eca6a9f876fe4607b3dd4551031ee8ddab6140e9eb833000f2cf06a7a2546406

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 8.6MB
Sample260930-dkdbgascng
SHA256 eca6a9f876fe4607b3dd4551031ee8ddab6140e9eb833000f2cf06a7a2546406
MD5 38662e3c7a1a19cbefcbbc38715f8d7f
SHA1 c8f8812eb20d6fd9e8ee58096f674841582a715f
SHA512 3e395c469bcfbb1f7a4b1c8774c8020ae94a1469441794e576e021f29f05be814462d1fa0a64e319ef8ff8975c344cfa0381eef5053070c12758993df14d4242
SSDEEP 98304:Ryq1v/nG8DyVqRlM8sd4zqCKHISj+V3+M4FHXlJTU+M4FHX:Rt33z2+VL4bJ04
TLSH
T197968D13F29941E9E0AED278CB664232E9B37C854B3562DF03507A651E76FE09B3C721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4148	alg.exe
1436	DiagnosticsHub.StandardCollector.Service.exe
4912	fxssvc.exe
3324	elevation_service.exe
3060	elevation_service.exe
4268	maintenanceservice.exe
3808	msdtc.exe
4776	OSE.EXE
5016	PerceptionSimulationService.exe
2032	perfhost.exe
1396	locator.exe
1872	SensorDataService.exe
1576	snmptrap.exe
2540	spectrum.exe
1904	ssh-agent.exe
3280	TieringEngineService.exe
3068	AgentService.exe
4520	vds.exe
4916	vssvc.exe
4984	wbengine.exe
5080	WmiApSrv.exe
1048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
\??\F:\	alg.exe
\??\F:\	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62d72626c665fbf6.bin	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017430-528.dat	upx
behavioral1/files/0x0001000000017066-527.dat	upx
behavioral1/files/0x000100000000c538-530.dat	upx
behavioral1/files/0x0001000000023463-529.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaws.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024fe5e728850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050d43b748850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c25ed738850dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008415a828850dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000298c87828850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083684d738850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b50902828850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fd8d3728850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ebbf3818850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4ff20728850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3920	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3920	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3920	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3920	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1436	DiagnosticsHub.StandardCollector.Service.exe
1436	DiagnosticsHub.StandardCollector.Service.exe
1436	DiagnosticsHub.StandardCollector.Service.exe
1436	DiagnosticsHub.StandardCollector.Service.exe
1436	DiagnosticsHub.StandardCollector.Service.exe
1436	DiagnosticsHub.StandardCollector.Service.exe
1436	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3920	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	4912	fxssvc.exe
Token: SeRestorePrivilege	3280	TieringEngineService.exe
Token: SeManageVolumePrivilege	3280	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3068	AgentService.exe
Token: SeBackupPrivilege	4916	vssvc.exe
Token: SeRestorePrivilege	4916	vssvc.exe
Token: SeAuditPrivilege	4916	vssvc.exe
Token: SeBackupPrivilege	4984	wbengine.exe
Token: SeRestorePrivilege	4984	wbengine.exe
Token: SeSecurityPrivilege	4984	wbengine.exe
Token: 33	1048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeDebugPrivilege	4148	alg.exe
Token: SeDebugPrivilege	4148	alg.exe
Token: SeDebugPrivilege	4148	alg.exe
Token: SeDebugPrivilege	3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3296	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1436	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3296	3920	2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	112
PID 1048 wrote to memory of 3888	1048	SearchIndexer.exe	113
PID 1048 wrote to memory of 3532	1048	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\138.0.7194.4\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=138.0.7194.4 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --initial-client-data=0x304,0x308,0x30c,0x2fc,0x310,0x140609ff8,0x14060a004,0x14060a010
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3296

