b47f52bdc17b0097133df631716915bcf2868b75c5225cef8776c53d52aae0d9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.7MB
Sample261012-v1lffsyvbz
SHA256 b47f52bdc17b0097133df631716915bcf2868b75c5225cef8776c53d52aae0d9
MD5 8202d186100671001524d9628cdd7e58
SHA1 bf49629b9e4fb3ef561b621378667206ddcda358
SHA512 6483243b762afb285e7ce91cfdfb9ff1656ecbb9583627970c0a4c0eaec5bfadd8e8e210d5a95e8862b8b6d4c344d4f39c56e1c0d0797c632ae4dfc78dc601e5
SSDEEP 24576:bR4JEys6kT0Bhvn/+h1Ay+4ZAgayjhwbmY3MaReFeDvSP3b:SqynTBh34z+tgauhwbR3P8wT8
TLSH
T14F85024463D80CF8E977823DC9A24A12E6727C524B30D75F57A1275B9F33AA0DE3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2244	elevation_service.exe
588	elevation_service.exe
6032	maintenanceservice.exe
3016	OSE.EXE
2296	PerceptionSimulationService.exe
5948	perfhost.exe
3212	ReFsDedupSvc.exe
3408	SensorDataService.exe
6052	ssh-agent.exe
4620	AgentService.exe
5256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9d270af33a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab6cd3fb6e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f15353f6f5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d633d036f5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e92d2fc6e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbc013026f5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dced2d046f5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
588	elevation_service.exe
588	elevation_service.exe
588	elevation_service.exe
588	elevation_service.exe
588	elevation_service.exe
588	elevation_service.exe
588	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5548	2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4620	AgentService.exe
Token: 33	5256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeBackupPrivilege	3212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3212	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2244	elevation_service.exe
Token: SeDebugPrivilege	588	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 2784	5256	SearchIndexer.exe	100
PID 5256 wrote to memory of 4324	5256	SearchIndexer.exe	101
PID 5256 wrote to memory of 5160	5256	SearchIndexer.exe	102
PID 5256 wrote to memory of 5492	5256	SearchIndexer.exe	103
PID 5256 wrote to memory of 4816	5256	SearchIndexer.exe	105
PID 5256 wrote to memory of 5156	5256	SearchIndexer.exe	106
PID 5256 wrote to memory of 2588	5256	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6032

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5948

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3408

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2688 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2688 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 baa2804009de86a0aa563ec97517c9e783dd76c808b370efa14d0884a056005c
MD5 685ebba96f2fd0c9b563df9fa27816f5
SHA1 d8a4c93e2930e5f91ea3c251ed03088bc573a904
SHA512 fee08822e851155696d4f8d711240aff2b59cdbf39aaf9854d4022dc97028f39842911c9d4c16740a6080b8e055781228d6551b0bc9606190dfda80604335af1
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnc+tgauhwbR3P8wT8:N3q6mjBqgaPJ
TLSH
T1D2D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 db0305d97ec14289819e2692bcfb2731058fc179775c015886ec344c9aa4bce6
MD5 0457fb85e21f95fbfebf1780bae04bca
SHA1 5d887f6b5bc5c18113f667ab143f4cf310539d0e
SHA512 cf2b69860d0b146c20cbf8a1a8cc371714aada27f3bbcea04d49302f44506b98cde4acafff761fa841476cdf65769172b998a271faa2791b001d54dd7394b7ff
SSDEEP 24576:CXYfDtczAD+4ZAgayjhwbmY3MaReFeDvSP3b:Jtcm+tgauhwbR3P8wT8
TLSH
T14075F128B3D408F9DD67823CC9A28511E673BC9547A0E78B03E4AA655F337D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 047a93f12ed5882a431d4b12c1f3f96295ddb47c7d6b6a45c0e13160344de88f
MD5 070c7d35c918266d1cf00e7da648ae09
SHA1 a72f42bdf69ac46392421e1802ca0eb5da14a9e5
SHA512 d31888b300abf7279b77258b3f8de4fda233c6cb2636675d0be60f80b3aa2cddd49090f2beefd8db732b325f7c79b32308c60b7e9438646bca671f3db75217f2
SSDEEP 24576:J0Le5ji0hmxSrM0+4ZAgayjhwbmY3MaReFeDvSP3b:JPji0Aoh+tgauhwbR3P8wT8
TLSH
T17595AE15F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eed345931f35763314f1ca2e7f06f2cf69be24eaea9586e878302048329c8a23
MD5 e397fc567df7b8e2d0be51e6628b431d
SHA1 ede0590a58b67c711c123b96ea298ce6162e0ec4
SHA512 f523bbaeba67c512e869be51f951cc2a309f717fc35bd749559a0353c5ef76e198af178e5da9bba34500cd3caccd9c976bd8ee71aa95149e9a782e88f575045f
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWj6q8wyuW+4ZAgayjhwbmY3MaReFeDvSP3b:o/ezSC6vUzPv+HjyN+tgauhwbR3P8wT8
TLSH
T1ED756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c8cf0b9bf7da63f48be3f28ffedff37e19a8d3ba443b5665c57189ae2d6772d4
