9bcf205ba9ed62545555466f635fbae406f28c8b99c0ac11b2c4832024e87a4c

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.7MB
Sample260910-dhhheaxthw
SHA256 9bcf205ba9ed62545555466f635fbae406f28c8b99c0ac11b2c4832024e87a4c
MD5 bffcafc164fb034b447c6c338f7ce6fd
SHA1 41fc683b10d2e53c7b4547e611ae971c2736c6cb
SHA512 bbf32d9fece173859b435aebe7add97776fc7ce58f038a2a9c1b8f0a9330e1c623cc2ca6a45b3108d8826bbd0ae0303f8a8cf6fdbdc7179cc7c654a30e11b9f2
SSDEEP 24576:nsRBiKW06iBhvn/+r1ck/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Aix0TBh3qVLNiXicJFFRGNzj3
TLSH
T15685024563D44CF8E5B68139C9724615E6B27C568B30C69F0364262BDF33BE1EE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1776	elevation_service.exe
3116	elevation_service.exe
5400	maintenanceservice.exe
2908	OSE.EXE
4144	PerceptionSimulationService.exe
1088	perfhost.exe
3288	ReFsDedupSvc.exe
4596	SensorDataService.exe
4796	ssh-agent.exe
3872	AgentService.exe
5704	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c594fc523e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeeec993d040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089e18192d040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a69ac192d040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002caa8d93d040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bb76393d040dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ae47092d040dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db817b92d040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1776	elevation_service.exe
1776	elevation_service.exe
1776	elevation_service.exe
1776	elevation_service.exe
1776	elevation_service.exe
1776	elevation_service.exe
1776	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe
3116	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3448	2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3872	AgentService.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: 33	5704	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5704	SearchIndexer.exe
Token: SeDebugPrivilege	1776	elevation_service.exe
Token: SeDebugPrivilege	3116	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5704 wrote to memory of 5760	5704	SearchIndexer.exe	101
PID 5704 wrote to memory of 3556	5704	SearchIndexer.exe	102
PID 5704 wrote to memory of 3752	5704	SearchIndexer.exe	103
PID 5704 wrote to memory of 4344	5704	SearchIndexer.exe	104
PID 5704 wrote to memory of 5948	5704	SearchIndexer.exe	106
PID 5704 wrote to memory of 4100	5704	SearchIndexer.exe	107
PID 5704 wrote to memory of 5524	5704	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_bffcafc164fb034b447c6c338f7ce6fd_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1088

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0ad77068032de32158d80b3561144a043f2117e5b5df8df6a634f0b66851a89b
MD5 2b9e0eaf5835ea24c146c8ead115f3db
SHA1 9e57a54710418e8764c3b53df32f58bc1c8e825d
SHA512 1c79a90d3dfa37423618712a9be1499af3c0bfe42c297266293d04fcfbba80ab583debaf678321a918020c39c59402d36187009c6db5e2434876172fda5e4edd
SSDEEP 49152:Pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnuLNiXicJFFRGNzj3:N3q6sjB57wRGpj3
TLSH
T1D4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 1695f10df667a520d89b9e4d2c60bba6656de22e86bb120f0b73caa8a4626f7e
MD5 07d5974532ffb7fd93e1f443c3ef43f1
SHA1 10332aa4d94fe5f19b2990e74f4d09d6c3b7ba07
SHA512 b3178120f2bff5de2ef5153ffd1b3ac75376d8d0d60fb5de20aacd64faf5172d338a7414bca89d11f8f4d1ed489291dc7ccb0103d2c58afd54cbfde70364be39
SSDEEP 24576:XXYfDtczAN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CtccLNiXicJFFRGNzj3
TLSH
T11775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 21a8e9ae3e379d056423185004ebfe8694c046e63f6e85261ef893f3f020d2fb
MD5 329619e030ee5388088247331b88649b
SHA1 637385b700b4ed23ea644638fda451ad5fd16065
SHA512 aaa0c0148cebb23868947e84c8d737364ab1ccdc1f2904bcc2c324a42c25cf6c2d3d4a7d0821b7c4ee2fb1feaaee1968071a7806b43ab1f2f45c75401ba77fc4
SSDEEP 24576:b0Le5ji0hmxxrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bPji0AjfLNiXicJFFRGNzj3
TLSH
T1BA959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dece17364bb471cfa38bce2cc41c0b3fb1ca8293016c5c4db78ad23dca7eaf05
MD5 bc9c3687afcf5f43cfe81d905ed936bd
