f0a46186aa0ec5fd197482cc54d32cac903ca8b4d5c8b7c497996ea100cec1c1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
Size 1.5MB
Sample260910-ccwmeacm81
SHA256 f0a46186aa0ec5fd197482cc54d32cac903ca8b4d5c8b7c497996ea100cec1c1
MD5 eb4676093dce55fd392b83629a05b2a2
SHA1 4d141cae9ca34644c66c5631e28811faba7fe371
SHA512 697e78359f2e9807f567092b48e471a338d59d9f5fd17e8afdec002574daf1112dda1b94af609fdce52a8fb182d66ad7216cdd37a4db0dfc116f886ce7a2325b
SSDEEP 12288:ILqPgvI0uA6bu22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:6q4vIhu22C9+bmOmbTk3reZCIT59z7m
TLSH
T1CE650247B7A9C5FDC07A923852425412F379B40A1B2057CF3396466EEF76BE0AE36702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5460	elevation_service.exe
2448	elevation_service.exe
4592	maintenanceservice.exe
6072	OSE.EXE
1616	PerceptionSimulationService.exe
5984	perfhost.exe
5020	ReFsDedupSvc.exe
2012	SensorDataService.exe
4484	ssh-agent.exe
5796	AgentService.exe
5484	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a5c48b27e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fd90aa3c740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e1d59a4c740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da69e5a2c740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000852f6ce3c740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d25542a3c740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba41eca3c740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003457b3e3c740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000378bd6a2c740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b4a90e3c740dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5796	AgentService.exe
Token: 33	5484	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5484	SearchIndexer.exe
Token: SeDebugPrivilege	908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	908	2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5460	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 1260	5484	SearchIndexer.exe	100
PID 5484 wrote to memory of 3928	5484	SearchIndexer.exe	101
PID 5484 wrote to memory of 520	5484	SearchIndexer.exe	102
PID 5484 wrote to memory of 1400	5484	SearchIndexer.exe	103
PID 5484 wrote to memory of 1416	5484	SearchIndexer.exe	105
PID 5484 wrote to memory of 1780	5484	SearchIndexer.exe	106
PID 5484 wrote to memory of 5052	5484	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_eb4676093dce55fd392b83629a05b2a2_cobalt-strike_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6072

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1616

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2012

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1692 1652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1692 1652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4fd60988166103c630f6d76f93fb8443360a7f71f9daf4a039cc3dad137d5bfc
MD5 74a0374ded0c80c2729e0724ab73a0a2
SHA1 09cd53fa6ac9aeae2dc390ea957d28c0c33f82d8
SHA512 964c00babd8929a1bf93eb0ad35f32c45bf42702bb1cf4c99731f558e8fecb0c156c42658eb4571b7a3d1360087bddeb863649142b0e39584a8ef00a638b7e9a
SSDEEP 49152:eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnv2LlOpbeZB7m:g3q6sjBKycv
TLSH
T1EDD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 245fa407558a997ccdb4c3b9aaa4dbbc944c69ed61126fea43442a23653aae6b
MD5 7e6894fce673603298ddd36c24c2f2d5
SHA1 8b2f1468c4cb1f7be382a8952bca811dd532ac05
SHA512 65b42ebad6d20dbf1c4d4742b2c50d37361e4b34ef2c626f0f5f2c4814d48cfa3133ab659219dc89e1318586545e2de0b4b05bbc94ad39b4e57f60db7ab39b71
SSDEEP 24576:kXYfDtczAO22C9+bmOmbTk3reZCIT59z7m:Dtct2LlOpbeZB7m
TLSH
T1E275016467D408F9DC6B823CC9A28411E633BC9587A0E7DB03E489661F737D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 bd5518dccb5732394966d3cf1919bbdf151a233fb9dbba35b3fac99b13790949
MD5 9b19475a03d4f2e588349814aa058637
SHA1 7bc45e58d5a09c21fef872a4eaf3507da5dc048f
SHA512 0cb7568d520cb4c9f1749dd0a75606d327d4c9ecf4cb13e6f4be8cffbc48dff237559311768c5ec155d9f479a446061254078d2680b5cda84c9a1d8b93aa4e6d
SSDEEP 24576:I0Le5ji0hmxxrMH22C9+bmOmbTk3reZCIT59z7m:IPji0Ajw2LlOpbeZB7m
TLSH
T18995AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 be6c613eea75a686ebf10e4f44a7b6214f1042ab47253e38ee73e759ea30b7bd
MD5 ecd5fcc6f89b904f3d2a4e7482b0ba08
SHA1 696dfec5c5b26ccf43e66632a18e9c047ea3a6bb