MD5 6600067a8d7336d79bf9e22294cb99df
SHA1 7ba5dcf20c543601ddb605d4cacdc6b62252fc13
SHA512 7b98073dae775a32fdc26f13146e1c7eb32796f7bb05e0b40db80c8da3a230fd2d3ab4873e67b9ab50123466b52d4550cb02ea20703553633b0b59771efb6c91
SSDEEP 24576:tVbqPb88hv/l+Bn+4ZAgayjhwbmY3MaReFeDvSP3b:tVO88hXl+B+tgauhwbR3P8wT8
TLSH
T13D559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 04dad22511e3778a27309eb1ae1f23ac5fe61382cef037e57702684ce062d502
MD5 ebfd088c11ea58abe6b17fe71c8b4215
SHA1 ee15aed23d280d987037b7fc08e7e08f21d76246
SHA512 96d76d35f19ad75dde3278ae57ecb3891ca0801aa9df9adb25af4eb8881be4f8300be495749f85c1e070454acc8e0bb394f4d6b3655afb648d969cf63bae2239
SSDEEP 12288:YqdeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Yq4+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C5552381D30C98CAC77B0B348BBA09607699EFC51E86A504E4C97BD9CCF0DADC6B5395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 ff1d4c360b11f31f541a44a53d7553a5eed7450f2c176498a68c7d38a354a993
MD5 877ebe95ab17629394335367db305f7e
SHA1 de47f98497c42a8f62a667579c2cf10ed0068f83
SHA512 c991e5ea887aee1e6c15b6f1b2a53015684fe63a85f05d1051e3d439083fa65d54376b27dc7396675cbd667bbd787af8cb742d607108bd3b216e1cf93abc4f38
SSDEEP 12288:UeBNUbTVO86UKeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:UJIUf+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E975CF3BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e04d5953d442cc70acfec546ae2f793325226d38e93bfd3634722ed5c0093300
MD5 107ca88ba8973a73a0afaf850e99eab0
SHA1 fa5cdaf48ebda1b880cf9bc63cc9f2aa4d2ad5e9
SHA512 93848876d03d6da4f1d5b09d2ffbe0efc1405f35dbbfefbc4f44c7b3253b8fbb705fa3d23597a44ed9c8103d7f86a84c1923797599bd4a573eb76fec1e570d4b
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THZ:XQvGAdlCEL8c/WRNw5CJgaPJ
TLSH
T1BB266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 93ad6446b19e369d05036586de1f3472953b850634230353b75a39d35c05c72c
MD5 18f26280a3f3a13eb749105494ece93c
SHA1 d83f98590f31522cd4098268c535ffd55e7218e7
SHA512 3d0121a3dcd200c497b501e5b3d80823d4457aec515431052c038752ef83d1b5c65fe82c3b60640622e966340f96976ad65bcc15c1a4fe218ba92e3afa5d5145
SSDEEP 24576:zuewsAjR+4ZAgayjhwbmY3MaReFeDvSP3b:KljR+tgauhwbR3P8wT8
TLSH
T1CE85E031FA74E436C27B0DB21B36C712246CBE604F511AC3E3E89E9D99706D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9116508413e0d5a6772771cd90db70679e3a102d23eb0aa709a687ad8cf2a83b
MD5 4a89862f35d0c320c792ad8c0c88f907
SHA1 a33df74ce14f1f07052d7a8bf83bc9b838f5d345
SHA512 94e4e643bffdf4878e01108c2bdeb8de5da32db5cbc0179bba26a0ac815a074c6ce98a1d737c72516582123ff82aad4d3787c4b6d1c02ce5210dbebef10a9bdc
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjax:AUEtQevvqc2W1cpV20I32A
TLSH
T1F5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e825b8aaa470703264dd4ffc989ef836af5f6bd3be5f903feee7715ed3129748
MD5 22e9b71870581a50fab717efd6825776
SHA1 acc812655c09d4d00ddae5bba547d39132686b59
SHA512 a5a0b54ab9ece47c342ccd22b7429066dac1ac08098ee6b7d97fe96b0cd3360795a401942cf43f1ef9a3a625b51d7b5b1b5c2e4d2946fce38303e2f6fbdf8225
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zx+tgauhwbR3P8wT8:yoqtVjnm1gaPJ
TLSH
T1E1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8b0c4c4edc0c1164dba78833ed78ddc127b44a4f074667ee3c946f8892798f24
MD5 1931380abb073aff9e2d6d042c84f804
SHA1 778ca5f3622cec4eb9c70370319c08b7fbefdbe1
SHA512 d270f3186509c19b3231fd20d1ba47714e8afbeea00aa354886541be3cc6fb99fbadc6b82d6efddd5f0660464ad25d0161ab1e371779e30ddcba2740942fedc8
SSDEEP 24576:aAhGL6IFoiwtA5l7S53S+4ZAgayjhwbmY3MaReFeDvSP3b:aAM5Foiq5i+tgauhwbR3P8wT8
TLSH
T1AA359D80E7F955D4F5B3AAB899B68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 9bd44881853e0df1e8f916d331783b3aac56f417c7dc278984aa465684719278
MD5 fdc2ce383ebc33f053fdc38568cd164b
SHA1 fc5b88c5ffb281f98ca88485d529e9461b0ffc73
SHA512 926f54041cd9b41ff82987aa9b773127bca8050981922ce28b7e053708ca293efde6742f20ff9d8c2b03c869e3ca07399a37f8b2705310f7db136e6a8d3756f0
SSDEEP 24576:ZwutOWt+4ZAgayjhwbmY3MaReFeDvSP3b:ZwmOO+tgauhwbR3P8wT8
TLSH
T1AE75F14673A80CF9E967423886978532F7F2BC422A21D71F57A0C75B5F33761AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 02986009497a6230aa2fc081a8d978e635b3cf20831efd665b17596365e113e7
MD5 e75173335fdd97264adeb3c5e762979f
SHA1 779ac08e630d33fed701ff3c0a95ca1a6e725480
SHA512 9eb5d0b320a9a17cd5278aab25ad218b152c3c52525f16910c98c3eeeab19d886f4ab5f38e039887c0bb1b30f3ce0346a37f3b17a1b29e1bf16c5b8e04dec45b