SHA1 244ef8205d44e2e945bd8c79120f9879d25f0082
SHA512 63203b432840396d0604950b724b82413789bed07b83486b4436c0d76457d4c8a1f00a464598d75b425ac273712c0317a97184a27d7c60dda1ea3308ce80453a
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyuM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3/ezSC6vUzPveHjyDLNiXicJFFRGNzj3
TLSH
T1F8756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8a8d887b84d01d1818ee6c635dd60e27f43bd0d3f541a480de8f1ea5f2bcedca
MD5 1e7422ca9cc24c04e7414bade13f88e1
SHA1 70a1c5a6e20cd0734ec4ef1c14736a45bb191a3d
SHA512 7a5ac9d4d42878bdf0fdc5d63d4387201a0536d62a78c420219eb2dc3ba1fbd0e7bbba9e0d05ccdb9dfae8eb9544ddb295b2f22b15189d8b99196adfcd26edaf
SSDEEP 24576:+VbqPb88hv/l+Yp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+VO88hXl+kLNiXicJFFRGNzj3
TLSH
T1FD559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 42d541324f74ffee3f6954d7538aaa780fad3a4f49594b665710c0fe331855b9
MD5 a035fa691b836dda647b2269248fad26
SHA1 a3a1022aa6cb82bf1f5990b40083ef718c6dbe34
SHA512 9e11d17fdb3547b8f8abd90595dc9718392f020fd7166bfaf3b340c554cb12bc634402ed7d33e1bf504389e5caaaf763006f14ca07ecb7af181eb98737b8e986
SSDEEP 24576:6Ly/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NLNiXicJFFRGNzj3
TLSH
T1F65523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2503E5EA17CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9f02cf32109030ccc7823c1b650192d8fb72119a4cb63e6a8328cc73b3618c00
MD5 98626c4822c0782c7bb1186e31314860
SHA1 d9cf558f0eadb551e3e6f489a1b8a04ff68f1c3c
SHA512 2544f6c7f4e787f867d556330cfa9b3969c8f1ccfeb9d379fa7bb07d920db47949e2d12335a83d14b610b066661a7f34c1cb6f32e8f9dd868ae7f3b1e0605a07
SSDEEP 24576:lJIUR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lJIURLNiXicJFFRGNzj3
TLSH
T11E75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3d75e664f4acce5649650e31a5f11901d074fcf93ae8de1dd07d5ed3e83c2535
MD5 d80d0041f93b10e2c32149d9ba43d0d1
SHA1 727794392afb1d78e2a293c4bb74a4f9695bf43d
SHA512 098f97e4dc73c5e12f3bc54ee46bf71c306e1feb42c5850130a4d7b6f85821eac33b9a5e286bf6fd1fd8e210fb136b0640dafad50d10fb1c83766dab3f803b41
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:tQvGAdlCEL8c/DRNw5C87wRGpj3
TLSH
T13C266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ff87380383e3eca8134c43e25f7bc0d4022fb523beb0248d1633063b935efa38
MD5 7fde38b5d6d798b271e4cbdb345949d5
SHA1 fc3cb66258c504df0c37e2eb434816d33e9558c6
SHA512 fb30eb4ce175515f30985b3987af6a41b537c16daacefa37c1668dbf1c4813a38bb7169969f0f623f7e4008756790da4a73ad5d253c6e94cd9ed5e822cbb6e4d
SSDEEP 24576:Y0ewsAjP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tljPLNiXicJFFRGNzj3
TLSH
T1D975E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fd1bbd924825a436cbfe6725fece58473a0d74061dcb3c12c21c78b7d6462895
MD5 ab4ee6f6ab05d4322c94f44244e56cb9
SHA1 1c1c4100e21d2189833284a9eed3f4b89ed936b6
SHA512 eaab2d5f9fd3d33d6b312d721ca93faae71027546a25c69e82fbe978280a7ee4a2b8b71ce81a4e4e9a259a151ecbbffe0b23fabf946c2a8160666a4e0350cc28
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH7F9:CUEtQevvqc2W1cpV2tI32p9
TLSH
T1A8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 569b6ce64bc1827d01f79ec7f0fb26693c009b136f46337be3901b8276599e50
MD5 c11aa2ad0602372c9641af83c16551a0
SHA1 9aabf7ea836ac2b0aefa3c432d9d43572030616c
SHA512 ba532c5850a62d12ffce9f4f0eeeceaad208236a72b03a812723d8adb3da8448cae3ae2c0c983a53ac6205ffe03500238c734d13f625a0b3521c9d848b1a20c8
SSDEEP 49152:bCbRquA/m2yL5zifFiV+XenmE3/zvLNiXicJFFRGNzj3:EoqHVjnmA7wRGpj3
TLSH
T103D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8c21320ce1d33d8cbfceb29c8a2166ee4378617f4430250dd4ebe2af050a947c
MD5 0eef0bf879301a838f1389eb5a553435
SHA1 58acb0f730ece481967c9430f66770abbcb4fea3
SHA512 ef865250bcd7000e5e77cd14ef4ac05a60136ad5c5e8188f06c607097694979ccd9c7b0d626debe755b0d8a807e02037c2239eaa0bde3247498638edcd3a4c1f
SSDEEP 24576:8AhGL3IFoiwtA5l7S53g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AMUFoiq5wLNiXicJFFRGNzj3
TLSH
T108359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 131f7b00823b47f1825bc4d546f58058e1e85743518640d596c4882dd1e5e9aa
MD5 9bef60d027c09689dab858ae3f085c15
SHA1 163fb7b332660e72c1f2ab58bf0ac1dffc667a8a
SHA512 7a82b0335d4f0564bea5426a98ee26521ab09de3b7ad22a893258463ecaa9ed36c0d3d49f5740245739e6be9ebe150537c25cc1a94d58ecc3e9a60f89e7c37d5