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3376

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3808

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2032

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1872

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1576

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1592

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5080

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dc3c53509502fc27c0b507a19e1b1e6f552baf10eaf52901f522e4c895784f7c
MD5 5bfaadab8066c762d2114bfe61738a12
SHA1 2a5952331ae33e7b578ebdee61664313d0eb3037
SHA512 1b9f59ac5c902d43653092a9bf0fa9a185717c30e7cb3bb5f3b4fdb12739043afb8782eb7f45a9001491b39f0d2c68ad302b79cb6aefa4930486889b8af75321
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnM4hxSMmT8oWgBCaX:k3q6HjBI+M4FHX
TLSH
T1B0D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 f93103e4c674c140fac25f27c801dcd04cee81084b2202cc5f5141b14703a68f
MD5 5cf6caea1b1be892567ed4153936baf9
SHA1 d115b2710127891dec5c4fa6b67299f0fc1ca758
SHA512 21dbf349bb3ec2cd96b2bcb1365eb35df81bb3da0b81e5dc54c59cc148359e8bb1353743486ba1a8f95eb4634c4d8f3463f7e8c1ee34755fb42d5130f7726fb3
SSDEEP 24576:VXYfDtczATRrKhxr+EHNmT8oW4ll1JCrLKXI3aKngL2jdshRTdG1YxITqvfPkbIp:AtcW4hxSMmT8oWgBCaXMarSj8RoTCCW
TLSH
T1B9C51229A7C409F8EC67823CDDA28505EA737C988351E78F07E499691F336D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 3d770f555b162752b328ef971cedb30273456b728dc4e1da48b6fbe8fa26e108
MD5 99ba3e9786e6970a255e92110187c6a8
SHA1 ea9ea3828b7dcff93bb4c395612153c661114152
SHA512 ecfde419ec8833ebec1fe864b9b61985569dd8ac4b2f7585599e77b423c3ad8588657288dbe098268f3a36539e428c4a2ba7c0700864004badc9b5b4b5c36701
SSDEEP 49152:/kcW4hxSMmT8oWgBCaXMarSj8RoTCCWhxSMmT8oWgBCaX:/v+M4FHXMJTK+M4FHX
TLSH
T1FAE52239A78548F9EC2B833CDDA28505EA733C988351E75F47B49A682F336D8193E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 1e79d3f86b1a931eb4cc62b19e7cea704a696dcb46d49c97c46d853565ba03fd
MD5 12f83ef47ed1068052f0697f67ee5989
SHA1 6e8187ddca33d98c257fbf203144f48ab987b045
SHA512 71d074a970286f37c6b3719b2298518009f03c8f7febc4f0d276f1fa1d2cf85f5ee1ec095c9533361ed5328cf0ead4261a07c20c95b9945255d6d19c77735620
SSDEEP 24576:VXYfDtczATRrKhxr+EHNmT8oW4ll1JCrLKXI:AtcW4hxSMmT8oWgBCaX
TLSH
T1CF85F128779508F9EC67823CCCA28512EA737C954360E79B03B49A791F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 e3d5975a463ac1e104eb88d3e7978767f8fd0ed8318173d08505471ed7fd8cd1
MD5 9aed186f6e48a49aaf483e21584bb031
SHA1 66106330cc6575cf9c93203c83cba3cbcde5432c
SHA512 5b68a666ff085f0f573beab3228af1b3f9806bafeb70090880368cf06690efe05c367f55e8dcfe761014738efb79f889c45d1614c0fa701abef2f6c324003211
SSDEEP 24576:Y0Le5ji0hmxYrMkRrKhxr+EHNmT8oW4ll1JCrLKXI:YPji0A2B4hxSMmT8oWgBCaX
TLSH
T12E95AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fd2c8131d804f708ad10558de1cc2792413483ec89817f08b06ca37daa892c48
MD5 20994ce3ebeb42021aec46e0ee07ddda
SHA1 a731f70c2dbaa12601db876ba153ef99a3cd1889
SHA512 12716910363e516e0b65ff34c536d4800a9edeca59e1497170ec462192b216bca4b86bdeb8efc248e4c28b9077b1346422fd8b531af8c2ce1cbf3e5ffcbcde11
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyumRrKhxr+EHNmT8oW4ll1JCrLKXI:9/ezSC6vUzPvxHjyN4hxSMmT8oWgBCaX
TLSH
T1A9756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a856c9dd22f491b7abc02a871ddf09157974a12657cc879cf2cd7597ddf7eecc
MD5 76783b0ed4bbcf392e2fff6ed4c77708
SHA1 93a144564ee51a27b101673beea88c9d7142fb4b
SHA512 a3f366dbb31b2a2aa547f1c7b6604ec052b3e4f3c10d1c7918dc9ec24e25b50907b3f5f555fec35b53eee5fa622f32d1f073c3e673cbc54313d5c5603ef35123
SSDEEP 24576:rVbqPb88hv/l+6HRrKhxr+EHNmT8oW4ll1JCrLKXI:rVO88hXl+Q4hxSMmT8oWgBCaX
TLSH
T177559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 5b68046771f54a27e76c383bc85fd9fd0c19f08af74f1b20f2ee1909b78a5dbd
MD5 f44427f8c76d0d9153c7c4616e97fb05
SHA1 d3228a6616ee71c1a9dec7b6fb7ed41b8b3ea3d5
SHA512 6cbff5ae02c44a0b2d2627d76c950cb7cb7b2e8da1fb3b3f297d23bfa5a14cfe0d900585746572ef20b2b80d8318f9950a656ca54b44ac33d00a0f1ec2381fcc
SSDEEP 12288:oHYvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:oHYRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B76523759F0D64EBEE3B8335F87257129A990DDCD1412E3B8F3A3FA83934C1A9552212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 592417d28d0fb28c85a761c814cf9098237b9a04c49e8dc6ff90c9883dc545f3
MD5 d00654a3ee1e9d65534fd467fa137749
SHA1 75a0cd04a3a4e4794f7f3f4876ba4f4b00a4878b
SHA512 687d9829adae8447bc2ea773da9b2f03143de66bbd2f6966113d948e3c1910cbd2bc7e8be87f7ee9dd22a52c8140f9dd45b6e9bc35b8a2830a7c68d7ac8a275d
SSDEEP 12288:+eBNUbTVO86UfvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:+JIUfRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10085CF3BEE28FCE2C67A8D785A918700D77278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d5b759b222ec53c3144b305324ce2ff4fa451bdc921e2f099da63169564a16f0