SSDEEP 12288:S+Z1IyweH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:XZuM+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A2651285339860F9D1A7033CCAF60A00E7B1BC922B7293CF9594679A5F72ED54E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9170a691b4e24cf755ba1b1bfb5a38d5c9921f2ffa329e9708de871c011a3c0b
MD5 c64dcd3a49a14733bb443405fc37834f
SHA1 337c2ba79f17dfd0a887218eea2b4def63683ae0
SHA512 4533d191315081513727796c08b455e32d07422d7a9dc0b698d54f15ff31ea81647fa184bc6caa93992f218c1bcc45200556e13e97e1cd00e7cb8442434d1423
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ut:CQRQyi36YOcPDLvw2gAf+PN3egaPJ
TLSH
T19C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 272557fa2219f90ec5c2b493d719f1257166929ae0a387399064b03d465b3ba6
MD5 6ba68ed3fce6293f994e2ae06a8615a5
SHA1 ab065130df882cb7082c93e38f6d1d5e9f190cc2
SHA512 b0a34de5923ebaa57ec15317860b0416440aa7c26f7d8ec57846c09b6252c493034e596dcd1a1ab16d80062c450beb147be6cf74dd98dc0592428b44e85561dd
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ut:QQRQyi36YOcPDLvw2gAf+PN3egaPJ
TLSH
T1EE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3ce819f9bb6c897a3078cb23e2b055db5a96e7c34cd706b4e016177a346523bd
MD5 adbb466ea0114a5b02df3ad02e022c4d
SHA1 4639f02e51efba908fdd03a1aadf5356b6c5605b
SHA512 48f17976d270cd2f8251d2c0495665d4084aaa0708a5c432a69d171c58052fd5228975f56f6d6161b28296749fc9eed53604d25d0d14efd15fbe1e783d5444a0
SSDEEP 49152:768Qg55nhkeWu7PNU3/h+tgauhwbR3P8wT8:FthTRc/EgaPJ
TLSH
T196B54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cffad1a788c1706bab77af98626d9d06da073de08f3a048618d9a62221a68f33
MD5 afaf4c57c3babd0ac6b794baba085e6a
SHA1 9481fab89a0b2f3db1e15d80e608ca73db62ce3a
SHA512 7723cb49a313b9fcf13a7e0e6e1176eae3946141618ccc01c702ff6c18bc1614ed898bc3b167e90e86b262b8223284fcceb27069c201fbd19d8c6bbd03b5fed2
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99r:qy5112gYy5azzVvU69nLKnhZbgaPJ
TLSH
T166167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c84a58b96ef41df8a7857508cead7e56c534dfded5f1b64f12844d72a10f5e5f
MD5 3e1d1e18d7e6ef7919123f5220896e21
SHA1 089b676ead9c9883839ec32bbf1acd6d1430ec86
SHA512 3ea6ebf0266e532a28c0a163baf0d59f9add2640ac58693f223c6800b4db9947ca78a53d483cd4910b753e889c96b882d7a90d013a7880bd426be02db725ebac
SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glT+tgauhwbR3P8wT8:nu6JmIxd2dmgaPJ
TLSH
T1D6D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 753a8f661b7fa98d5280d2e8edc2973e14920c8ca50ce543b409fb90b0b4b386
MD5 fb11dccf8f6fe2b3cb7d2bf73988097c
SHA1 48e46bf23847a8dd78e4a0f57e3540b70fd19cef
SHA512 bbc3322adf37a1de6342ed87cea221fa881c8ab74cab804aacd714c728dfb31ebb9b97106f47f08b0d34bad03b6340f29cd1eb98828d6cd29c9a6abb7bc5cffa
SSDEEP 49152:T1hpsNoJpF1A67U44CwH7R4x/+tgauhwbR3P8wT8:TmifPqR1gaPJ
TLSH
T149B5BE13F29800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2c70cd7b3aa8164b8e6d0677f8b502468a28c0a5fac5c81f985838eafd98a251
MD5 7743b341553b83daa0dda94397b52efb
SHA1 a9830e7284325ceb86c2c6fea53b9bae6fe995f7
SHA512 d129e3a3083fe1b3bc384d55b9fddb51034fba7424e3cc544ac667c9b4ed5550b95dfb28a2f0d5dbd82f4da52a59fa002fa3b308a66aee7abe34e2adc506a0cf
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHqM+tgauhwbR3P8wT8:Z5dKqi61fgaPJ
TLSH
T19AC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6d10977c1b50e6ae1977a083aeb972a5690ec09096ab0480b526b74e40839cb2
MD5 6914f29c02cbccea0d7bc4787e33200e
SHA1 ce39e4994607e811145d32f528c764f80ed76762
SHA512 81ec0faba89aa3f0dc912c15e5b4da300aface9ff90ff9091a8e8a8e6b6dcf2d860b4ce7a7210c29b8224ee8c221b5b2a157a1ced2e0b2aa0a292f50afc84842
SSDEEP 49152:LhtSn8EApI0figjgiDn0AP5wD+tgauhwbR3P8wT8:KX2iWphBgaPJ
TLSH
T1DB95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 6fc655c503202fc3ba95b74fbf186ff9b01ada6f43ca2b57085079396a812ee6
MD5 cbb85a4daa51640c9b65f90078a3ce85
SHA1 b2c2aac0202f5cd894a8d67349b759520cc2bfd8
SHA512 ec1401fc95a11dd72c6532a1ffeb522210f85aee2e02955e71ac9c883064f626cada6a6893662c4b8a08c2d2edf0bea96954f5901eb0ab171d3873c53697cc3b
SSDEEP 12288:PVeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Pw+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13F552381D24C88CEC52B0B748B6A0A607698BFC72E866144F5CD7795CCF0EED86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 0dab6b2d2ddb4abd2aeb9780691df5fa65a6688d6caf82d9dc55e3ba18087343
MD5 46f27b5054f8b59536c4b02f33f412fe
SHA1 ab0dc0f7f39365e7230cac4d0f106afa383b4677
SHA512 91a79fa6b03e83d2abf016240607696ab40faff521c15239a72dd0a2cb29099ab00bcfd2f70e9424b0dbfa75e59d179b27357a34528714a94fb3701b3b970a82
SSDEEP 12288:oUeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:o1+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BC552381D24C88CEC52B07748B6A0960B698BFC72E86A144F5CD7795CCF0EED86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 317f0c16b46117e11416e803cc5b5fbd97cbbd6c3bf773ddffb1aa6bd4cdc4da