SSDEEP 24576:5wu4OWj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5wvO0LNiXicJFFRGNzj3
TLSH
T1B975F18632A40CF9E9BA41398657C035F7F2BC152A25DB1F4360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 7b06251160dc6a79e3be6165af82f1ca2e3ddbed40b47e2d7fad65909ccc89fe
MD5 09e7df709c8ae7787cd8abdab129a563
SHA1 fa4a5e1432cc915836078c6120a4ceb20d1f2974
SHA512 afd4467b43466b1c34eb727fc6e6a07c33224cafc92ffa183d631fbe7f17c54d16ab3369fcc3f5cfd8ca09d1630e705c38a6ef6fa5cd9a1c064237645cbe34cb
SSDEEP 24576:iZue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
TLSH
T13A65129622D820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2330ade9ad5f938bdfbb6e828feaba5a503d1fc0e20b6baec0ae233027888e39
MD5 f9114741afbe82f66554a64762facccc
SHA1 667477662eabef5e9e152255c882d2d86266801c
SHA512 90ca2e4d8deee3eb6c08faa578e823bf2765df1f0f688a697fea0acf36fe4d885a2a4a87386b15584f9bf3d43d918ff72fd22634a277a81e698f0c01cb7bac1d
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3V7wRGpj3:UQyiKa/X+PNZF9
TLSH
T12D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5c2e5b81c3c8c545d04c9f5d4572f1e3d3778d738cf051828d0661c78bf3702f
MD5 34b89ad8b7b1cd644af128bacdb53d14
SHA1 b3337ecac5dd0dbcae2dd790314fe00a2dbdf7a1
SHA512 52368727ec687b10b98e2d998069e2363c1a9ef5db389d8ea24f68f323b12ab5e427a665b949b8d69d5dd6b90bd7af9ee876bf430bd157bba6084154e01ef3e9
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3V7wRGpj3:1QyiKa/X+PNZF9
TLSH
T11A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6f463fabb93f997ee817995d62efd7972b052e698ef6d22678b2d772d8be8414
MD5 f68d4fb11a55d5732f0ac2daba288378
SHA1 4024c5c0feedef33104ea7525e043e2538b71a2f
SHA512 11c76141512706373f76e42ae26b5fe5bf4a2b606ec915387f7ac9794e27a06c56694612b8627900bfa92968ccf363d9246d655962b94977f81ba655946270c0
SSDEEP 49152:X68Qg55nhceWu7PNU3/fLNiXicJFFRGNzj3:BthLRc/f7wRGpj3
TLSH
T143B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1ebf42fe8697cf1061d1cb01320f76a2071c00a29d9c576017168fb7f3d6322a
MD5 cda720e5d96ba9d552cff0f5d6365776
SHA1 822ba6686f02a688e711d0588125bff53bb2ba0d
SHA512 b1750b9a2694d5f72df41bc42aaaf42cfdd5c08dc14de36e38f2d035ebea3cf6743bbebd3583b8997a395affe9b87d134e2a18d9df5e3dc7abb3a6e3aa60dca3
SSDEEP 98304:jy5112gYy5azzVvt69nLKnhZy7wRGpj3:+LIHEWhEF9
TLSH
T172167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d78d86830f85f55b259f0073411d434316a029b04d5ec4bdde88285d6e035a30
MD5 decbcab50accbf7887e690e3a46540d5
SHA1 9bc852df6542abcd84520ea605da70c409f0c305
SHA512 ec6b0870ceecd01a1d1a02b4bfab851ef63a8ba5c805e856054c14a497bfe4c5b6f231df4f3ff457e723aba0c26c33ff43e67d0904edbd0444886bd691f69aa4
SSDEEP 49152:HB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gldLNiXicJFFRGNzj3:Ju6Jmdxd2dd7wRGpj3
TLSH
T188D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 99b58d58313e5f051a3eb7d64de83d339f38ca4f52bd9c0d138c9c9c08f6b88a
MD5 5e80b4073459f23e3c0540c632723a49
SHA1 e35f39804cbe653a332eba8acf988d13e715b0d2
SHA512 df760643ad2a51e3bd012b9b0b95f169ed3d5dd8788a0ff6b677bec2235ca529f141b27d396180fc14b2de70cd8760688c6fe1f266da9e9864da8df1ea477b68
SSDEEP 49152:Y1hpsNoJpF1A63U44CwH7R4xxLNiXicJFFRGNzj3:YmifPWRA7wRGpj3
TLSH
T1BAB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ca325c71e03ec61e3ef9f770ddfe0c3e1f79b9f0282a9dafea8d8937bdd29884
MD5 2a0f014dabdf290c67447ae953b8418d
SHA1 b9e66478d1cee10853eeec5682287afcf7579959
SHA512 208922720102a42416342f10b6bf76e8f9b544f8eff81ed7a9beef6a3018bfa17e10248011c87c48c8d65ddb266db93d52b4b8cf87f8f972a9f0a8de47c72ae3
SSDEEP 49152:vSuZQIY0Be2KcRVtOnks6NMHqeLNiXicJFFRGNzj3:V5dKii61e7wRGpj3
TLSH
T1A7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 646501982195fab8a3cf47cb7b2aff5dc3b1e590fe3b06167fb29e58aee5b9db
MD5 05bfc8cd5b9a65fa6d48f191aee28ca1
SHA1 c921adff58c9bf093dce2971692d4b924902a579
SHA512 2a862e3efc6c4c8cfe9d1e9e7b8db524907bb6e101ddc885663b3a1a69d8c8aa302bd696638214f8499b5e2f0592cf3570db5c368640e632634a7e4b42802bc6
SSDEEP 49152:1htSn8EApI0fig3giDn0AP5wNLNiXicJFFRGNzj3:EX2imphU7wRGpj3
TLSH
T15895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 d1236f6c57456ce874b3078ac313925dc156eeb4d53f5760f209fe80ab9b2f5e
MD5 b02348bc69dcbe89d005973aed1b9830
SHA1 51afd214306a0ce2fbbee4e82cfef9a44bcbc5d7