MD5 ea1a71e3079650bf6d6796417774ed46
SHA1 bad927b6823cb70b76916c0d742964e0705d9dbc
SHA512 c8c376acb08a3a2a41e024e618f40ff2a7e08e766eefe7bf846053b0e8660da8464d9b16878e299d347706beb3e353096482eb80e18ac754cb2595f67c287363
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:TQvGAdlCEL8c/yRNw5CH+M4FHX
TLSH
T1DA266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 3894bee27a3294e149a711e59141eeccb8dc063fcaa45e72764cf5c2de2de31d
MD5 23b05595d6cbcbc43c57543dbe83dd7b
SHA1 93dd6d8eec29a02078b410fb6e86e2e314958215
SHA512 80d67cf621ea7cf042649d28d67f7c2e961537e6a2d96e81d697bbdf9be207687f712fa9eb7a3ddccced0c03a9cc4ee57af52874a6c0ce1fe41267bf68abed0f
SSDEEP 24576:L7ewsAjRRrKhxr+EHNmT8oW4ll1JCrLKXI:/ljR4hxSMmT8oWgBCaX
TLSH
T1F285E031FF74E036C67F0D766B36C716586C69604B512AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 936d54386f296e2e0587fad1be4f907f03abcd49c6fc1ec3358b20c406954a1d
MD5 9c11d416f33f22739c3d19ec89ee223e
SHA1 59413ed41e5548a96bb47053d492c61991749f03
SHA512 0a9785844a237956257e39163692a59f7470ae5c89dc699467d14c4a728c79515bd908bd66dce7f8e737e45d70a43c0fe62a0afb711622119b41a4d21e84e5e8
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHK4:QUEtQevvqc2W1cpV2EI32K4
TLSH
T179474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 31b0016da183a3aa415cdc610cdfadbaaa168e00dcdaece6d248a5a933271314
MD5 d76148f0da41586dc0a0013386c32498
SHA1 37850e310a8505925224e76389eb1870731dad24
SHA512 adf67e3e8b7e185e41a753a6182790831e961e9508239361b81ee5c665872ed63206b3ecfa9ed1655a9a27a623a3238b8837962f44a61f90661182d6cd4dbec8
SSDEEP 49152:pCbRquA/m2yL5zTfFiV+XenmE3/zx4hxSMmT8oWgBCaX:moquVjnmz+M4FHX
TLSH
T155D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 adc621d034ccf5424cb315627328e0bfe4c2eaf0641b7812c9c222e6dcad340d
MD5 c0992f573068bbf6defc694a32783eff
SHA1 bd8128bb7c0d1b387f9c4277d058bf0b31795c87
SHA512 a7387668bc682e85dd6a43aff051f5e70fd3e95d105417b832d220c0ff6800ad6908f3ac05fa5eab909c73c35f5fa019c9f998ad812ac7c64448f96b58b0ad51
SSDEEP 24576:YAhGLJIFoiwtA5l7S53SRrKhxr+EHNmT8oW4ll1JCrLKXI:YAMyFoiq5C4hxSMmT8oWgBCaX
TLSH
T14235AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a68378c1157e76e982a1db3720d42844d43305a54a22bf1f5d1981283b3aedd3
MD5 10568278d2577cbb71c2414cbe2f8184
SHA1 249dd21e7e98440fef06c969c58204ec00e7ec80
SHA512 4c61922511c0b49c5a42a10d5e9b38027084f70d5c9b2c433a85f389b7f8adbd3d96ffe38912b12841546b591286550763aa1be8709a14605d37d56551df357d
SSDEEP 24576:nwuSOWtRrKhxr+EHNmT8oW4ll1JCrLKXI:nw9O+4hxSMmT8oWgBCaX
TLSH
T1A685F14677A91CF9E9678239C557C136F7F2BC052621DB2F0770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 46588c91ef5561ac92fd1c52b24c1c3f8108d687c227001a018c523bc06b8535
MD5 6ac95fa87878b620a4d1fcdacbb69103
SHA1 cd8415e38c0c1ed51470a666132c2eeb34247987
SHA512 7a243e746826d1a12e277e85183849f39bff741f3568f4f27d2a85c15fc65142b803c15c6730e2262556120def7d46ff1e43f07ce5c026af66c4e7ade2af349a
SSDEEP 12288:njZ1IyhvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:jZucRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11475126A279870FAE967823CDCE14605D7B23899633143DF1A3947A92F33DC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c6e7ee1925c0c3012c9bf3937b89a0de82896dc65324be0e60529c68bcfd4a3c
MD5 7f2cbcf7a9c95c014c2bd7d6e3d51d3d
SHA1 381818a82bf65f0b685db8c88a7d7cc471f06547
SHA512 122a38335b90bd72e6934963c15bbcb081b593657e37aac497d394cdbafe65b6a453ba358a5512f635d47e68e0b3fd8d3df19fa87c2cf8b85c275dc176bd6559
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:/QRQyi36YOcPQLvw2gAf+PN3c+M4FHX
TLSH
T158667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d60308f91cf036172429aac24b87e41264e588338b8062fe23bd3882627c3e89
MD5 f14fa6f29425d2ffc989d1fc4d20ed51
SHA1 245b43d543992998b46382c659af6d12242af90c
SHA512 455e4d702d8ff5f0e20042aec53cae9378e9d3fc73a308ebabef79ed3febfd08849fe8b3109273ead69c3d8eadef337cbbd928614a4fc8a8c9fc2c601a67b950
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:xQRQyi36YOcPQLvw2gAf+PN3c+M4FHX
TLSH
T11D667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5025d01e4d2b47d0a58c88b6257c3744a98e525c2a7247a3aefea429b503b490
MD5 f3af458d1a36ffe2ee47c16e8401b446
SHA1 0d8b75ac8790b680e7a2bcd99d99c381ab2b6de6
SHA512 90cb4f6714f66256a2906f986b44cd74b5ec8f5730ca3e9afd0806983a8eba81abab694f762f76db6ce30ecc9f5e11acab5219e26a4b3657e2f9d7daf3c66619
SSDEEP 49152:f68Qg55nhheWu7PNU3/B4hxSMmT8oWgBCaX:ZthWRc/C+M4FHX
TLSH
T1BAB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bd943ccb782ea1b75c6ea4d271a1ea224b2364be61354b33bdc602dfb185da8c
MD5 35d5cafdd09926b463b89a0bbf92139a
SHA1 470bafede48ba0828d0599619c9a775fe7c44d40
SHA512 3c274e5e7483c42c043284f36e55c22d151de5ae433f2584a15b751fdb01bc0ba731368f89353b5d2b279e95e6ca2b357d4c6194b89fa66f2a7ec880153020ac