SHA512 9b4ed30f653b781c0f6f6a8a61103d6857c504ca15010c0c9c514c354da3e06d435164a0e1c40bcaf39f1377abddaa026f05d63b2af65206a4ba350b0dda28ee
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyu922C9+bmOmbTk3reZCIT59z7m:h/ezSC6vUzPveHjyk2LlOpbeZB7m
TLSH
T1ED755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 70d3f4fbfd2f5eaaf9171724a691a583a2b63350396c6627d953c5d4e2afd2f5
MD5 201d68ad3b870bb1380d252d4a63f3b4
SHA1 76117b5aedd0fc92e8a0a87efb6eea0d3b98ee7d
SHA512 90c591513a7b9ffe5c376be79aadc760cd98ac10f083dea9cc7942509b07ec36ba3eeca2876f6aff4e597b501bc754fc3f882fbd7d93d26ad212012457237541
SSDEEP 24576:vVbqPb88hv/l+Ya22C9+bmOmbTk3reZCIT59z7m:vVO88hXl+F2LlOpbeZB7m
TLSH
T105559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 6210b469d34b4f9868cd538080da5b7791b0c20a9b67a8de0da6fc22d5a1227f
MD5 20197792fe43284540991d2e660af202
SHA1 d65f8bd0fdda81a35443dc21a4e54efb170950ce
SHA512 07bb97be6d96ea58260428e890ffae3bee0bcc532e76fd7f74455177040353aeed2dbe8905f80f71a01ab3e5d82ce70dd9aa58089cfe367a2a24541dc9ab292c
SSDEEP 12288:RLj22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:RLj22C9+bmOmbTk3reZCIT59z7m
TLSH
T17F5523C18FDCC8FAC6BF1230569164E56635EED8DDC6B55B81891ECF18F0AB8D04A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 6e26b451a146fbfc379f7a7804e4698ce005064258c0e820773a59da4fdb0afd
MD5 ee7c99ac88ffe4498a151424e2199804
SHA1 eff4fc2bba3617cec9afe8bfd0a01f3a9ab8f150
SHA512 9321a2b566311602bfdf114bc840bd9f904c7205541ef8c4cae28b600416c2a05d231439f70f28f17a13c39761449176e9e6e042702d9f6f6f905225a5ab0bdb
SSDEEP 12288:aeBNUbTVO86Uy22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:aJIUy22C9+bmOmbTk3reZCIT59z7m
TLSH
T19575CF7BEE28FCE2C27E4D7857918640E772B8708F52A3CBD165820E9E235E05D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f2408ce37bd000b72280df4e23acb0cabe22cb119b2d6d6a6b9ad7aeb2ade3eb
MD5 c72e4beebf6e851a7fd9c50f54a90c94
SHA1 696b8f0b4b203e6112132d21fec002988c1d32ff
SHA512 183123a26f43114eb16e78ac4d981b5d5f4ed791ae374f68f2625f143ee1c102a6e73e7428ff07279e7d11fd6ced3388ae996dedd7a516e1d519f0f5e1b907d9
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:6QvGAdlCEL8c/DRNw5CNycv
TLSH
T1DB266C656BF880F5E0B7E134897A85B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 45a1369144ab3d3d559482861f8dbf5da6533ff99f4e878e5e162a595f3eef41
MD5 2086274cfce29a07c6eb8897b61090d0
SHA1 87eba3996a167b775d629ffd48c99b5de1c70711
SHA512 61558002e57e0c86b2d206742075f438ef4dc581fd77c3efd798cd4a708df108f36c56293f68b027d187262bdb26e0227531f8a0ca94ff8f6ec41b9f82764e88
SSDEEP 24576:60ewsAjA22C9+bmOmbTk3reZCIT59z7m:bljA2LlOpbeZB7m
TLSH
T15B85E071FE74D436C2BF0DB11B26C716143DBA604F9229C3E3A84E9E59702D26376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7bbd7d3aad867aae344e31098239735fcc30abf870328672c4fc91192a7ff5e8
MD5 b32bc04dc55e01805044b5cf1c2e3e4e
SHA1 9734a67555fa3ff1f96ce5b98f6b3fc947a39645
SHA512 b7380642c122b6775ed5d0fa9605914aa4b35252105871ae880b855500950245daafd72f8b87fc2a859aa536859a7fee8732391fdaf9a5e3b40e848d5b506698
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQv:lUEtQevvqc2W1cpV2tI32Q
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c6ffc2589350e18f8a11779d1bebe136e54e31219573ae1c3c3b19ef022c9c81
MD5 cbe830add6c7e0f3786606742b6ab0a4
SHA1 debd6acc4791253b2ffd55e32527024c543f6d74
SHA512 3ac69e774b6f12aa8397fea0f23881ed1f871fd5d1c5e80629b9be1c0f8dda38270b3933e5d4d85849775f8fe998f6e83c38a9302520b69b9689ffb2268d7d73
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zg2LlOpbeZB7m:toquVjnmRycv
TLSH
T173D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5409ec0055bb15526461a8f5631896dd94eeed3ee00fec6af9f9fb863cf0d80f
MD5 ac094dbf6d171b44ff674ebf305605d8
SHA1 407814946c78054e1d6da81b4adc6c13846be6c0
SHA512 c54e0630bf637a849066f72e634d3940a72493bc20f5261d255225cb3391d57324c9f8ab607a11f9eb30b6802e4afc8258bfda881777e8bd69583d9a8dd66234
SSDEEP 24576:hAhGL3IFoiwtA5l7S53x22C9+bmOmbTk3reZCIT59z7m:hAMUFoiq5h2LlOpbeZB7m
TLSH
T10A35AD81EBF945D4F5B7AA7899B69171EA76BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1c415b009eb50cc796dae99b524fddb832865e903369e4f43b9038ec2e17f45e
MD5 98925b8e4b21a2f12f66b5a15bbc59c1
SHA1 1d3bc4811f65666d0c347e7090864fa1bd98bb56
SHA512 4d3548b020a2a8ac892729512a761969ff89b53624f707daab245f44a9a4748abe8a782a7f87b52fce5606b27997c4098406528ef5d67d8b509aeb328733a09e
SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+Cd22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+114:rwu4OWE22C9+bmOmbTk3reZCIT59z7m