SHA512 0541b8b6b96b6db4c4b2f5faa37db0e9f1177b407a2183738a825502716d273caded960d4cd2e343c2a00be6a07e9bd49ef3a36949b6f3f406c2fd27618c039d
SSDEEP 12288:0IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:06/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3548955B1F6FC003AC6754428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 49bab411df45e53a04a6d28187fc240b61f9ab4fb2b70010c9086493f7c4c54f
MD5 2913bbfa355cd3fee4549802ce29c00f
SHA1 cfc9504da5dc4ba09df741e5cb8e76bc1c646fb7
SHA512 a249774b943699e5bcf56df444ed1a01cbacde4b4c7f8bf601f05602165564f657ae6ab71e75363cc4198e6880734103aaff0488054b08bed4a41927338f2c51
SSDEEP 12288:DPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3548955B1F6BC003A86754428F5882E2DEB5659E3E3083D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 45092b0995e3eae9fd38324287d07a79cdc889d0779f5a4ef0c6a350d09ce6cf
MD5 0a71cdec1eab4f13868ae6843aeed227
SHA1 66887731dd0748e37dcb5615d35bcc442191c185
SHA512 1450330a74f6f3a425fb88ec20b21e73904801d5616c1730904d1b1a96c3dd12166a7856d46676f29856883540da2f5af81ccb5618aec8a53d1dcd6fb218fc1a
SSDEEP 12288:IViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D2548955B1E6FC003AC6764428F5881E2DEB5658E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7049843351bcd537ab96fd4ddaff9570c7a7f99ec7f2e921b350e22ae326b593
MD5 bce64e7a1a5a054afff5c2e4a64cf7a4
SHA1 45f113b111c6218d64ee1f908e9918cd4004eadd
SHA512 63293235f7d2a1f90a0cc850e3a2149376f3d8229f230887d8cdf93cd012a79dfbe12f9d47eec6d4795f44376286bc4177a8a2fc6b59df9f9de6efac9520ebaf
SSDEEP 12288:mV2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E3552392168901F1E9FD8039CA764024F2A47D6CD7365AEBD3003D1E5A35FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 6313ed6c56743946ea39d64c87a243e6cc3b65a0fb5bbca98954b057faff993d
MD5 e9d9b0cea6eb28fcbcc2c8c47a8ebf85
SHA1 516c98097320c890687cb517be050be141368fc7
SHA512 7d3625e8f23405236ca9aca67e9edf31339502973193b81b4f71cc6d2c44d656df50e5907fb8041c73a7b477abb2269d7ef4427398c13bde77c99f8914aa3c3d
SSDEEP 12288:aOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E3483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 39ca1a587eb40a7bd9c92c96c89ed268bc3c206718fb77c70489b34b87848ac4
MD5 94297371ad4b65fd9585682aa6aae386
SHA1 5cd17385d2113e724c85d2b3ba66853e10d56159
SHA512 deb418462f0284efc268e795a6ed07793e98ca5b3c7324552f2a375169ed49210033006e9b8a45d24747554c837df3685b37462a894626914978bbd72ed4ee38
SSDEEP 12288:xjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14E5523D3548955B1E6BC003AC6754428F5882E2DEB5659E3E3083D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 962141051b03fbd1e085d361d3ff96de078bd7b8a8a9467b48b57cc51fbc54fc
MD5 8deb861c8336044aacbca70e660a675a
SHA1 a3a5e61a5e711b55723b74ad05d72ce505ba19c4
SHA512 998e5af9fc85f7bef76a141609c3d83d3c640f9b2d0d47a394430bc57df9e4577c06244d3fabe4fc2fdcfe2a2ac6647d3d5ce59e387abf058bbcbd0468aafebf
SSDEEP 12288:HHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3548955B1E6BD003AC6354428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 246df64df85a5ab9f6458f8beeb34c5a822a6804027de67e87f597892676c6ee
MD5 952d3d55178cebafeb2eacf1b578cf1d
SHA1 14f799b72f4c5e782eb722936c6a9521abda6b0f
SHA512 8ee8210465d15da7827fc8dd38d9cd3b39e533bd54871650aae5b8296c75ad4e6c13ade2bd2c9fcd7818dab72f2d294e7196c9510d595e3b91dedf7efa6481a5
SSDEEP 24576:RZMRzFVSOb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RZMRzfHLNiXicJFFRGNzj3
TLSH
T15E750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 7a38e1539048fcaac51509d50530169227001df99027163810bf88e209130d09
MD5 0b39f206c8dd9953bc3a9a32e39c300d
SHA1 8b211450de33ce049ca0f8219871c981747d4cfd
SHA512 0239e6ddf16b5cd0a83a0b9226c5de27f64bf043967e87baf95cb9196d613f113f44076f42c65d0443a500040c010d4a61034cb964c552989262f12edb038668
SSDEEP 12288:DEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1655523D3548955B1F6BC003A86764428F5881E2DEB5659E3E2483D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 b8872a704c10a1cc3bc92ffce04e54eed627b2cb86249e2371bdc7a572ccc11b
MD5 a4a2db56ec88dca57465355640123dbb
SHA1 200ca944ab3509300d3ea137384ddcb1850344cb
SHA512 8c1ef539f0c41689a6c60fd21c36a23f28350a3d359248b3515dafb587295ca8635f2c9693e3cd9baa797f388e715c3fe8230f3c5ba32ce9cd1b2e973e26e44e