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:Iy5112gYy5azzVvL69nLKnhZB+M4FHX
TLSH
T140167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d63558078bad5aa8a64dc7b9d6d166eadf56669aae45a1ab17442fdb194b1896
MD5 9380d68789377d0b17239c88d27ab534
SHA1 b3bc27f25f394307a46a3407ba0af504d1117c5d
SHA512 9e30e7c48d7c0f8d3453d4b8ab44866be996f409292093bbead475e129615f66efd03977387e065ffd28c9af2a8467a67b514c8a28d934cbf4601854649b48db
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glD4hxSMmT8oWgBCaX:nu6JmVxd2dk+M4FHX
TLSH
T176D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fc41a35dd3fe78fd0279ffd8ae3810d0efd4636f45f779a401115c557499152f
MD5 a169f0d57c893de59213b1d8e348906a
SHA1 921b817e5fbda3634e5b2f13439a8981a3d3c11c
SHA512 c7f679b58c66cc4d269554723fc8682acc28558f0b6b08e22bbc862923f652ac1bb7dd5f7310ce9c6989cae24c10ad3bb8a0fc884a4c0ca8a6cef3cd766a775d
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4x/4hxSMmT8oWgBCaX:LmifPbRz+M4FHX
TLSH
T1D0B5BE13F2D900E8D06ED17887569632EA62BC450B30B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7fef0f22e9877ec8213596d13c74fbcc124f46111bafd9fb2c6b89ebd2d3cef5
MD5 6d2f8af0d054ed020520d76a645ed079
SHA1 d720d2d2e864ee33b258772a0c7d91a52715be1a
SHA512 5d546cd581250194ac61a7323f45ae48de7054ce0b97acf046ed04e3e5da4135114e8e399d4fdf9b17e37808f0ae011389aa6ebdb2439cc92dc6b755e03dd6e8
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHqc4hxSMmT8oWgBCaX:r5dKTi611+M4FHX
TLSH
T1BDC5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b12a5a5fb58e9d612691d6f143ff8c964953302d3ee2f68a213bb1be4acdd29
MD5 b698725b8aa8c9947bb4b4ce255efac6
SHA1 b1ad613082a5fc5511d9e453b64553e95b9783ec
SHA512 cacceea48d32cf5258a59412dc0cb5c7e236e931f475265b0de51b4877a751ffaf47ff7a45fe69d4822dbd3cfb617ed2484ebc6787de11fdec967c77fb4133cb
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wT4hxSMmT8oWgBCaX:8X2iyphf+M4FHX
TLSH
T1E595BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c074b7308fabe15ed142a6f6b0e9245ad6c5488fc279899d02ffd85a3fe0ab47
MD5 1c5fe00d33a7b24d3537f54fcb7c6666
SHA1 7e989ddf68b30f7a74120f222a6a828127a2eae9
SHA512 aec978763ac92048f2a1a551a6b4d8d47baef6f6a56502563aa95301aab28fb0eb39c8143d1c458a79624e3339f8465a5d285222c7706e75aaea71fb889b566b
SSDEEP 12288:oQvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:oQRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D5652375AF0F94EBED2AC335E8620716D99C0DDDF241163BAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 7d3044458d14ba290c6261f6cc554fc0ba5975fb34ee9330a015512bb5743a2c
MD5 75b001a8e970ffd1f63880097f43af38
SHA1 082b2ef61c12a086ab40caf79783588ba8e28d61
SHA512 0d0aaa2b87734457d4f35212b3adbba670ecec0425ac9caf9b573f457170cb4e675acf9a52083194d2dc7d6dc28ec2a173e0b89072db5db5309c8e09fe51565c
SSDEEP 12288:51vJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:51RrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T195653375AF0F54EBED2AC335E8620716D99C0DDDF202263BAF3E2E683B31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0ac0c65e6f108a626669656cf72cc19548b1900283fdbcbe69262094d9544007
MD5 8e0811f673d708fa3a2b93ef5882b3c0
SHA1 f3527eb620d88d2845a90df3c7f0ed86a13b4f92
SHA512 03813437f1e061f9ffd3903e735a72c2cbef988a59a82331b2701b31a0c8fbab7194c744d4b44cbc51e56cd8a7f39d32479c4ee5304f6486b31bf7d6655a0dc7
SSDEEP 12288:j3vJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:j3RrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CE652375AF0F94DBED2AC335E8620716D99C0DDDF242263BAF3E2E683A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6ef8154b067f846f94eb0d97a21338b1b38e397de8af84224ade0b8daed67249
MD5 69e60a15a2e7b228a3f46b168f3419df
SHA1 778fbd1245b5048d6503a63f9c6744d51bc039a1
SHA512 4c5aa9cc28f1e42d285949d138988e2e64d81ec424f59cb248766719d6dfd0cbafe8384d930cb0ff49959c1d47235b67150cf97c186b9d826a0adf6b2144ed9a
SSDEEP 12288:RVyvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:GRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F56523656B0E50DBEC26C339D8724312E6F93CDCE322277F9F251E682E31A956931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 e4fd1d0e4fade67f6cbcb135dc1a6fa3286af730ca2e2749ac3eae147d8de4e9
MD5 eb18efb894e8fb1258131558381ae49f
SHA1 fe1d9aa572666fcfd6418ee08634ad62003cca32
SHA512 650dad977a8232575a2f6cbf8596d37adc48eba89f667d9ef337a2108090bffafc49a38f18d6abe3942b05174e63223cf7e218473f6f5e88c2d840f645be9547
SSDEEP 12288:3avJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:3aRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T168652375AF0F94DBED2AC335E8620716D99C0DDDF242263BAF3E2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 8e16a630bc411c22b29e248eb1daa8f7b4120216a6fae1db2a699a9d113387d9
MD5 3233ede42d0cc97371375c62c7489150
SHA1 3323ed9918d90d0bdf9955639b577a4afe841d5f
SHA512 7147aae8290505390f8df006c8df47af1688640d94c98385b59b526f7ecd70743ffe308b01a36eb214a18e7daf0a52d1dc3eb4c8be8bc0c10d5d467c3ff30952