TLSH
T1BF75F18677E80CF9E96B823885578136F7B2BC152A65D71F0360CA5B2F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 294236ad5817db13211c541b784869663e123bf0644312480252df2c3d9d304e
MD5 652671496f170312a9c2086dfcc19344
SHA1 ee8722b24c4dd33f00296a20efe13a07f84e03aa
SHA512 06f025127fb9b7703311cfd8b28cb47dcff40e7b80967a40a7a56140682ad59e31b2fda458afd7d3ded42a1caefe70513e0e2b5801fb651ebdb4e5ff28856a51
SSDEEP 12288:CeZ1IyQ22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:PZu/22C9+bmOmbTk3reZCIT59z7m
TLSH
T1746512C627E860F9C1BB423CC9E15545E372B8A5ABB253CF02540A9A1F73FD59D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8fd4482c835393c2a56e7ef55a7b17a4d6a30f8d8c589b100f8e99248b1b2ab6
MD5 a308c0203fc9a30f9fce57999bf52d5a
SHA1 a6f56132bc1baac245e8927942048bd10630d70b
SHA512 f6e80b0a0cfdcc63f54b86d98b3cdc4b4ba149480cdfc0b9bba67731f11e0d4a36bc270cd8612e00fe94666e87569b80d3b518945bbbce02dd95e2a2a7da478e
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:iQRQyi36YOcPbLvw2gAf+PN3mycv
TLSH
T1F0667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1e04c781b34af954a95b08123136aa55abc23af5a7de0942dd1ba6093aba461e
MD5 c39caa9933d5b6fcf7fdc474e9057449
SHA1 35c1b30f04afda731c13626c701b105585bb14d5
SHA512 af9ad377282b01e38dc40edcfce3dfafccee1c4be28576c318a3b6f1b3842d7ed22353e0b03024235db6bb4591544fa727403c408006475f6153853623c83da0
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:rQRQyi36YOcPbLvw2gAf+PN3mycv
TLSH
T1E6667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b4c64acbba5f7009c30a02625136ba47a71a79dcf841c79060dfe6cdba5f0d0d
MD5 53ed40434f59e679a6dfafd8a02fbc27
SHA1 0cf8d818f9b6945d491142976d19dc18363825c5
SHA512 38882078ea3deb2c1a15b34e137b07e940b63d1638cadc3cc0c47a8af346f4087aa863502d641126d2d1a059d0bcb542eb2e226b339b3b4eb3ac66ca51b7c178
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0v22C9+bmOmbTk3p:C68Qg55nhceWu7PNU3/w2LlOpbeZB7m
TLSH
T1A4B54933B2F600A9C44DE1769F46873196D27C758FE1E3DB8105720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9b78cb18e7d26f6b0073d0dca2313699f421e85e94e00e09e49c1ca33e58cb8c
MD5 0094bc13d56fa0226ef4c5f919e2d7dd
SHA1 5b060d11e0032c65cba8417027fb586a2f4bdd1d
SHA512 46d8caa4d83b289790b3b2024a81a8b65bd4bc8763676fcf60f580959611711568f40f25db9bd6d11fd49c8569a591c41c290e55c534767ac5c4cc22231ff95e
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:Qy5112gYy5azzVvt69nLKnhZjycv
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 52501a004d7d7d26d0af23ecea697612997f59136883a6885b25c26d81b3eb1f
MD5 0ff6132b8758e266574303a8d4429af8
SHA1 e18d16591f89868610522893c366133a0241509d
SHA512 0f9910d618bb4de21bd744339b55e6bddcd1c1736be8df6067008ee8adebc895238c5a7094cbab47c1e73f04b3444d897320e5fc49be6fd8e2af701394f5d202
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl+2LlOpbeZB7m:du6Jmdxd2d+ycv
TLSH
T167D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cc35a473c050430a4efc22abfd95b62dbcb5322272ceb9a7f08698bc06c425a3
MD5 1f27b2b8b15279e2783dafcebadd2491
SHA1 1fdca1d340b7254b63ad53837ec72bd7a4aad201
SHA512 794c4e8dd865d172c91d1534973bb9ca5979c3d6e585be0b81bf9212aeee3014f675519514d466970ae1fb2a6f9e0a4e17c57c289f07d8a078f7955e5456b830
SSDEEP 49152:S1hpsNoJpF1A63U44CwH7R4xS2LlOpbeZB7m:SmifPWRRycv
TLSH
T1AFB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 869a79ae8cdb8c38d07f7be9e00c0643793078f2650a8d9ed6b22dfccde5c01c
MD5 c8884ca29a2e5651ab4cefc0dd5fe9ea
SHA1 e054ffc2fa9b151ad05abfc49859a52a57df9dd0
SHA512 c5d13dbb01cad572cab0deb4737e49814a8b5c233a089098e76f99e3b030750c4f01dbc730a2a77af6b035c4cc11d98724ec0f134ff5a59e737bc588c3efba1a
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHq/2LlOpbeZB7m:95dKii61/ycv
TLSH
T13AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 120d6d218e34d8bd111f023c929061c5bdf94805ea087644f3f6357da5a6be65
MD5 c6d3f143d194e3f7509eb1425abc1c47
SHA1 50f9f6372112645d5adca8a79d9216899c3220f4
SHA512 e570881d2fa2ea3f71413edb8c3a8539765d1aad7dfc4f9f1c86ae5d2a25c335b6f0506988fbcbe8aa9f4d1f0c46161849e27557560ac922544a53f61e8ba252
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wO2LlOpbeZB7m:aX2imphVycv
TLSH
T16F95BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 47bcde689d3ccd092324d67dd51e5c71b629625abac858fd5117cbd4771c3699
MD5 061029ec9ac9fdf5b82ad361ece43940
SHA1 f38af48d06862f1345962f075cd95522ed39443f