MD5 968e4cfc76d7a2f9f9901a63a14f996f
SHA1 446bb972fd8c80c410a83885c9a82a7aded32a14
SHA512 87e45a4e4ce9fdd6ca0340ac0d7a5534fb95894535279eb069ea3b271f54b4e204a4867ad67f3e83aef551241caa56875bf4c9f122196bab0aeb2c43e095e366
SSDEEP 12288:nCeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:n3+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B2552381D24C88CEC56B07748B6B0A60B698BFC72E866144F5CD7785CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 b66b60cbed42a76bac3bdb8668a6a8d89c46f6d3355abc57889ed85db5475d4b
MD5 5b7613b4ef412c3ecc30a63b91534cd6
SHA1 44593bf79b59699ab0e550574244d77436c48c66
SHA512 3ec3f87f8949c8306060caaef4f0631b02c53fb3bb8787477cb51a75c5d68935b40a40dd47363a6093ac9fd3da49f1cf08f8eabd827df7d955ea9396f9b591fb
SSDEEP 12288:iVbeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T170652341A35C44CAC4774774CB770520F3A9BED66F62A28FE6843B894DB0FE88974B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 60fcd98a31716ab9615f0ee63c8f17667181ec4a15906dd43230e91754feed5f
MD5 ea89cae137c75bfab7c9769fb70798a2
SHA1 6ac60c34ef8cee13b3e4aebe9dd856215382a57a
SHA512 c6430e36c3753f2efed8cdc5e940908c1140f2ccee1ab45047b8858348a801f67a5b6f7aa677889687c816b567436ab1a3b323f53ead259badebc05d355667b9
SSDEEP 12288:vjeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:va+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19D552381E24C88CEC52B07748B6B0A607698BFC72E866144F5CD7795CCF0EAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 ad6f72f1bc594d403399a3289c3df520d14f38bd90f196498e37486640dd7795
MD5 b0586a122df5621e117ca88251f14018
SHA1 e2ec56afedc7b289be196f9f570d063d96564d13
SHA512 fda5b1dbabf43215c7d48f80aa26394baf0598ea2201ce5bfd43879c66e691a7345aed480656666f60340896c8ecf16c07e5f7790a2ad0afe273c10ba46bfee0
SSDEEP 12288:eYeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:ep+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T16E552381D24C88CEC52B07748B6A09607698BFC72E866144F5CD7795CCF0EED86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 bcd3c4ba71f5121a31db4988e2753670cc2ab8bc5903b0ee8c7a35404c3663d2
MD5 5949f4ea8f4afb747207af3abd099ee6
SHA1 366f56edc6c7b6b04083203e4fb92b75ceef73cc
SHA512 6c3eb4f676bf3adad9f93bacde19aaa34de2290d8788ab0c6e84a8198af638a7e4c38ed7aafef6bbf0552e3f0d90e88e39cbffaa2c61b64ce6ce61f318897ea9
SSDEEP 12288:9ceH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:99+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T103552381D24C88CEC62B07748B6A0960769CBFC72E86A144F5CD7795CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 bd3376afe939b35583005c4d33368166c90b65fde56601ba1b67ae6154d8cff8
MD5 4fd4c1b91c240be0f35c213eb2817d1c
SHA1 e363baa71bd48c52af942415ed02a9521e22a9bd
SHA512 840b21d02fdedee1fe1747c979faca33e3296445ec75b481a9ea3e1f6479fe2bd96232297804cbd4418384c7aa06228888124ecba5e006fd1f7f8121b84e7635
SSDEEP 24576:sZM6zFVSOV+4ZAgayjhwbmY3MaReFeDvSP3b:sZM6zfZ+tgauhwbR3P8wT8
TLSH
T1D7750194B35418F8DC67423ECA664911E2B2BC5A0B60C60F53E837675F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 93b042b415e99a4d7bf15477cb1dae766fcda9d09f385708199f40432b53b84a
MD5 3c7ddd8513c90855577a1ff687dc000e
SHA1 cefc86db453d8a7146215d6314eabc67c5bd15c4
SHA512 6da48f1b56d25a1cf44af40653c84b2082ce81f33d36e4df473caf06be41031c87ed61f002df490484c6108b7660a73490f5757cc980b85a506d738f27059947
SSDEEP 12288:AReH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:A8+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E8552381E24C88CEC56B07748B6A0A607698BFC73E86A144F5CD7785CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 e6019e66a01e8877ff7af0cdb38a0537817945dd63bddddb6a6c17982aa7e3b6
MD5 b5ea85ee8cfb5c1d5cff2a3ee41d71d8
SHA1 da4efeec2185270f1051e03e1b5a6a7d9e5273b6
SHA512 ca36e9d1b5775d7ad27a383f9e199a67a228bf4e9fcd5fee5d7dabc7d15212ed1d9374fbe8b91eb90ed31d2b29325f9ffd73d2bd4b5cf937ca5e65aff907f328
SSDEEP 12288:5teH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:5o+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B7552381E24C88CEC52B07748B6A09607698BFC73E86A144F5CD7795CCF0EAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 f343eee62d5471f1a4a944b87947f148371b84515650ed814f96b7a260e171c6
MD5 8e153107b3a1256c3f3f5c1e808e026d
SHA1 75a17cd5df48c4d83c5cd1301c663b59badccef2
SHA512 6175df8c0b3fdd2ff90a96855aa5e680a71faf2d532776274e2072114e38cf6b54e8e5429427c85a7c75cc24259c1da6c27cc35a0d13dd2b0bdfb6dccf2df141