SSDEEP 12288:kwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ki/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE5523D3558955B1FABC003986754428F5882E2DEB5659E3E3083D1EA238FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8767d799877fdadde97b676d79ed846d681ae961d2c1f169b73035993a6e87b0
MD5 a35f5fd597b81839999ae1ad26e33cc3
SHA1 e2282240fdbe28f28ec874f249e3fa0f0c54309d
SHA512 90b391e527b0f67d83b6e088cf5125341db98d60d8dc7279de79e7e2e05ff53f770702396e1502db6e514e0ca500d441a31dfc0d582ebf08819b6a0ffcd21e6c
SSDEEP 24576:zzy//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zULNiXicJFFRGNzj3
TLSH
T106650247629530F9E17A4139C9620911F7B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 69dfb346fc809d5afb770d00402e21cbb2e0cca960d8b9a6fca4561f12901a22
MD5 c0e2459824ed308071d96b1b2fbf2ce1
SHA1 46aea8e54fd45ff9edf9ea9fa0c7c0d098d79ce0
SHA512 248f74dfc7e1503beb12f90af8976e4c8ff2cb1c59fc0f84062ff78909052e9035d9ae5b8b70e69dbbcf85578a886819a2650f8ab7addd10e24e08de13d90d42
SSDEEP 12288:rEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1185523D3548955B1F6FC003986764428F5882E2DEB5659E3E2483D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 9188b6da2ff9dc7e8cb734d406e63bf4722a6e4c51316f71fb25d7f6068de57a
MD5 b8be8614d67f21c590330e0f2837b093
SHA1 f2e9f008873eb6610f2f2acd54e77e094a6993a8
SHA512 d375633648e2637e738e07db9904bc53496bab02eaee9fc8f73efc4f354f29e1f75ecfbdc4f253b8be5948be1ef73d921a79aa822c96c055a6e05ebc31056c62
SSDEEP 12288:lEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1005523D3548955B1F6FC003A86754428F5881E2DEB5659E3E3483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 088d715762605a4a9d630af7af5670661112d97449a79a024e87f404046b777f
MD5 ea60a1995b807d156ffab0235b2bedd2
SHA1 921a288ef4b0ff34731376263559c2a8db058fd2
SHA512 9548d7cc51db02177b75270cbf81da22ee2aa69a5623c8c41877f14c2bdefc6fefa815543da02592cbe50f3ffcdbcfe21a8cc0bba2fd0ce3bfa49f405e6cc3d0
SSDEEP 24576:Izy//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IULNiXicJFFRGNzj3
TLSH
T1D8650247629530F9E17A4139C9620911F3717C364B208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7f2919d5fcf871363be0f3a226c99ed08b5c015019ba1d81aabe8a10e47c9404
MD5 1fb8b9a0f31616b709237ae5fcf82c60
SHA1 fe4c07065790e0daff160609e1d1751fab277e73
SHA512 69011e08b22137f6cec8f2cdfb693e37a01093579f03ddf8179edf5990827900731fb16f7acffe87c2542eda02443929cd048dc3aa79ac975c8d13569d44ff33
SSDEEP 24576:rTDaLl3z0zDJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rTuLljMLNiXicJFFRGNzj3
TLSH
T12A7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6dd521a1d87ce8c80c6853d7c5efa4c8ab107738bc74062d4fc418b265aa3f65
MD5 d630038b64f748a11a8f32b88bd3d30b
SHA1 1a640a84ecf13606d1f3086749d770744413e4e5
SHA512 69367cb2cabcf58c7cf7fd32ab1401c98aaab3e93a0035984a2924c37741a5c12a4dee45487e93fa283161c7154f576f59d80cccbb5a9fafb91d3bfaa32bf8af
SSDEEP 24576:Q3vd9CHKy7GZ1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:avd9CHKyaHLNiXicJFFRGNzj3
TLSH
T13285CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 3927cd7672469adecb8f825561f5064b7e890691ec60f5e37e8637bd64eea6b3
MD5 2ee0b6537d2330470bb475c1a9602df9
SHA1 26cadf809c2d6eb54b9eed22a3c5e0fe70063a87
SHA512 cf9af7dbc0daf294deae0b42571dad6bf1e74996fb0524375ba4b73ecf56183595e7bfa5de4c623a68e07b6fa1cf8411d1fc750f9a7ec42282ae6a0801a3cae1
SSDEEP 12288:w1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E3483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 618d33b670f86c61d7a6e9a91a16c15847d16604602eff8fca482396561b1c13
MD5 a208367b11734ffb9d545478d711859f
SHA1 97d75c196a77789c9f43e639246da7aea6f0bddd
SHA512 07607c60df5a8510ac105d2af31826a8377cecf0f60a8a89a72d4067f247d32fbb6cba35d3d494ba15720cf9ecbf15ee12883e6a02f99f2ddbae60351bab99d4
SSDEEP 12288:8LiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C5523D2548955B1F6BC003A86764428F5882E2DDB6659E3E3443D1EA23CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 6a66d5129e66b07e93242ea6704821669d9a767ebb59b5be047c5774c6571b16
MD5 8857f471527d7827e52af4df400e4a05
SHA1 f0cad617d913e5ebba34dc661d0e74954d01efc9
SHA512 bbf5ccc25b70ef19946547f31038044c392d253aa8d1cd74e66c598e8b20b7e648e4166cc0adc509cdd1d57101c34ea1692db638b8bace070ba7bab01d9e5ef0