SHA512 9b5f563142807f7f5044cdb87355ccb2c481758d776c1d7939f06b2b47229660d43047ac4deac2c475130ada435a66db34ba8aba665ee0d945053cfefb464e5f
SSDEEP 12288:L722qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:L722C9+bmOmbTk3reZCIT59z7m
TLSH
T1CB5523C18FDEC9FAC17E5230865120E56129EEDDEEC7619B428D0D4B2AF1BF8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 64bba82452beb31228d2c8975a83f6d5f8f695c37435b0d9093e2e00cd297da5
MD5 e7fb8165caba007a07546822c258db74
SHA1 885a2823f210f185a9447fda7623ff29447ef317
SHA512 119a0e8bef33d099364974848c70f1abd6c5fdf71fc8151d40e7b5161afd7ba5763dfeed9289834ecdb77cb4a59052744c743ff4647f26b0af68f9632d8a075c
SSDEEP 12288:cM22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:cM22C9+bmOmbTk3reZCIT59z7m
TLSH
T1DE5523C18FDEC9FAC17E5230865120E56529EE9DEEC7619F428D0C4B26F1FF8A40A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 54023406445ce62ec97677c983dcc9919c44ac21ba44033b8393897148cd0cec
MD5 4767ab5005734d1e6d115b34ac291410
SHA1 6554c52a0500c20680e3072ce6534b6e2645e40d
SHA512 4b2b1b491f0a0df97a2f71f950187487deb270b40fe46d26d5fb83cdb45437774c1ff587ff666c93864f36db36d488085b79b1ed2bfdf26d79ae94908b8786aa
SSDEEP 12288:9K22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:9K22C9+bmOmbTk3reZCIT59z7m
TLSH
T1905523C18FDEC9FAC17E5230465120E56569EEDDEEC7719B828E0C4B29F1BF8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0eb87a2c48facc0fb7ff18aafb07a0eb2ef796e2c047b0ec5eb5dd55afc33d73
MD5 cc9f5c67e9f3223f94fa586f87ee9c6c
SHA1 f6d3a569d253608c31e13a6d986869f506bd9e27
SHA512 7dcd50e33157078c07b1e6298d012a1021095f870c194b158cbe71cefc0d7e04c1777d9b57b328f88d888df260e0f0d4a1cf213860aa5bdc86906049cca8425d
SSDEEP 12288:wVR22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:y22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B75523C11FD984F6C47E9234C56150A1A275FD98EFE3629F82440D8B1EF1BE4A829B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 cc11a9996c0cdebfbfd6c0e0b4895ec3b1b9ea8520b823a08f0e1c488c22584a
MD5 4d5497c07d1c2d3d19ec61880a2b5caf
SHA1 a6f3e40094702531606601c212b6822bd18df9b7
SHA512 a83cfbe84cfefb74dbcf7f8f4307100a4da629b075a7a07f3175bfcb0f43a50866f79b5daf1fbceb4585bdd0f7e979b2329b856a83d5b4b3e05b10c6f1c25d88
SSDEEP 12288:C522qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:C522C9+bmOmbTk3reZCIT59z7m
TLSH
T1635523C18FDEC9FAC17E5230465120E56529EEDDEEC7719F828D0C4B2AF1BB8940A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 05b758d811aa5f48a1a2c4bd5793f4a01672f35c0354269c5842fc137a8707eb
MD5 5a4bfcb8d1866859d7374fc5dae3211f
SHA1 b763049e23035d86b244e1833959ed2812e3b4d4
SHA512 b6bc1ea5fc84d824a6b4f82e71814fde3ec9bd84dd741063238904a4e0a534cada7001ded5a55107e7465e0b131d5a3af2b49378b2bd4f3b27baa25727c213c0
SSDEEP 12288:7422qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:7422C9+bmOmbTk3reZCIT59z7m
TLSH
T1E35523C18FDEC9FAC17E5230865120E56529EEDDEEC7719B428D0C4B26F1BB8A40A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 c3d65c34c6156f159a21df739f3f07936caf88b0e3f26611ca211ca04f1548f4
MD5 4ac1ed85006341cbc61502c098872349
SHA1 90615892785e8c62fd891353468526791c84accb
SHA512 382e17f8a19b07a813959ef0cf4830c9adda58c3a3f01682ee1b25e65e756095f306455797d333fb17c845d5099716c34e31dffdf0c18d4dff7689fd584c05ae
SSDEEP 12288:L022qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:L022C9+bmOmbTk3reZCIT59z7m
TLSH
T1825523C18FDEC9FAC17E4230865120E46529EEDDEEC7719F828D0C4B26F1BB8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4f3d94bbc86869095b4d914e49b14a9cccd6bed6e2271038ca81cbe1a7b50cb2
MD5 e5b06a80e7271acea5333073af98aea8
SHA1 6d1c2ab60d2af5fbaf98a8f70f06d5d1137eff24
SHA512 44aed229b50c6bac94f9d6fedb9dd75112bbcf6641d7c6e43e1c307e01c5b8bd42eefb3f37aa5a0eed71fe704f304b858924909e47b72e4b4154ea4f53d6c493
SSDEEP 24576:pZMRzFVSOs22C9+bmOmbTk3reZCIT59z7m:pZMRzfI2LlOpbeZB7m
TLSH
T10A7502D5B79008F8DC7B813DC9518855D2B2BC594BA0C65F03E83A6B1F733A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 0420c944f2ce811e42f4d5798eb7a0ace1ab61db16eab10e544111f3782508e1
MD5 365753901df34d5e976015063dd5026f
SHA1 8f251f4c5879289f9b12b9c0f86eb4a4fc90c418
SHA512 131b0a828df3e6c72b16d67ab2525b226f13feda9b64bfdf0ba01760b5f799db4a4ab77134aafc22a4602b56726778bbae407009ddc03765598fd6c44a200765