SSDEEP 12288:IyPz5L8weH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:JzyB+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T10A65124773A430FDC1374238CA620A11F775BC721B609A9F579417B65E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 2e5ad66a0c0c493d0667ab3099ad99675ea3b463155f4d28c27db7c43fdcb41e
MD5 e7fd667a6e48550a2f73cccbecd6f266
SHA1 cd483a97e80e4e9cb4f687a7b39d3c817291176a
SHA512 2bf9d7e40405ec4194ea606295c3658fd651fee861e347a02bd090293ad3c430fa7b84ec8a349ec1f5e583566091c9c62abd981d4ccc415f13f19c3cb8434fa0
SSDEEP 12288:yReH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:y8+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T110552381D24C88CEC52B07748B6A0A60B698BFC73E86A144F5CD7795CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 9a00cfb3796f6096c4245a768b91c7a68e3d5ebf74aaf23b7d4de970d3778a0f
MD5 477ee9c9cb030343ea137bf0c1dc263c
SHA1 9d00fe675532220a6f2b768f6a7844bb837bda61
SHA512 069eaf2cc3c6e17b82d6cb493c0797d50f60b0b0959fd75bcfcd021cc70814d00c6c5b0cc5412587fd92b117169c662274b75a4279d347e2aec3403bcce68979
SSDEEP 12288:5ReH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:58+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1F1552381E24C88CEC56B07748B6A0A607698BFC72E86A144F5CD7785CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f7e17daeef46a8eb943695426936e50016277e35db967fa22b99ff8f03e859df
MD5 cba4a132b225ccf23a9f9a12a539bb75
SHA1 d185297296fc11956b421739cad61a686bfa5bb3
SHA512 fd53ad0739b955dbc99dc89644afcf6845511b469db4d234a34c4dbe37ffafff9b92e7221a18a41a1239d77e47cb796871c9d425ff3d9392694990017fa1faeb
SSDEEP 12288:6yPz5L8weH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:nzyB+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T18465124773A430FDC1374238CA620A11F775BC721B609A9F979417B65E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 22ea74ac0a0595887cca693595dce8da5b1ccf622ef0f97a9a4881a283cb1776
MD5 1ae165a5e245dab5cf2ec65e6d9ed4a6
SHA1 01c8a0f27eccf01557d958b13ec515686ce33450
SHA512 b816f7475a101a0513783d9877f6d55111406926184378dc2e1b024a1b0f2b4db5b43c0b75627df062cc5014fd6e91586f0f392c7589adfd9383594fa3024fd4
SSDEEP 24576:ETfaLl3z0zDH+4ZAgayjhwbmY3MaReFeDvSP3b:ETCLljW+tgauhwbR3P8wT8
TLSH
T157750194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 5696fa06297365f87d8c3643e0636b44396d524f5d20483805b3f2e29d6a1026
MD5 53d106f6a9215ee0d80ed9cddb3b38a3
SHA1 3741b32e6b198ae128015b7fb25bad5bed2e8805
SHA512 3b1d01c3b37f32679136be651162525b4d8998354c9d16daf4b98943f480c2ef5ca9634cc8ed09550ee119155e305874ec387f06ff6e18155925f0e510cb0c13
SSDEEP 24576:H3/d9CHKy7GZ7+4ZAgayjhwbmY3MaReFeDvSP3b:X/d9CHKyaZ+tgauhwbR3P8wT8
TLSH
T14885CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 6110458c2a41bd19127f24659f094eec3137e6f46e4db031042e2f91e5f3d173
MD5 427a328112ce0334b988cbbceb281fce
SHA1 03473db67f5701c15a77e4917945405490783664
SHA512 ea20379578cac1b928551adaa23692ee6acf82dc3ca34215bfa0c89ff2b0e6b4597913b1dae121e33d460843033cdd2dc5527f3b4f9b6a4ecf950a24a6d0df04
SSDEEP 12288:MieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:MX+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1FE552381D24C88CEC52B07748B6A0A60B698BFC72E86A144F5CD7795CCF0DED86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 631e4ac9b33f0ad22881d6ae8a813f86a83a96c13f16c8cc63e4a202875c5536
MD5 13036e095a89dbdc0513b90ef696027b
SHA1 794cdb923c3b2aea31d5b1afe475ee1f704b05a8
SHA512 8be784d6218b7f44715785dc21d4e34cef5ac964dc9a8b253c26b8521b5f75cd6204ffb0e5ab75e67562fc350c7c0ce5688b32de390fd6db328814a4b8173fd0
SSDEEP 12288:dQeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:dh+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1DD552380D24C88CEC52B07758B6B0A607698BFC72E86A144F5CD7795CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 c56f6e3663f43f4d3082d7a32a197837f9fcb4c4036b9be419cdf55d494706af
MD5 74147c2d7928d43a9791cca392aabc58
SHA1 d9d9114c115ada646b465d41a5fb9f94802ffbb1
SHA512 5d9cf7b36b0369005495adbe948790bafea7bf99df1b55ef6451ecd2acf071de15334eee4ec562fc8609efcdbf20a3955cf3420c70d8e436d9453c5daab22f6e
SSDEEP 12288:0neH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:0e+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1FE552381E24C88CEC56B07748B6A0A607698BFC73E86A144F5CE7785CCF0DAD46B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 11e3b85bf0b038e06f41433b8fbbccc2eaaa576674daf99a970156a823284523
MD5 235ed17929dd20322efc5cbb9c4cabde
SHA1 98860ed5b8fc87eceebf6a20c89dc36106d90feb
SHA512 d836ad3e8d3fbc88ce58eeda214aba6e19d948e9f067bcdaf954e284f94391b750db99f0cba2c1337e22240527659c69b308cb81df8b8bc3a4c000917c80ecf2