SSDEEP 12288:aCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3548955B1E6FC003986764428F5882E2DEB5659E3E3483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 3e394cb260ec78fe322566fabdc4aad7e166d841ea76df21c5d4e7690aae7fd1
MD5 cb98f18b4207a48a00c7a25320a5080b
SHA1 ea68dba0c96ce4b22a8cbecc34861c35aeece390
SHA512 4283b9aeade88d711b8d58954f0d0ce4c82251afe611f111e267f467ce512dde7816372d0996d02fbb60070cdd6b0f9f642d94df35bbfbc7899ba09d209d9920
SSDEEP 12288:bEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3548955B1F6FC003A86754428F5882E2DEB5659E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 3229d693e248b3a63e7898913233069c4d01e000529fe02d0f8745176fa565b2
MD5 a4411959d3a08b393f7c1d5e5f3433db
SHA1 db595395931947a0b4b3221ff0ddaf7db64ea576
SHA512 089b394e9fc9fde873366c400f7137edc8b94f92222ec633daf23e9cf306fd51c994c4ceb660bfd34a354129466470bec20aae5a5eea5cdfb97e56a741fefddf
SSDEEP 12288:c1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB5523D3548955B1F6BC003AC6764428F5881E2DEB5658E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 5eba38ad2b502dda1fdfcc0c87bc768d5f5d7c1792cac004c85eae5660f1760f
MD5 a93312845601304915bb78722ff30429
SHA1 adc76759ccd22c70db1cb8b604c5250229d9b10f
SHA512 8ae5433644fa103eeddc81d9749efca1e4b3283f1f1d3a829e6164a6e39213bf03829f1c6a0315f6d7730b360e5d451de423da80e3aa5068268fb7d3bd6cadba
SSDEEP 12288:UciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Um/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D2558955B1EAFC003AC6764424F5882E2DEB5659E3E3043D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 427ffbc559cea05d891d7bc1d8c30da4d669edc9a5fa38ee4d4ce5498fc5ddc4
MD5 79d2c732abb7777e1a85c4f385cfb6a7
SHA1 c595fc8df43818244e92db79a06ba93e1f7cb6ea
SHA512 0455cbe2d0c2adf295cb3eb99900ee9fe8738e528451bd9bb1c9c7be3b274da1ae9ef85e3ce7da1008bb4806a6ff9f3b0a5fff5b052f8f6ffa9f7b7af1a7e826
SSDEEP 12288:iOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E3483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 2e16ebc92e9be3ce42e4136683853a1ea9d39246648253569ab3672a3d74c520
MD5 8db1fd559a89a411701fc6f2e9b9ea84
SHA1 07cb40c44608313fe0b9ab9684b70c568e8b92c8
SHA512 7c737d4839aa13fbaab1894bd4b57d450f44b0430389dd64dd59546650247fa91730ecc9b94fd31af9cd36ecd5e16b3e5bade42a60f7000b1231aebdcb8d46ad
SSDEEP 12288:adiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3558955B1EABC003AC6754424F5882E2DEB5659E3E3083D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2bd57dd0816b3255a9c012e7693037667a8194a74ca5ad0184344f9ae076d8ed
MD5 c17f61c6aeaecb4335f9797afbb0639c
SHA1 104dee198d19daeab8a28e114db5858793c3033f
SHA512 4229f159c88246fc0e273eba1df9d5ba24ae6e045e77588dde46d0f52b52d8e5a2afee3d56671f9752f293e26fa4e21223e65d5e761b4555f27c833db5d2ba7d
SSDEEP 24576:BfwvUk9RX6wkyAIS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bMnYISLNiXicJFFRGNzj3
TLSH
T15C85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7b83abea341922eebba07cda8cf8cbcaa0b2286a95811e1b433b386a99394d5
MD5 cd0d2a2eb55765d0ffedd37845c41176
SHA1 e352c37ad848ab65c90b1849bd5fb3f3a8363fb0
SHA512 3b63aa948e8aa3c7f836eda5446cc6da45143c5d3e9c29afd27cfceb4a7e6817ea6b5160d0b35fddc5c26359d37778ded6b327805539599a93c028a2dff0d857
SSDEEP 49152:pYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tLNiXicJFFRGN:kySzP17wRGpj3
TLSH
T127066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 680b9e50c47b31bb952db2217d6c1a42b5c74bb611a8967f5d7de7c87ebd8f4e
MD5 3c2a6e5bd0082143b31bee0487411032
SHA1 3bc108368d0d1840a883136d6878984285e4d914
SHA512 007d55824cbf4cae2f7fbc05d724c44e9e2d29143679e92d669e6a487ffaf154843d282ada76cd939a2dd84bbf49bc07d915af1b1c9f6430f4000766772a06c0
SSDEEP 24576:J47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J47JUQjTirIhCnDHUPfF/dLNiXicJFFS
TLSH
T1CE65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dfc302a4e80e147e4bdaab8712e219dac1f3e956e65187370136923596a8006a
MD5 7870443b2918f9f0ad0d7906478186b1
SHA1 95587919c082c33602c972542e4c4c688d4df0f3
SHA512 3ef4f5513a850c65115e9195c75aef5579e67722f0721356c98413bc1f99490417f808ec7f09d94edbddef4694843df943f41032a4f42715ffad99c182ebd542