SSDEEP 12288:SP22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:SP22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B95523C14FDEC9FAC17E1234865120E56529EEDDEEC7719B828E0D4B26F1BB8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 9dd11789530601cab27c9fa8222b6e4018aba3838a0350c73e61e04cc73a7ae3
MD5 d67af609ba8ecdf57d75893211c9c0ce
SHA1 3454474dbbe42ebfc44781ba7ef7102b1782b32e
SHA512 83aa6eeb711d410c45b91c66a03bfffdcfeb3494814fe3c27e6114ce609baf7ab5392ca7195efc7448c4370b7fb346add9b01178cbf304b9c1f35f115875f95a
SSDEEP 12288:Tz22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Tz22C9+bmOmbTk3reZCIT59z7m
TLSH
T1385523C14FDEC9FAC13E1230865120E56529EEDDFEC7719B828E0D4B26F1BB8944A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 943399217664ee793c32d851e3a8b39fed2fb56d54805490d2a509321c91bca3
MD5 b17bb5426a9bae27cbe7136d23e0a0f8
SHA1 913e1f6971a1355e1172685dcf9611d87e975e31
SHA512 3d589d984af4f91f6bc41b2f0595f7c5f80738111ccd9eeb34aca20d06d3b4d2daed09e15c04c778db593e13450ede7000bb595d3fa7b5f4d37d45b7d62eb8a7
SSDEEP 12288:KyPz5L8Q22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:XzyQ22C9+bmOmbTk3reZCIT59z7m
TLSH
T1BC65128367A520F9C13B8238C9521951F375F8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 80a5f9e30ef0633bf0ee29838597d77ec41e05a8963787963542135661940724
MD5 6c0ce2fb75fa9ec0126d35067926cf35
SHA1 8219a0095f26461b38e1ae7dd5950b1964f6f0f6
SHA512 e29f6eaf462d3b63ce1fca899b56b2983cfffa911990adfb26a5b8557f100740da0af52de217a34626bc657f3580f0f820b26064215cb65740b5bbbb317fed49
SSDEEP 12288:5P22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:5P22C9+bmOmbTk3reZCIT59z7m
TLSH
T1005523C18FDEC9FAC17E1234465120E56529EEDDEEC7719B828D0D4B26F1FB8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 844690eebd3c61f3ecd00a10ac51a9a266bdb36fef8ee6f2d820446aa85dce7f
MD5 568bd01cd7996fef1645d489f1e14a1a
SHA1 15187432739353120a5b29c6d1f620ede90a514e
SHA512 aa97c478022342ddf8ef76517c16ceaa454cc8b61d9b1159f983d3043f67c16ff4be9c57e53cc782764e7d37ea3468a3a917f2ee852a93cbf37d685a8ee2bf49
SSDEEP 12288:bP22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:bP22C9+bmOmbTk3reZCIT59z7m
TLSH
T1F25523C14FDEC9FAC17E1234465120E56529EEDDEEC7719B828E0D4B2AF1FB8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 b1972b1a93badf6dc5b6a9f3aac101912e321aeea4028c2ee80b94c65aff61e0
MD5 67955e71824abb40a212817eb50b16d4
SHA1 fc27e8847852086dd14c8e762be820c64893848b
SHA512 742664ce5c479ecf0fa6437d299e7f6b9db304ecd63adb7dd16837835821e2c6da26a2f2c22e34cbabcbdeeb4ac3fda7390f760ef0e58989e180f4dba258f338
SSDEEP 12288:VyPz5L8Q22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:8zyQ22C9+bmOmbTk3reZCIT59z7m
TLSH
T12B65128377A520F9C13B8238C9521951F375B8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 9f3873858abd54c5563ef443c4204c14870865d2ae4e549640b668cd40991b4d
MD5 65a63941cab2f6b816b10f785840dc20
SHA1 3426d243a6acabb80a3bc62a10086da1fa888efa
SHA512 d039e777a381db1a601595277ad92a8e44d91cfbf76fbc5f72ffb3206d4149979a3ec10b84012e9adceae150e784e47afdf28417dfedbf5498206b8244baef83
SSDEEP 24576:kTDaLl3z0zD622C9+bmOmbTk3reZCIT59z7m:kTuLlj92LlOpbeZB7m
TLSH
T17B7502D5B39048F8DC7B813DC9514956D2B2BC5A4BA0C65F03E83A6B1F733A05C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 257ee9b7fa5d81ec8efa626a66cf67fbb35fe8ef42bb43cdd9b469fd48763467
MD5 b473af30908fea19fbdd3e32f7dc3534
SHA1 a5369d3856851280887fdd06ebf271e596d9bcd6
SHA512 2d17ad732b9052d2a911cdf012efb3f86ec2b218ccfb79a449b3483475f8cf03ec3a52bb2dccd49bfe5e938f562d01fd213cf3490bf15c42565a49063b26c2a9
SSDEEP 24576:63vd9CHKy7GZG22C9+bmOmbTk3reZCIT59z7m:cvd9CHKyaI2LlOpbeZB7m
TLSH
T1F385DF90F3E414E8F0B79A34C9725511DA76BC995B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 abf6cf3f85899dfa98b049aa1eaeb7cec33bb6610dea60b49d048af056736c2c
MD5 16da5271fbf2f7df4d3e7ae12b6419ff
SHA1 0402dac84120301cccf1c69cdc97bdaefe20585c
SHA512 357482b95581e8dc853f4db5c81739f77191c56f0c01b8fb82de1d7567f2eb843544951a00f2d8f4b434c65c5503c234ee9c220193ab27e2fd7f784a6112d702
SSDEEP 12288:Xq22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Xq22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B25523C18FDEC9FAC17E5230865120E56529EEDDEEC7619F828D0C4B26F1BF8940A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 a5aeea10e0942e92c044de4301109a74f2d434e583748a54e025142494623177
MD5 297cf38d006d6219f3aeeb1e50ae2c92
SHA1 f12321750132be0465cb4a3211482aefbec544ad
SHA512 f2fb4d0cddda33ae0e91507feb77bf383ca9e0c539f09231012924e78b498f56e5f5d5e0f02a249e23e8a73453f6c86b4441ac1c4ba34003a480aea84ba53c55