SSDEEP 12288:ZReH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Z8+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14D552381E24C88CEC52B07748B6A0A607698BFC73E86A144F5CD7795CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 2eea110272430641db80d314853c7155cd60772f578a6e2f5c25556a69805c02
MD5 9541ee8c915ae0c4d659112189aea700
SHA1 8359c348142de2b5fec17504647c52eaccc334b8
SHA512 22229d758ac4615c5211674ec5dbf45ba13685bf324001bb8ddcd2b8b6846283254bb9584327d6ecac34ba557c8b94661d3a8e7abeec13d3927e4ff722757d48
SSDEEP 12288:6ieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:6X+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T137552381D24C88CEC52B0B748B6B0A607698BFC72E86A144F5CD7795CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 3969e5c42cf55b86e6f0ee1773bd04cdc8cdf26f37c681048abb63713d261bff
MD5 16ab9ddb85f9497c36a032bfc87bb44e
SHA1 a0187ccdcf8c1cb742b55a9779f15e3318626a89
SHA512 365b17a037aaedbe118ec243933992ea46113b6438b094c2c85cd4b42f946b72cb2e3444965d86e375d5146b711d4d8c9f80b42ce226ed5ad2b7e8e7a369a021
SSDEEP 12288:jZeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:jE+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C5552381D24C88CEC52B07758B6A0A60669CBFC73E87A144F9CD7785CCF0DAD86B5798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 aaaf4b0afef57c35d40e894150f36d17ad6d7126e0682ecf83380f864b01eacd
MD5 7c9494f3d7d462537860c3b8350bcac3
SHA1 9f77336bcd2400b577eac82299406e1e509cf2fe
SHA512 c85f00db13adb080c39d5c91c3a1ca18211ced122bf4b3a0ddf3414fdeb9d9fb73ad22c5e7288d9205e95d7cb83ce25d20a09d93d7b15817e575627d6aab0daf
SSDEEP 12288:SjeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Sa+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T17C552381E24C88CEC52B07748B6B0A607698BFC72E86A144F5CD7795CCF0DAD86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 316db525396770224b487c3534721e648265d79fed1ebe13e05329f6a9247211
MD5 47328dc3ee34109e705d3e52c0fcdc50
SHA1 e03f4faf72bf632b43a5484ad91f2cf2369b0c24
SHA512 463284c1542cfd0c54f714d6e673fb07677d94273a8a90ea46616a19131fcd39c90467a8dbb84080fa523a8899604a7df571a60d5b1a8b546a4821f8980a10f5
SSDEEP 12288:uaeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:uP+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1CD552381D24C88CEC52B07758B6A0A60669CBFC73E87A244F5CD7785CCF0DAD86B5798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 7f1fc481e0ba0a067f350b0ff2b911b5f79033b62d7d6a2e25551d0e8a70d1dd
MD5 d9f511bcdfd8a14bb7a8efde45e9c046
SHA1 67fa1c8e40194e6155dbaea50fcee9e1d070f343
SHA512 cb979e5b42121302ea53eb552bb830f43350d579df047cc3fd81d5a614a6bcd29e7b4c15d6f2dbccd764adc6518499ae9379706a0cab5491d005f3fd1b93c751
SSDEEP 24576:/fwvQk9RX6wkyAIY+4ZAgayjhwbmY3MaReFeDvSP3b:NMnYIY+tgauhwbR3P8wT8
TLSH
T1F695CF29EBDC44E5E1B7923C89B74606F6B178591B31C2CF129A53AD0E33ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 97dc6aa19065cc97f0d19df4288d932422bfefe69add6da421a222f43e064418
MD5 5797ecda9f811041474eefae15801f81
SHA1 7cdc56dc0b4b35df1f05210253ede419ee9d8cc9
SHA512 75bc337c61122f8c02eb8e81112c9a591e02f1173ba9a066b7a94cd86077990fb4892249b184516ea65abf9bbe6481195f2c9903e502d4dcf9b0a57bd6bf2f26
SSDEEP 49152:pYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0j+tgauhwbR3P+:gySzP+gaPJ
TLSH
T129066C96A1A801D5C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c2c195ded8d1c93d25a7b883ec58f13b646d28d697f37b4bc9a58bde0de743a8
MD5 66997f4b008bb47d06c70558b3a1baf7
SHA1 fed0857d0939a3a38a917250d1157f3538336970
SHA512 fdf3285514ed62849b496cff8840ab623457dfaba957ea2a9cb6f71e26ab9ea28fb8c992d7339c0018b723616acecc45bff0146f20ea6cb84f356afe60c3a4cc
SSDEEP 24576:H47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYF+4ZAgayjhwbmY3MaReFeDvSP3b:H47JUQjqirIhCnDHUPfF/T+tgauhwbRG
TLSH
T19D65AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 f6246241ec55e562af977716432f71f30f458b9a877ad3372fa93245d7f3f9e4
MD5 b323544d59e74ca93629c56f1fcd2662
SHA1 0983c1882899378fa07506d19f0370032b2f4c07
SHA512 d79356ac82b29eeee44cada5a9ef4bbd2ccb403e665585679a512856b61ed47d6f45584e479cd31b413a485e2bafbf1de38d2f7e6c030d11acbebc00f48791e0
SSDEEP 12288:pNsfBeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:GM+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T18C65F149D29801D8C06E1279CB564A40B3777C6657E1E3CBA6C0F67E0F71AD48EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 6ee969435255fa623bc584c1610643a822ff7eb0d7428f3452d9237822dfdd0d
MD5 41d73a85a216607e695e6ab35a968282
SHA1 0f7542e50c3493bc67d743765407a7ec8beda6fe
SHA512 cc595d69ff0db7073b01e7713ad6bc9cc618c0aa1c8400bdb91915d473e84e0ff2e794666059f0a38bd55f1f2563c26310004f47c2bc3c1b2cda4229a824a62a
SSDEEP 12288:TcibfBqhrM7oc8rKeve7BZVqbXMQT9qdX2OoZH:TPfq48ZoBZVqQ09mGO4