SSDEEP 12288:SJvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:SJRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17E652375AF0F54EBED2AC335E8620716D99C0DDDF201263FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 825c5ffeec1286277b68a2575f36072d23153f27d259971c764900a36a2dd6e4
MD5 ea18253db0951c48c700c60f0ec288e2
SHA1 f23b882d3fa8d8d6215cc97e38d1427de079b6c2
SHA512 4e3762ed4c9c37164489a335f8afcf9f204b6d50db16abc94bd854f904848351f1e9d4384414458c3746a813a3dfdab207ad0bae75b189774854da6fa53e43d3
SSDEEP 12288:qdvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:qdRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T144652375AF0F54ABED2AC335E9624725D99C0DDDF241263FAF3E2E683B31C1A1052621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 09eeae5ef3306ab77a6db43c5ed460f0d4340ac68f94fb5a7817131f7c571b6d
MD5 c6040f749793f86debb6a4f1aec74c9d
SHA1 7c36aa1ce19a4b85fa005bb98c30e50ebb9fd633
SHA512 39d7043afa7317bcbca95f414bb998be2b37aef73d35f152a433dc2ba871d077fdbb1871ed12a199bcbb1b976749ac809c6447980df573bf9acbed61a2f9b43f
SSDEEP 24576:eZMEzFVSOVRrKhxr+EHNmT8oW4ll1JCrLKXI:eZMEzfZ4hxSMmT8oWgBCaX
TLSH
T1428502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f758d5f3ba6c24dbb71f4dd8e767365053494e415404d01a13f67f41811c54c6
MD5 d88ecf4296f58874120dfef038ac5fb8
SHA1 38f614916f3ffd9af60825dab617e648273e3452
SHA512 93cddfa431a40f1626925e51f7413c41821792a96567cc283243b45d2e369017913e0b0e24b266694d96236b81de8b95a5712e393de6c8b9ea9e1b6f512f92bd
SSDEEP 12288:CsvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:CsRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T129652375AF0F54DBED2A8339E8620715D99C0DDDF242263BEF3E2E683A31C1A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f7ffa11a42678560b4aa0987c793846acfd27231dae95e7798a4c4b0070f173b
MD5 5112538149b4f56dce4ba0218d0df314
SHA1 77485a76adbb7767322935bb6420aac4e39420b3
SHA512 3271be204fed640f0c534828195fd1e30c1dbde434b31fa71a5b1e061ee22d73a4cb272624241da35f4dc5dcc88a5cb384cc8c45ee55264e59720fb1b254f4c3
SSDEEP 12288:hovJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:hoRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T171652375AF0F54EBED2AC335E9620715D99C0DDDF202263BAF3E2E683B35C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 ace2e70750316f7f13aed38a3498cc3bfd57ca70ee85767a2b3d4c58b0a90a5f
MD5 a0c5ade95e4f5b328a94e806cd06b520
SHA1 b6ee09470015cffead0babf7c7af259a7b35912b
SHA512 b38be5845a4de61dfb92863016bf51b3c806267becda379365549d56ae515cba81fa6ef2fc0feb0577ccb776353393f188ae572e5d5fc83969612409b70c5fc6
SSDEEP 12288:myPz5L8hvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bzyhRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T156751217779630F9D5378238C8621A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 25d5d5cd688a65bd62fed0bb9b978773073717bac109fb0a81e41e7a23ddcf88
MD5 d0c2c0f600cf51757078675749ef20a3
SHA1 111d4c8be5848a1731bfa18b1e15228da79c0b4e
SHA512 1c339aa61cb205c2ef85763f795e6635efcd51eb01a1fe1e1959080f3438ab1e84ee0947496c880a5704565ca419493b4ec728fd02f38769a4868e443ffc59b2
SSDEEP 12288:8svJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:8sRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10A652375AF0F54DBED2A8339E8620716D99C0DDDF242263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c91d4729464206b86437d70dc5c89c4e148c6de27525a58293db395278cc13a6
MD5 b08a9826e3889b9e56127785a45b3a32
SHA1 41ad12927997d0644bbd272a3e6fb66d888c5995
SHA512 73b7e7de388e27bd94d950667bb9bf163a472918da5599ed96cce807650f62e2313b190f61d0265ad93731352dae2381293c37f2dab46eb62c6a6850e056b0cc
SSDEEP 24576:TcP4mcvIjkGOxhKP2l71SNKbrh/8KBURrKhxr+EHNmT8oW4ll1JCrLKXI:oP4m4IpOO67N8K24hxSMmT8oWgBCaX
TLSH
T1F665AE2DABDC0096D0BA913885658A4AFAB1742E1F3286CB1160937C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 879fd4091c6a84e4d7c1b4147d9fe3a1816a8921ae1d4b93c4cb018045a71787
MD5 af31cc3a837db5ad586231d61994412b
SHA1 747fa376b01e1443ff5257eacbfda1d0c31835cb
SHA512 e0ecde7100c6ec560ec23d93ee2edd7c3dbb95ea2f5e603d99c3d97f8075a7f4ccbc8f0c7c4185d70f35f38cda60e69a36fe682a31f49371da290678acb7515d
SSDEEP 12288:3zsfcvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ycRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A075F11AD24801E9C46E9239CB524A01F7773C6993E193CB5BE0F93D1F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log
Size 1KB
SHA256 6d789dc8757e9a14505307155ebf10e4eb458edf28d92c186694cc3d678b1eb7
MD5 01666cb20eb719668cff50b6fcdd7b82
SHA1 efc3782dce106f9fe469fbfffb0e423700c3ca43
SHA512 da22cc1b006701d2f364f4c2d0710fa8765f20243f73e3160caf39185d6c2d8233f1970a26f68d455f58d97aecba6c0c7fcb6c9b6160e7e5aa844deb96e973c0
TLSH
T19C41F471595FC82702209E6B2930654F98E402449B9B330473FBA35DBAC3835BFDD52B
MD5 SHA1 SHA512 TLSH