SSDEEP 12288:ww22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:ww22C9+bmOmbTk3reZCIT59z7m
TLSH
T14A5523C14FDEC9FAC17E5230469120E56529EE9DEED7619B828E0C4B1AF1FB8D40A14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 0da2476d0524d1c693606ce32afc466786747529677b2e807b8860391b73ee4d
MD5 a2cadc29b3d21c0d5a1f9740a50f5585
SHA1 9816aab98de042af3d98d37655f23f8680929e70
SHA512 56c38af2dd3b41cf412a0334fc7412cfd8dfac47165c71de97e72c3c2e37f63316b79f57e19623344bca227cb75af3a5bbfe7c5569fcea18199ab311a2a32ebb
SSDEEP 12288:Pl22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Pl22C9+bmOmbTk3reZCIT59z7m
TLSH
T18A5523C14FDEC9FAC17E5234465120E56529EEDDEEC7719B828E0D4B2AF1FB8900A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 c053183c2d20d9932baacdd2dd87967b8f8fd497c78e298c20a2e0b0c5bf74b3
MD5 3081e29cf9b8ab19b682978cf204d86e
SHA1 446db97424459dcd3021b4966679ee47359b3e07
SHA512 941215319804ae7fef59ee84a8240a7a53e4eaaacddfa31f1fdb228c184ab5be9427b9324eb0f0b62b7f978609395b8a0eb8b6399cfb4c578b0bc2894b196978
SSDEEP 12288:mP22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:mP22C9+bmOmbTk3reZCIT59z7m
TLSH
T11E5523C14FDEC9FAC17E1234465120E56529EEDDFEC7719B828E0D4B2AF1BB8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 86e21423253fb890134faabfa6609342f7c22be48e45e9a5f8eda40b87ec71de
MD5 4b5a402bc9e4043dff20783c1b0ea868
SHA1 5de18ffe8cf8e383fc2baa103c7d3364c2da633d
SHA512 31f88fb9a80baa88f86a212d08925b525cab1063bb54b6529f6f892276858a6cd52df5217b46ceaa9a38597f95d741d92bbda8b5274011d53f8bd447a5168645
SSDEEP 12288:bq22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:bq22C9+bmOmbTk3reZCIT59z7m
TLSH
T13E5523C18FDEC9FAC07E5230465120E56569EEDDEEC7719F828D0C4B2AF1BB8940A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 e09759120a4b1d81401a02dba27a85cf29d33a5f3f0324cbf7e26ffe8543ffe3
MD5 e7167ba8a5bc9c07ce7760b36dd99a28
SHA1 d6e1194764cc5709793153d3bfc9ed3dac3772b0
SHA512 ef1ed078065e97bd4e149240b1a54b0573c3cf8690b4a929f4590a33cd98fe69f5858a8d515535cbc8b558940832ca49e3e842eb5315766f8f9e416ef4dea9a0
SSDEEP 12288:t322qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:t322C9+bmOmbTk3reZCIT59z7m
TLSH
T1FF5523C14FDEC9FAC17E4230865120E5656DEEDDEEC7719B828E0D4B26F1BB8900A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 ae7504b93cb0436cbe631c18fb4a96c3237aa39ba0817fa04e4d61de28770cb2
MD5 28e3ca10d3c6c662d61c89c1b5f1af5d
SHA1 1e7fa2c8a1d13294c0431fef40bb3b4a52e49f65
SHA512 9f462c16687b49cbe1ad097c277d955b466f3eabd2334975d57bcd19bce7752596c06d0d24cceaa04dd4f7f69fffc9d0c694b55e899fa1d299df591ddddabd63
SSDEEP 12288:/522qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:/522C9+bmOmbTk3reZCIT59z7m
TLSH
T14E5523C18FDEC5FAC17E5230865120E56529EEDDEEC7719B828D0C4B2AF1BB8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 b8c271c75f5f3305411f15ae33ee42a1f97a9478d1b41a08b2b677841b26147e
MD5 078de7d5d79784ff2f72756e618f777a
SHA1 6d720dba9817d1c5e580e884c8293f57883dcb56
SHA512 1da727c455035ddeee98fbf8219305dc4a0017d0011fc37ab77696c1a60bd67276cbf619322cc6826d752eb1fbeb4e5267f060b040184e1bfe415c4f490d8970
SSDEEP 24576:jfwvUk9RX6wkyAID22C9+bmOmbTk3reZCIT59z7m:5MnYID2LlOpbeZB7m
TLSH
T15485DF29EBDC44E5E177923C89B3460AF6B1B8695B71C2CF029A53AE0E33ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6a48679fe9ff6aa0f02e12914f14941be8883650d64aa8933e7371c2d6c4fa8d
MD5 9fc844c78839c42b2b3c080ca582f5b9
SHA1 bec00fd07f344ea8e168f3d07d0d41eb4920229a
SHA512 288f5963d2505db45186d972fcc5a3a67d20f8a22b329ed34cd2d395e3c8c57003adad28c826da6d0760d94fafedf774b5569c3b14af1c288bdf71d24b5727a8
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0u2LlOpbeZB7m:+ySzPGycv
TLSH
T186066C96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 238a0d14264732525d83155534fa5829a22abae489f96835ca89cccf8dd35552
MD5 97d7d8fdca406032639a0e32fbee49dc
SHA1 70a993cf7125dee69db032e3ce6f35d4e1af7d96
SHA512 325aba82dc2878dd09a7104f7ac87b6571dafd7cd4d7e53ec49883dc70195c7550e54842858c360bcac61c2b7f65154a9205589bc6afdd25d6398c373c6a5dbe
SSDEEP 24576:747Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY822C9+bmOmbTk3reZCIT59z7m:747JUQjTirIhCnDHUPfF/+2LlOpbeZBi
TLSH
T1FF65AE1EA3EC01E5E1BA823885154A5AEA71782D5F32CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 abf50fab13e3a07e98b674f2be1be39370aa30a76594b99ebaf50554c8edae17