TLSH
T19F4527107626DB4FC6A940325E33C1CCAB707D42FE05AB0773C9873FD576659BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 fee6fd86a69daa72318d22edbd53d5b5a3feb0a6c2416b2ed0f0e8b9795fe4ca
MD5 c09cda7bf750f6e3cda75319562a1ff9
SHA1 5479ccbbea3b4bfe48dd8f5a86e0c9291b2ce613
SHA512 bf6fc62f75ed1d40c701243373cbd86f46e9b7b24231d3b91e0722510477c28fa430b8044c5504289629b0f454b1024fc4006d95529bcd2110c598d3a3cd05c2
SSDEEP 3:OlH/l8ZUY0gh0rl/ikearmlXA3mCllltq3mCllltGlslslslslslsl6Rhc/:KuZUY0a0x/ikJrSimCtSmCtEEEEEEE
TLSH
T16D8112E86F4807E0F2FF2032802963440730F049684093DF060832228C44FEC1C07BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 10f5246f1393a68d873a3a4c4ae48b2879415a85d899d9e9b9a04cfeafd7582b
MD5 14c20c4d52750e7458e792ff71a5eebc
SHA1 dde367ba576b18e27c04b1d40c1e7dfacb17a975
SHA512 48ee71b62260c2dfd565579d28792598f24e0acae77c5eda83cbf043613f7632cee4baa0808ebab348d04a9dd249ab324581765e6524454b03a33521437562f8
SSDEEP 6144:H7xYwA6sXcnHYHnRaGjq0YVW61ozi0KDeoHg0KDeoH03aSmkUIs12HmR0gaLh7Zg:ajMnERaOqBV/Sm3hsned9JmO9Q
TLSH
T1F7651940A536A78FC0B76032072A5F8DA774EC07B7056F2673C9453AD86AB56B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 511686926ce81d7fd0b0e375a62346f7abb1c343b09ab33e9e26816582851239
MD5 fe159807fc2bc220fc683434e7ccdb1c
SHA1 7175d2c54187f82514db3c6f02a791c3592c82c4
SHA512 06df4ce3eae5fde44d5f6ea6fcefc6a20c697eb0eded4b424e6f536761b778f3c1db9b5c1bad9261c05ef79e906898068cec310663c9d2b587bd58578f66e66c
SSDEEP 12288:go7JeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:1U+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T175652391D34C888AC57B0B708B6E4630725DBFA61F41A1C7F48977C98CB0ED88EB5799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 77ef4a209d89e4c9f9b98545336cf5adb3f012750616cd0370f58c0b851fb44b
MD5 4a10a3ce81c734784e3c1a000aeef781
SHA1 05dcd7f36c73420bed079ac4aa1637b06aac11aa
SHA512 962b0ef1ea7194d2391b9ef9f0bea348a704688887005b5af65f64e9abb17cbea27b72df2edd1eade7b85192cff0d8db86493d5f8c9d1979275ac9e5b9c7d272
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYW+4ZAgayjhwbmY3MaReFeDvSP3b:5gb4mBIBhGFF+tgauhwbR3P8wT8
TLSH
T17C65AE1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 85178201b93440ad511a16f80ae175ac48e69468251c210ac878d2bd6ff09c01
MD5 6ae2886ff629437f832ec758b97af2a8
SHA1 4c3f9f114f71ff6bf0a3431b0f54742e1c349533
SHA512 fc6c61ea4b631ee729a05203756c0d0b084e3a9a5f5b82628dfa02d84c938ca1984bc950e8238a5e1048830280332af730eeba031f6d57bd3ee6d57482fbbca9
SSDEEP 24576:vG88u8FpJqH1zzria7/mV+4ZAgayjhwbmY3MaReFeDvSP3b:e7ZFPqVGa7/++tgauhwbR3P8wT8
TLSH
T18F950165B7E401F0D47BD1388A864663F6B1B8250364EBDF06AC8B511F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77cf1d7ca3cc6c961232726dbdd9d03226cd17674c8a3835628497212132d8d5
MD5 976cc71997f31d7c6c7f156e246afe04
SHA1 cc12156cc5cd69f1cbb1ef77035dbbaf072e1909
SHA512 8d4cd0ab6bbf7c764143a7dc510f94adab3cc8e449c87cca52d0cc973ecf80d8aacd31b9c17515c1dcb1a44c65803f7981c5450d9e20bbc0b30c1959fcc3a44c
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjp+tgauhwbR3P8wT8:iG05lO43bTgaPJ
TLSH
T1EAD5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0a77f7d4029093d0646ae27f5d60f2898020462985205f06a009ab3afef5ba40
MD5 d14158e0f2a52cb3d68730709d2a5c32
SHA1 874d419b39bfb7791986216cacfe0cb5df6d0d14
SHA512 fbfff73b8d4f465bdb2dffead29692a4974e7c24c8d9767c4b884e86721315393a42ca053e3ced620841228cb374fd1ce2793887753495b905c82b32993191c6
SSDEEP 24576:Dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnj+4ZAgayjhwbmY3MaReFeDvSP3b:7a5POZ3lJt2pasx2+mh+tgauhwbR3P8z
TLSH
T12F65AF5EA6FC00D5D579D17DC6834616F5B1382253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e45ca9da318697fa4937ab763061420c1fcc5bda5b637c9ff4dba3edc6a6cab3
MD5 541e05a2c9c5a8c71ce6831509f34884
SHA1 6eca6b897bad2df2889c1ac705d21f2c8ff2d1d2
SHA512 2ade66e7430d28e0be6b2d5c996f0792985ce63c7a8e6f464305275317f0470e0cc3ea17371b15bc1a8e160b85d1cae306fb22b16f291e79b5321a51f227202c
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkN+4ZAgayjhwbmY3MaReFeDvSP3b:FNc/zEOVHFe+tgauhwbR3P8wT8
TLSH
T101858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 344cba3182ae908dc94eb3c51f84d1c1926d9f9ac6b5ead761a30d150c2036c4
MD5 50883e80b8ea906d405085416648ca90
SHA1 1f249cd0a3962aa15456ad06c750d93f84d368d3
SHA512 1f5fbd0f4fc22a9f4023f60eff51bb051119996ffe2611844e4e7ee7bab1d15faa6bd753c29c7cca307c056e55a2391d15e6d6d2f25e0dd9895e5176731e01a2
SSDEEP 24576:KzkNvNnaFeYhJNtmZBmP+4ZAgayjhwbmY3MaReFeDvSP3b:KzMwBtOmP+tgauhwbR3P8wT8
TLSH
T1A755AF6EB6B845E4D1FEC6B4CE238512F6727861073293CB9290C13E4E679D88D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 ad899ae0ff226ddeca8e6156515f7e8a3ebdb218edeabb3ca3659b2833399775