Submit Download

62d72626c665fbf6.bin

Path C:\Users\Admin\AppData\Roaming\62d72626c665fbf6.bin
Size 12KB
SHA256 de749a21ea8bbd5ffa184c682c4d37798af293e3671de60d173c4583331d9b49
MD5 5038c7b1a6c02d384b98312fed9d1374
SHA1 6f981b07d6a6d25d76cbd89e328a873f4108bad9
SHA512 9c1411682f294256c27d9906445d04b04c73aad41fe9fcf59f5bf1e626c4605c0583cad853dfd4eb5b2b355c13332490c4a030d73718057b5b60f422921f7c8e
SSDEEP 384:1wbm1y2Il3ngfR0K6MwwiBsmHS0qsRafs:Mm1NIl3gp0KzziBscS0VaE
TLSH
T1BC42D0BA2B6C522D63C1602813574DAED0EBD283D07E963D85B374E25F30DBB9E421B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 924524d0cdf76be7a9bc01a696d06f623db833fa6f5c83fbb2817193785e9ae3
MD5 e7055f6b5c50658883cba6f3b46506f5
SHA1 4cd4b3e81b01d5d7e655b256e8e2e02977e39d7a
SHA512 3c76f25ec60a00c5925f0deaaeede855c84fbb260863432af9260ab636f810d130c83c29f7efd3196479172b2624443267268975605804f928233a4fc65b89b6
SSDEEP 12288:Q8vJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:Q8RrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CA6523759B0D949BFD3A8334E82283356A5D2DACE301556FFF2E2B683A30C565C62712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5dc3350c4431aa75d6671731340b655d30d404e9f96ff3b1b33828daeddd5e12
MD5 04826d4b1c63dcf31f114cb2451ec240
SHA1 41d4874b7e301e78e6418d3707a4844f51767a76
SHA512 b5bfe0709e08b4a67333d98ac5b1ecceb3df9c8c2cc11e1bbc10946a5dd72a5397ce17a50ca1baa0beb279fc735a75581324ece1a086cb5f5a87a61f2d0d9196
SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQa4hxSMmT8oWgBCaX:4a0hNYG4JwK+M4FHX
TLSH
T1A085AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 5e9113cc6e9eee72edbb87d91b1a9d811667a88f0b7780df8fb1ad6673476cb5
MD5 4861201a62f71554efd83d55b9a06a74
SHA1 9fe43eee2936eac4b04fe43d02c03498dd920be9
SHA512 7cfbcc18ebed7f11bf1ef2cc73b0991b8f5abd2d32ccea7aa6a90f9180423414b0d5650b795b967d98d3616585e767a5159eba2b1a75d1aa6d0f497b5e3c8364
SSDEEP 24576:HhbHjPlRrKhxr+EHNmT8oW4ll1JCrLKXI:HhbHjd4hxSMmT8oWgBCaX
TLSH
T11575017E279D20DAE932D23CD9528606C771BC691311A3EF27A682781F37DE81C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fdab97a727acb4c46d4dc5e8344b43fb9afa4b1666c52a78677e96e99cbaf92e
MD5 169763f9d81966879e0841a5825381ba
SHA1 fc5be74c4d52e79acd07347ce8411eff91201b04
SHA512 4535703fada0b95696d6cc96ac32b1bea0f927f696d731e62b1376c9c37bb2f4768b28e77201dcf2f52dee9d994332a05e350485bf6dd3cf841756290fa3efd0
SSDEEP 24576:O3YgnJcRTk4yti+R5dpR/tRrKhxr+EHNmT8oW4ll1JCrLKXI:OIgnaTk46ppR/t4hxSMmT8oWgBCaX
TLSH
T13245BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2e00f681675d8195a5232a97ac309437dfb5d5c50d00a18424002e1718c77ff9
MD5 f0a174dd3abc85ca11a2a65b04e531ba
SHA1 ad82191cf90ec928e5811bef81aab34aedb4c6a2
SHA512 a6ea16cbc256288bd7c1ddb56cc464f79e8adcf6ff60327db828eaf0195828e526a110948c9bed06105d77ef9d4fc64f27621aaf85d5e3470310ede740ed5e37
SSDEEP 12288:f4vJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:f4RrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10D6523755B0E649BDD3AC339E863472599980D9CE30217FBAE3E2E683B31CDB1572211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3211271023f2f2cc8b0f2bdac59f28986c47a1ca4f6987879be34baa8a01cacf
MD5 0234af04106a3d7eb7ad5b368be73544
SHA1 bc0ba1d6b8b736cd21781cc687926ebff4bb8973
SHA512 b791b1f22890a1e859b17c966d56dfa38bec7f885751cb35dcfb3f3fce5df8822b4266eecc09b8a4516d13e10a720c3a4e8b38e727090a49d96b717eae23077f
SSDEEP 24576:YfL3UTTRrKhxr+EHNmT8oW4ll1JCrLKXI:YfL3Uf4hxSMmT8oWgBCaX
TLSH
T14195F155E79500F9ED7BC23CC9628A16E6B2789D0360E7EF07684B651F236E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d69f66137a2643cd9eb8d456a8362218bb269a5c5670b127585f8108df12e682
MD5 3f90ab69666852c1acc72296a1820c1f
SHA1 bbe3673093ef6ef145dd388e7c1f8c6aea2a8ae9
SHA512 1ba12d35be25a55c1dea14d7110279d363c74184b17a91aebf28dc0ca47db42165f997d8a1a492d5d9f108281263b3001edccff2de055d629b86b8d7a77fd02b
SSDEEP 12288:vpFtfO/vJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:1O/RrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CA751229379D10E9E93A923CC9934309D7B17CA9531217EF46A085BD1F73EE86C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c43b351a7ae5df06fbd9ae36ff57c5289f7da327590f80f4d49f34819d4f834
MD5 e847482eb717009424c06f0571a8ef45
SHA1 8b25a095b02f264b85c490d1319efc6798d2f3db
SHA512 db535b2c6b2c2854c3c4bc1d626e0cecaaaf8a25d2ab0e74d8d7f049358f7323ead401c5ccae7e6594f4f15faab62b4468d1cd0a27c146153f0b24b22ccbb57f
SSDEEP 24576:h7NM9YmZqmWMUkPjZM48Mv6bEhssRrKhxr+EHNmT8oW4ll1JCrLKXI:h7cBWMpPjN8DbEhF4hxSMmT8oWgBCaX
TLSH
T14B659E2E6BAC81E5D477D13DC9A28206F6B1B4651B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e8189e480dd1a542a9ff7db677a098d60d6afa21948d8937de87113da943e52d
MD5 29a39658df7f8109e5ea07158ce0fba1
SHA1 3c2b1ffe8b37955d19f0703205f9a891858bb309
SHA512 71316dd38eb9d2971d302f3683779e4971c0f93186c468a1342d60dd57e4f40887d07475c53f897e397925f2ad348064ff124b2b2eca2d077074805a2167e300
SSDEEP 49152:uF2YuHNETovcvNYf8kmM4hxSMmT8oWgBCaX:f6tCf8kA+M4FHX
TLSH
T1FF858E2927ED80A4E0BBD27D85B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 52818aa37b0ef01c66ba4e132a746efe38ed3c9c85ff8d2770c0244cce0e8345
MD5 e7501120f884fa34313d697f7b1853fe
SHA1 976bcaf58f548d6622b7794f227c735659d8df1f
SHA512 c78b1c8ebbab397bfce7492bd4684fad6de2347697fe050c1aad81d78ed409a61a6fe3d640c58e78a6c1b6f79c99b65e33f1066e43d2c8dbf043d4c45199cd96
SSDEEP 24576:TAFs06+Omlf3NXEbTorRrKhxr+EHNmT8oW4ll1JCrLKXI:cFs060lVXu64hxSMmT8oWgBCaX
TLSH
T14E65AF3F66AC00D5D47ED17E8997C91AF6B1746703215ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 5dae39e6a09169a7f75e7fa9e66294027e38f6563e89a8b4cf109d36b59f547a
MD5 4574ca8a2a0d8adaa1a05c8e031fb529
SHA1 3750a1c5683aa9f28dc21fd97c558da6904244b3
SHA512 9e0274043e530fd3a09ab0cd081d6394fe1933802297b7bb4b887a3a9ddfcc9eb39392a78a21875372a03b3d8fc3e45c62b4424ec175a3e36ec50ae366b4f2cd