MD5 30a430698bf598b26f32cddbb7b51a5f
SHA1 df7058ee95772d06a5755e8711f618cc164dfe2c
SHA512 2183f6cf6834a9d9b34e2564ded2e4fcfa32d8121e91ade2038ff517248053d7f9d849d069514a6915c2dc982b90b21e3b6fb171f45578f625abe2a160d3518b
SSDEEP 12288:obsf/22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:P/22C9+bmOmbTk3reZCIT59z7m
TLSH
T14F65F185D79842E8C06E6234C7515641B333BC659BE2E3CB52C0F97E1F766A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 6edba0579d4a9941421676ba2cfe2d8c530173dbe250018e8fa87ad19c4dc2a7
MD5 20d097de0136cd28884feac248a890f8
SHA1 39a073969e31f6da027f6c9a6b9b3e803bc68074
SHA512 9353358e29eaabb411be8635ecfcf90b2a1fbb87d2d5f20fb51179eb36e0c02614b557b475a2e985b82d2dcc2f24917a57feb1dc966e93301ec4692bc345d074
SSDEEP 12288:IT9V+eU3f6rjfCSygc/BSJu+LR4Ox8KFP:ITzhUPSKSyX/8c+LR4wR
TLSH
T1C6252810766AD75FC6AD40321E37D2CCA7707D41EE059B0372C88B2FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 22c6adebeae0f2c593066e4b8f02a12db4f3ec012d35813e854977f4aa715b1f
MD5 a13c10e31611d9f8290598a9a71f4914
SHA1 ab88f073cb658b2409af69099f19aa5b9cc57e85
SHA512 a491ca5e1f4f585096669314371b728e850cafbff16dea5f3b59dd6c35729dfc0cc158916f1f7bf51c4712eb72e97029fe1f0cf14f64e17d2433fe432847d413
SSDEEP 24576:4lSyJS1HAgOwADd438b8Z+i7C674SUKHWKAZiCs2:4lSyJS1HAgOwADd438b8Z+i7C674SUKA
TLSH
T1BC55C6816437E3DFD1FB6072072A5B4CAB64EC12B3095F26B388553DD82A725A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 a3d7a9719aec11b4a06422479282b57805b517139da073e624cf077a4636dc59
MD5 a21b4bfd238e12a4e46c8ab2514cb88f
SHA1 c78af7d741bd059b9b2cb787cbc40cf1a2b4bf98
SHA512 b5bce476f63067501dd620fe76f31f1a76a874d75a64ffc1b8df52dbf0ed51290c08e7ee1afb364e8abb353057d12424302090ecddeaf85a613ba22daa211794
SSDEEP 12288:+07n22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Hn22C9+bmOmbTk3reZCIT59z7m
TLSH
T10C5523C18FDDC9FAC47E523045556074622EFEA8DFC2A0DB91490D8B29B1AE4DC7960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 faa7c1862f71af64f1f8bc448c7c7a5ccb452e70c1ac9d95c6f41bb78269da86
MD5 7254a7c654d9565ad2de9b9d11aa442b
SHA1 7527bb528b47a93366d87533ce2aad1c41ee1aeb
SHA512 09f73f750f4fa5797df5e3e40bdf8199e675c530a064579295d84d6aa65240a271327259bad0cf23a02a0cf7dcf84ab62cc8bcaf9c50b2f1fe075f60f47a8ba1
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bY922C9+bmOmbTk3reZCIT59z7m:lgb4mBIBhGF82LlOpbeZB7m
TLSH
T10465AE1E22EC02F5E0FAD2B8CDA64417D6B278164732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fd50727e82617d013f2f513d28c43dbf4910b166125d3eb5b458fe475ca9df2f
MD5 ae67a372373cf0d8246fbdcafcd70919
SHA1 88df1787a02f7eb654a364081989093b0ea14680
SHA512 b1721a5100d56cc72d54016176873b72ba74e0ee14309938e556f8566277a0702cb363696805c6b3fc01ddce1c4201589bc3378d2e45fa09a15f106d92c70759
SSDEEP 24576:IG88u8FpJqH1bzria7/ms22C9+bmOmbTk3reZCIT59z7m:r7ZFPqVea7/F2LlOpbeZB7m
TLSH
T13695F16167E101F1D47BD13889824663F6B2B8250364EBDF07AC8B561F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 305b3c06903d3fe09ed6c207d721ecda83f171afde26b65d09ddf721f1e9ab42
MD5 cb2bec865162709369a372200fbcaeda
SHA1 0a85087ffdb5ab93e9091a90f0545ef4397915f0
SHA512 05fb9b4b4d27d8ebb4e6ab7418380946335de4c3ee9d343d414371644c7308b173aaa0c29dc7b9db80ada5f753a38482b6c887fb52f08e86d64514a0ab72fafe
SSDEEP 24576:qPUr+NQI22C9+bmOmbTk3reZCIT59z7m:qJQI2LlOpbeZB7m
TLSH
T1E475E15F26ED18E5E67AA13C85824619F771B8625752A2CF02D0817E0F73EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 211348f3ccc9d8d6587cdf5656a027b6d99b063fe393e6893c856aec5c9606e9
MD5 826d3a940bb07a5f9b85bbce7925a28e
SHA1 3fec57fbe1415148a16e821d7697b2f758dd1fb7
SHA512 7f90a2a2249e1222ab775fa2f7c507d7715e5b96c57e6b9d7aac9ad8bde4aacd0222b40a597fd8c22b6a3f198690fba002931b031c9ce1c0dbcfb45678bdfe1f
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj42LlOpbeZB7m:YG05lO43bLycv
TLSH
T1CFD5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5126bcaaa9fe937679b63dac9f64ef871e8b3c429e52ce344e5d72cdfb76dc3c
MD5 29964442dce58a89c683ee0ca27150ad
SHA1 ee155b98fb5f5c239c6956913e51a3556e7c42b0
SHA512 6d79911a2d087837c1068a5ff917e4a46271e2494cf93b6e142082f7feb3bdb66788e12c627036ea14e009757dbd315868c5ec0d2dc5964dcbdb27bfb7292996
SSDEEP 24576:tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnu22C9+bmOmbTk3reZCIT59z7m:da5POZ3BJt2pasx2+mw2LlOpbeZB7m
TLSH
T1FD65AF5EA7FC01D5D1B9D17CC583861AF5B1742553329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 17735ff787762788b69907ff789aa0dbe0c867b76dbf86f1f8f22c383263d4ea