SSDEEP 12288:Xbsf0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C65F15AD28802E8D1AE5139C7564900F3637C2987E1D3CB93C0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 43e9679682d76764f776cafbf44f7bb9522b5e0f17c62007b1bd47b907489a60
MD5 19cb11aef271d43ab5102ed70c950bc5
SHA1 5c16fd90b450ae9ae1ee55dbd53a36f19d3de226
SHA512 00fe917d5c9eab7dba2a984b9a6db01c93ef7dd19df63fa86215fda69ccceb11381de3ece172bb5837f958b4182d41cbc75ac0abc429248a33fe082a439bb387
SSDEEP 6144:8sBC2narHacdgPnNDPotMxtKjhrU3fhkQdejBSa/g03H9gUOkDI1jC7Or0pLzNZf:VikEU3fbde9/wUUyNZlwbKwp72S
TLSH
T1DE4517417626C74FC66980325E32D2CCAB707D11EE04AF0373C99B3ED576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 c569928b9f84481321489d3b4095ecf76dd0ce8e85a5fcd7b389448d9209339d
MD5 ddf9beb731aa986f3d5ab578ea667a5f
SHA1 1ede67e48457dcbb547a579b0623c61aaa0a4cb8
SHA512 f5fc94cd0e1b4b1c20c46343e987d92b203501d3b75315d9c26bb3600e02608245091628ac4d9e271274fe859808508d5fe5eb8f655040382469dd02a6ec0f6d
SSDEEP 6144:KVvPU03v03j03HZZ0tX2iL06bL7JxW7IgU103G033qD9tMxJAAZv03b03o03M032:8Z0tmiLznGZsUHAfC4
TLSH
T10475FA816537E38FD1F6503203366B8D7BB4EC07B7496F26B3C84539D86AA15A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 7487d4be8a90c2048df68a77548946d6ec2341eceb4b106b929d175422eb25cb
MD5 9d2cb31db3300ab5acf6b34008f76629
SHA1 9975fd5e7a681e77ea3fdb7f00bcffa33289b69c
SHA512 64586d60fe8bc41fe32705b24c3efbbfa60e5dfd682305bc04acd34967e7ac680fe3e7dec1cbe46e40929084e5ea3a5f68b014a91875a1918376a01d15644267
SSDEEP 12288:5z7MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F7552393568C59B1FAFD0039867A8434B5497E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9e677a26177403cfada0bbe2a4f298f4aec483c808a6f2961cb325fa69d449e8
MD5 0169f15e47a8d3d7d7d272e6ff041a4c
SHA1 bae70949391b80632b801735ec2dce20d7afae44
SHA512 d5b09f81d315ccffe9d7033bda624f855fee6a6578f66b9186a738e3ad41f4278e3878517baecd14f03f7522358173cd604536310bb43126f14eb83f79d88bd8
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ugb4mBIBhGFLLNiXicJFFRGNzj3
TLSH
T10465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 93608773a8ec9f77005e947de2cc358db9ad6e5861bc248ad592a41dbfcd6478
MD5 31079c93bbc6e88078b62fde29b2ae23
SHA1 992f381eb861b6f59d4b7993ebdd76d96d726b5d
SHA512 283e9b0b466aa5bc504e1a01d9d65412255fb4ea07ea22499cdf9b7be762ad474293fb017297e1809cd97595832142f9c068cbea0341b68e450dbad4a3914d29
SSDEEP 24576:BG88u8FpJqH1bzria7/mb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:E7ZFPqVea7/kLNiXicJFFRGNzj3
TLSH
T12595F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c0c64dc9b39c4d7bead3eedeabf03de6ee6de106c08fe5ed4263ebf80fbf69f7
MD5 3080685033bc875ec7e7cb85d36e5977
SHA1 b52963999c6c32d5a80ac93d465dbcc8eb05d7b8
SHA512 62dbce9ab19a564e0f4f7691cbdd06c316974d1260b123a88c20037448f88694978e1c317bec2029069ce84a32a5f292a93fe04ad846be1d9f7e56dba3efa1e9
SSDEEP 24576:0PUr+NQH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JQHLNiXicJFFRGNzj3
TLSH
T10A75F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 32994177e669160d5b5d75860697a384c6bd16f181f18ca1bdf7d74031ae1cb4
MD5 5d04f0de2705f00bce7a97da3e46b4f3
SHA1 f155e8fadd070e1dc3381a2da2dd742d5bd0c10b
SHA512 0bc2ccb40f00cbc36f4a26173ea69195de134f9e70d6c478715fa48761ad0ef5b95ce359efaca7bc02dce8d018bee665d560a92004ca0b7d03c739f0743fb18d
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXLNiXicJFFRGNzj3:6G05lO43bq7wRGpj3
TLSH
T163D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5d2e99f02dad1a95639d24b1004aa6d8c622cfd6e73b27a3472e94c26f8100f3
MD5 b84fefb3ee6a31628bdec4422cfdcaf9
SHA1 06bb8a183d79000ce478566964c138f69fce4eb3
SHA512 1e795120e8f43497ba4079607fc7e97a701d367fcd83a17f5346028ce4206ed957823eb6813804ceb59eda3d3f3ff4a01fe3781c625cfd783b34af2585ca294b
SSDEEP 24576:4fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnt/TwSfVcYG3K/cJHlnFR+IGNe8jg:Aa5POZ3BJt2pasx2+mfLNiXicJFFRGNf
TLSH
T16F65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 29b782bea0bc30519b36aaf4de4eb48a1ed86dc0cc2ea31afe359f0e9426a9b5
MD5 1fee0d23574b6c8599f8ff7746ea07eb
SHA1 c8d644b79b09cf38740b5a1de167d080fa926364
SHA512 107628bbaa6cb78bc826c23422ae3969825004811ea8b2776960b04c3dac46a0b0a371f95bd7fb80092dcd427be213318991150e6ddc3dfb6cb753785155237d
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YNc/zEOVHFELNiXicJFFRGNzj3
TLSH