SSDEEP 24576:gJnJ5D3WL6RrKhxr+EHNmT8oW4ll1JCrLKXI:gJnJ5DGL64hxSMmT8oWgBCaX
TLSH
T14E85D03DD2A810E8D4B7C374815A1B56FE72387D2B226ACB2874D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8379417c92d778481a808e0958e5042b7fc49cf84d889db8b2f713333b3e0079
MD5 c109e96438677ee73a045c2c5981f993
SHA1 f4b87547f1b0f3ec562d289c6daa18e1bdbd2fc5
SHA512 d184b65d5b43b36ddd3399ee2e5bf88f38ead4d7c007e16f19f3c79b0c475ee7edcfc368a23a5c65e4ff42ff9a23a6fc70344f4147892fc883eb763f8b8faf0b
SSDEEP 49152:ro06DIKdwc+eQnSt65aVQ4hxSMmT8oWgBCaX:kv+M4FHX
TLSH
T151956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 5421074060c1fd98d6a5e6ec09b79ae7ac3e689f48bab67660444c2a8d91d228
MD5 c1849e3b258d1b57b6aaab46eac6ce33
SHA1 77fce53181c22bc6ba92a19768ee1fa09d26449d
SHA512 145909fcaf71eb429c6695163b8a62852ac760087ef3f89949f60a532e127207605aef4b8f360ba8d9fcc5fce0adeea8a99f3f056ce8710fe137bbc8bdd63f67
SSDEEP 12288:sEP3RBGvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:nBGRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11A75126D2B5D70EAD92A813DD5A18605D3B2F4B8630227FF5AA5823D4F33DE91D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 2bbf1c4fb46dfc3bbb72813cc30c12dffd586e39deb41382f31c58c637734b43
MD5 621e3a2b6f119afba31e0f481583bd66
SHA1 4083e97b78c1d88c0db82973f55f2993e46b3d8e
SHA512 8473a4989a3098472b0b6f75de36fafc22119b1a6abe1c48a67792d010879726558bc89ed16447846ce2f1c1362742337a985ee9729a05201b318aacf1f1f280
SSDEEP 12288:bjky1vJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bIy1RrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A0751214638860D9ED7A4238D97342619E74BC24AB1157EFA9A0FB3D7F32ED46C31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 d89d3f2d864fb88a50e710976ac783ae6b5313ea56887cab69fe1fe233f9051c
MD5 203213b98b0a5c58246193d98d580f91
SHA1 5cd24cc2e1fb5fb9f4a3b0656d128a11852d1d03
SHA512 557894469ec65d60204f88a0876e928ecb9d41f74b693b860a35f55f8ff84678d20aa6eb94262bc2b56e5a8c9bf2e1e28386255104b3ead45d34aec6f52077e6
SSDEEP 12288:SrPvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:OPRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19265237C5B0E74DFED268338D932471195A82DBCA30129FF5EB9AE786B35CC61172A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fac3b8875fdd8df7e035291438849dc80506d5575863f8d5dbc14ecc97534e9c
MD5 ca8bcbdcff3cc110a0e0e96f7907e932
SHA1 7728542aa942c8a23be3016de95f56e72438c653
SHA512 6d25e6c8f65c13ee85cb8ff2377368124cc75771ea156da0b625ac1af3af394c777ae54058e82c4da34b4159d10e5e09590e28397a69868d1e950b2ce8cf189b
SSDEEP 24576:jQ9MxZKdcz97w3ERrKhxr+EHNmT8oW4ll1JCrLKXI:jVKXE4hxSMmT8oWgBCaX
TLSH
T105558C2DABE9059AE177D239D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 345fab95777ab7c68ce85219579bced0bc6b5791ac62133e0ca82deb37af9be4
MD5 a1717aac75d3c4a6de965188eb477312
SHA1 772ea2eb73a8872d5a14733e17c5dcab2e235556
SHA512 d68961f9367da565fb4aad34051e020c0e9f5e5bdb158fc2860df841b5862b3d5f4f2ad6116125f6d410a032edb9ca96157c8c56447d622878da98682d4507f6
SSDEEP 24576:nyocbApRRrKhxr+EHNmT8oW4ll1JCrLKXI:yocbApR4hxSMmT8oWgBCaX
TLSH
T14F85EF1FBB6E40A2E136823CC9818305E7B3B4745B6267DB6691C73D4E239E9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 43dcae6f693330538a4b655d08f1566ac36e75be69420f7fa18d856c6ac9e98e
MD5 a4c77d0bb8e007de0240decad17dd72a
SHA1 d40e8a8ae77ec81367b07ff72503b38cb4109ff3
SHA512 86aedb5235afd71b7f2ae2dafbfa02ab1c021802ed53b690476dfa75e00c74f47f89fa063b4bc45a4a1901a5d75aa2a52e32b450b546d02666d247f4fc11889f
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKR4hxSMmT8oWgBCaX:f0zuNIO+M4FHX
TLSH
T1BCA57B3DA2BC00A9D8AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 853df6a35fa0c9794c278686692a5723492339b7ee528e278f5ae235f74a7b02
MD5 8b65418c2c7f31e6fc2303748de61906
SHA1 2b59d16bbd85ba4cb9857822de1c8c8ece7bc14e
SHA512 03fc52a68376e070e3db1a83bfb98423da197d2a29ab900d15fd6ec0005e3f7a8373e645152fc319ca16b66f0943698f9650b846152943aa3db9b42b4c7776bc
SSDEEP 49152:XTDxR+N5YzTljMf4hxSMmT8oWgBCaX3arSj8RoTCCW:Hu5s+M4FHX3JTy
TLSH
T1ECA5E22EA7E815E9D17EC6789A23C506FA727851033193CF42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 3b5916e5409378142609a535bf2a509597b7644b328b4060bb5898bccf45c7ba
MD5 6bcdd853085d321fc4458f347fdcc2a2
SHA1 235ae3b8df9392cae2a9622f5dd9b50db2d574df
SHA512 c343a4285d4421126d1cf0c00f0a56b53458ea36bf1914c3ce9e074926dd2efda411ab5bef3901e0eac7466996e8f5d316e3593220aac1755935c507530751ce
SSDEEP 24576:9TMdOz0FFS+kmSLyRrKhxr+EHNmT8oW4ll1JCrLKXI:H0K+kmSLy4hxSMmT8oWgBCaX
TLSH
T1A085F17EA75D14E5E43BC23DDA538A06E6723865032276DB06A0C17D3F67EE4393AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 3fcd305b07d552ed4b6b2366976d2e4c1e4cd3cedc4caff9cd76de5349093854
MD5 dfd727520852429602f5560d26e298b3
SHA1 6e250eae4c943bafe36edb9c99161ed7287b2b7c
SHA512 6851a942af40524ed9a060942ceb6321e69aeecf1ceb8358a23f3085bbc89368acd8c430cdaa052ed9093a56c1f9027227eb05d738e625b1067dbd3ef775acca
SSDEEP 49152:k4gnaTk46pqR/t4hxSMmT8oWgBCaXZarSj8RoTCCW:kHH+M4FHXZJTy
TLSH
T18595E12EF3B910B9D8AAD236450147B5BB71782D1F219ACB0170C538AF1AEE85F35F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 ecddbeef677e2855881379bb3d61ca52483e98c279452ddd4ee328f51492cc26
MD5 b2cb40c98cf7129e47e9dc6271b2f079
SHA1 9dba5f1abe17a6a925e0d437e22804e4d51205ea
SHA512 a74d5fe0b130de0a46cd5438117be0d87114b7b46df7d0b260aca1dbcdb9e4c0b770212269a14cdca4d21b397106291ee40421ff1bd48669767b132cd32eef05
SSDEEP 24576:mTRrKhxr+EHNmT8oW4ll1JCrLKXIKaKngL2jdshRTdG1YxITqvfPkbIcbjLm:mT4hxSMmT8oWgBCaX5arSj8RoTCCW
TLSH
T13CB5236E9BCC24E4E8379338AE72460959B17DADA30216FF5DE09ABC1F37AD45538700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-257-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1048-578-0x000000000D770000-0x000000000D778000-memory.dmp