MD5 a943fff0bfc815fc47bd3df618c04277
SHA1 e2a8ae6254686a377800381fb2f4f4724dbc0c37
SHA512 93a694e7aca17eb3fdbad794d0df8080a310c131947731da2b9cfaa27be54323b24da2b281f894222143ba101d31e3ddf238cef3e98609a84a1a2e77a771dd5b
SSDEEP 24576:XPUr+NQZ+4ZAgayjhwbmY3MaReFeDvSP3b:XJQZ+tgauhwbR3P8wT8
TLSH
T16675E11F62AC18E5E67AA17C8A864715F771B8621712D2CF02D0917E4E73EE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 203fa19ed3897285715e2298ef28a05c54359d7ba16448ecbce3360d8b5c9b7f
MD5 81f6b4a4bbc40e275dd6933e98b77abd
SHA1 ef13a0f8cb852bf3b34aca915e90ed4f6e2c12c2
SHA512 67f3794a9b207dcc826fc990389ba48785f1664f1a7d12dc8a9dd3b31a3502612861b31ed7043c3e570fbc0fd52898c70d41ca05e27c0b97a53ee947dfad2ee4
SSDEEP 24576:jD3FHshBIYQgAQ+4ZAgayjhwbmY3MaReFeDvSP3b:jDVHeBIAAQ+tgauhwbR3P8wT8
TLSH
T11285E17DE69C04E4D57BC2BCCA634A02E77138A9032266CB12D491BA5F77EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/588-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/588-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/588-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/588-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2244-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2244-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2244-23-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/2244-15-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/2244-21-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/2296-64-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2296-72-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2296-286-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2296-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3016-230-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/3016-50-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/3016-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3016-52-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3212-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3212-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3212-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3212-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3212-383-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3212-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3408-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3408-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3408-108-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3408-102-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3408-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3408-314-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4620-133-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4620-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4620-138-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4620-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4620-127-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5256-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5256-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5256-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5256-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5548-77-0x0000000140000000-0x00000001401CB000-memory.dmp

Download

memory/5548-318-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/5548-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/5548-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/5548-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/5548-0-0x0000000140000000-0x00000001401CB000-memory.dmp

Download

memory/5548-322-0x0000000140000000-0x00000001401CB000-memory.dmp

Download

memory/5948-79-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/5948-84-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/5948-310-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/5948-78-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/6032-74-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/6032-58-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/6032-46-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/6032-39-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/6032-40-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/6052-313-0x0000000140000000-0x0000000140203000-memory.dmp

Download

memory/6052-116-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/6052-122-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/6052-115-0x0000000140000000-0x0000000140203000-memory.dmp

Download