29ce35c57a218
SHA512 a2c5f3406db3d1b62dc5c36bf2ae11b05c760b05317f57ec256482a125ab027d906bff69e18f965839c502df062654c14065cfcc04a4933483d2494f89760531
SSDEEP 12288:bHvUrBFrEjwaQAZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:bPUr+NQi3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1AF05E12B36AC1CE9E676E17D85964609F771B462031291DF02A1817F5F27EE87C3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1b210c6804509773461aa3a5605c4a2fc0549beba9f50681ee24eaa163611628
MD5 0d89e5a2c34f4b2f3334008f5f50b786
SHA1 25f13acf621ca1815ecdb034dd8c669322780c79
SHA512 7b11582ba9286cac9a54c591f416d687426e2aff110df465dafec6b46230e1fd86e76cbc1929e190a080ad4dc20b629773d9966bc0c2ae2274d8594eb3ce9b6e
SSDEEP 24576:aD3FHshBIYQgAJ3KnAoIBlEq1tIgAWz5foj3Z:aDVHeBIAApKnAX1tIc5foj3
TLSH
T1D125E13DEB9C04E4E57BC1BCD6A38906E67178A8033255DB119481B66F2BEE43D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/432-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/432-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/432-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/432-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/792-46-0x0000000001E40000-0x0000000001EA0000-memory.dmp

Download

memory/792-40-0x0000000001E40000-0x0000000001EA0000-memory.dmp

Download

memory/792-50-0x0000000001E40000-0x0000000001EA0000-memory.dmp

Download

memory/792-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/792-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1468-360-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1468-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-101-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1468-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2504-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2504-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2504-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2504-300-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3312-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3312-390-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3312-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3312-392-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3312-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3312-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4184-125-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4184-129-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4184-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4184-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4184-119-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4436-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4436-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4436-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4436-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4572-301-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4572-67-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4572-73-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4572-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4628-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4628-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6000-0-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/6000-7-0x00000000040F0000-0x0000000004150000-memory.dmp

Download

memory/6000-80-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/6000-1-0x00000000040F0000-0x0000000004150000-memory.dmp

Download

memory/6000-8-0x00000000040F0000-0x0000000004150000-memory.dmp

Download

memory/6000-304-0x00000000040F0000-0x0000000004150000-memory.dmp

Download

memory/6000-308-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/6004-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6004-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6004-14-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/6004-22-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/6004-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/6016-359-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6016-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6016-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6016-108-0x00000000008C0000-0x0000000000920000-memory.dmp

Download