Download

memory/1048-571-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1048-284-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/1048-304-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/1048-577-0x000000000D770000-0x000000000D778000-memory.dmp

Download

memory/1048-575-0x000000000D2C0000-0x000000000D2C8000-memory.dmp

Download

memory/1048-268-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/1048-425-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1396-384-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1396-141-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1396-135-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1436-36-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1436-44-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1436-45-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1576-162-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1576-156-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1576-386-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1872-151-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/1872-514-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1872-512-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/1872-145-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/1872-385-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1904-177-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1904-183-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1904-388-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2032-383-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2540-387-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2540-166-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2540-172-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3060-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3060-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3060-382-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3068-206-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3068-203-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3068-208-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3068-197-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3280-187-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3280-389-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/3280-193-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3296-505-0x00000000030B0000-0x0000000003110000-memory.dmp

Download

memory/3296-438-0x0000000140000000-0x00000001408BD000-memory.dmp

Download

memory/3296-420-0x0000000002A70000-0x0000000002AF3000-memory.dmp

Download

memory/3296-572-0x0000000140000000-0x00000001408BD000-memory.dmp

Download

memory/3296-427-0x0000000002A70000-0x0000000002AF3000-memory.dmp

Download

memory/3296-409-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3296-403-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3296-499-0x00000000030B0000-0x0000000003110000-memory.dmp

Download

memory/3324-60-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3324-68-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-569-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-66-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3532-580-0x000001601F660000-0x000001601F670000-memory.dmp

Download

memory/3532-581-0x000001601F660000-0x000001601F670000-memory.dmp

Download

memory/3532-582-0x000001601F660000-0x000001601F670000-memory.dmp

Download

memory/3532-579-0x000001601F660000-0x000001601F670000-memory.dmp

Download

memory/3808-434-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3808-105-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3808-99-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3920-11-0x0000000002BC0000-0x0000000002C43000-memory.dmp

Download

memory/3920-18-0x0000000140000000-0x00000001408BD000-memory.dmp

Download

memory/3920-6-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3920-0-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3920-19-0x0000000002BC0000-0x0000000002C43000-memory.dmp

Download

memory/3920-396-0x00000000028F0000-0x0000000002950000-memory.dmp

Download

memory/3920-10-0x0000000002660000-0x00000000027BC000-memory.dmp

Download

memory/3920-534-0x0000000140000000-0x00000001408BD000-memory.dmp

Download

memory/3920-379-0x0000000140000000-0x00000001408BD000-memory.dmp

Download

memory/3920-373-0x00000000028F0000-0x0000000002950000-memory.dmp

Download

memory/4148-22-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4148-515-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4148-29-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4148-30-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4148-28-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4268-93-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4268-81-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4268-91-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4268-87-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4520-210-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4520-390-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4520-216-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4776-116-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4776-110-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4776-380-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4912-96-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4912-97-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4912-57-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4912-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4912-49-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4916-220-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4916-399-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4916-226-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4984-230-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4984-412-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4984-236-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/5016-120-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/5016-381-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/5016-126-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/5080-240-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/5080-419-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/5080-570-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/5080-246-0x00000000004F0000-0x0000000000550000-memory.dmp

Download