T1C7858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c646a5276ad4c90c33aaa7362bb8d02d6f5b873132a8d8c5ad7964a68319072a
MD5 3fbdca55ea3f673df71145249a7542ee
SHA1 f1722bb62b479d034231d1bdeabdc4a13c9242b9
SHA512 70d311545ab89c54e0d42b12302c6e695f414ff730cb082a7cfbe78b7121570f75aa959befd0ae3b60deb71b9c45aa829a60681a223f0d04b7379a2e1d06d9c4
SSDEEP 24576:VTkNvNnaFeYhJNtmZBmB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VTMwBtOmBLNiXicJFFRGNzj3
TLSH
T16D55AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 05dd6a804620c359e91b232a943a63ecaadc353abab29391fb230492616219ad
MD5 7a303edcf75e7c6b1be09fdb945c67f6
SHA1 5f059ddf2ce741715a47b1ae584fd54e5aa864d5
SHA512 2943acb879505cfcf7e1736f6bc2b5a8605aa7b84a9da2eac216ccffdc3f19919210c6816a9d2e2dec0a06774ab75caeee5fa31c02132b156aa9ecd291dd2682
SSDEEP 24576:HD3FHshBIYQgAa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HDVHeBIAAaLNiXicJFFRGNzj3
TLSH
T14485E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-83-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/1088-77-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1088-78-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/1088-309-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1776-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1776-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1776-21-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1776-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1776-15-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2908-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2908-54-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/2908-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2908-246-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3116-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3116-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3116-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3116-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3288-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3288-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3288-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-381-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3448-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3448-322-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/3448-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3448-0-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/3448-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3448-87-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/3448-317-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3872-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3872-137-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3872-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3872-126-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3872-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4144-294-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/4144-73-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4144-67-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4144-65-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/4596-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4596-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4596-313-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4796-115-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4796-113-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/4796-121-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4796-312-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/5400-39-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/5400-50-0x00000000022F0000-0x0000000002350000-memory.dmp

Download

memory/5400-40-0x00000000022F0000-0x0000000002350000-memory.dmp

Download

memory/5400-46-0x00000000022F0000-0x0000000002350000-memory.dmp

Download

memory/5400-52-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/5704-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5704-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5704-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5704-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download