MD5 c90a66a175e3490c02fa872646645119
SHA1 22a35701ddc6db4a5228eb8ae4a7e2869e97e8db
SHA512 67fc13acb3dad616632aee9b8dc951585806030770853fb40923b106fd87ccd47fe651c6943b0c2747a5d5b1446c245ff30f80262d2744f8840564af563a9857
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fkk22C9+bmOmbTk3reZCIT59z7m:wNc/zEOVHFl2LlOpbeZB7m
TLSH
T124858C1623E901E4E1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 26ef354ffadea92e294db5c51ddcfaff8fac6b299a193082696a335824378c45
MD5 ee38f663fcc85ce4554247714a847a10
SHA1 b7e6afd28f05a5f948a9d264a320f710bb0b6adb
SHA512 578f4f5d09bf5562b570f45f5d021d04928709be8923387ec8a8e4e139dbc805e79e60c9effd31ac193b59402340ecf4fd9cb0ee91583ba72a218ebcbce327aa
SSDEEP 24576:cTkNvNnaFeYhJNtmZBmC22C9+bmOmbTk3reZCIT59z7m:cTMwBtOmC2LlOpbeZB7m
TLSH
T1E255AF6EABF846E4D1FEC6748D238512E6727861073293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d6ca7ec0f35fd175cb10c9d58da3fa001fe0f97528166bf19ac9a5c61c6cf9af
MD5 fb1b66bcdba7225a774f5787b300a2a2
SHA1 8eda46d4c381bd3ed5087043451e85e675995e63
SHA512 2754f411eb889f9962939a0fc2b3ac815cca6d963308f0356567744c90303fd091f65210657c9b4863893ecb2755b8d7d2ee9b82ed891cf4ab0209b2ffd9597e
SSDEEP 24576:LD3FHshBIYQgAb22C9+bmOmbTk3reZCIT59z7m:LDVHeBIAAb2LlOpbeZB7m
TLSH
T1F685E17EEB9C04E4D47BD17CCA638906E77178A9076265CB02D481BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/908-0-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/908-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/908-80-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/908-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1616-72-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/1616-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1616-301-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/1616-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2012-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-307-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2012-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-93-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2012-100-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2448-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2448-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2448-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2448-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2448-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4484-108-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4484-305-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/4484-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4484-107-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/4592-39-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4592-52-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4592-45-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/4592-54-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/4592-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5020-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5020-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-82-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5020-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-320-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5460-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5460-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5484-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5484-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5484-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5484-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5796-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5796-125-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5796-119-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5796-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5796-130-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5984-77-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/5984-302-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/6072-50-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/6072-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6072-286-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/6072-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download