036dfd78ff26d5a8f070f5a4730740a9c26649e0b5aa251d905208e754ec0a3c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
Size 2.8MB
Sample261023-th4cwaez2j
SHA256 036dfd78ff26d5a8f070f5a4730740a9c26649e0b5aa251d905208e754ec0a3c
MD5 e38a19f5a8f143695e9d0a0c3f7edb91
SHA1 b9a74a6a8717a26fe2eab221c7e88db4c4cc9cc1
SHA512 b5f0fce3194e5ab46d29636e6b43375c43f141b1ccd9a8d7798216f3476ff38d57ff4c8e9ffb4df23dadfaa996e9bf53e0ac4589bd2f561fb28be67f83888ad8
SSDEEP 49152:VA6TJHeYhORXVKHuPlk8OsEqYQVrarSj8RoTCCHDmg27RnWGj:tebRXSQlBRJTbD527BWG
TLSH
T1E9D5BF4773E801E8E0BBD278DE67950EEA7278460B3497CF06904A5A1F63BE14E7D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3304	elevation_service.exe
3816	elevation_service.exe
3120	maintenanceservice.exe
4080	OSE.EXE
944	PerceptionSimulationService.exe
492	perfhost.exe
1988	ReFsDedupSvc.exe
5456	SensorDataService.exe
5712	ssh-agent.exe
3584	AgentService.exe
5824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\12fd79cff1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001098313b0863dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020dc48380863dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3816	elevation_service.exe
3816	elevation_service.exe
3816	elevation_service.exe
3816	elevation_service.exe
3816	elevation_service.exe
3816	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1452	2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	3304	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3584	AgentService.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: 33	5824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5824	SearchIndexer.exe
Token: SeDebugPrivilege	3304	elevation_service.exe
Token: SeDebugPrivilege	3816	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 2164	5824	SearchIndexer.exe	101
PID 5824 wrote to memory of 5548	5824	SearchIndexer.exe	102
PID 5824 wrote to memory of 2512	5824	SearchIndexer.exe	103
PID 5824 wrote to memory of 3548	5824	SearchIndexer.exe	104
PID 5824 wrote to memory of 700	5824	SearchIndexer.exe	108
PID 5824 wrote to memory of 5708	5824	SearchIndexer.exe	109
PID 5824 wrote to memory of 5744	5824	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3120

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2ab45e7c6d4462ce5e62d6a8662b7796b2605a5df4a99c2bfb44c047e927d764
MD5 2f2e121316c7332ec8fc072cdb93d6c2
SHA1 5f56b6dfed8abf5755b3ca66bfb92e8890f3dc97
SHA512 aa18bcfad78ec0d4d4bae5cb92013871d24765257563eae149da9e8a91b11a1fe88f2704600cb82dc258496146397fbbbd94f21ded80484ed0a93a4d72827f77
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7Dmg27RnWGj:E3q6HjBcD527BWG
TLSH
T100D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 912d63ec37b893b049d7ed4bc0b28a3865fe9fdb8d0d8d22c500feb2b2e157b8
MD5 ecb8933c4c892a9ad7f6a2a9bbdb3b6a
SHA1 6a1c7bc828d24aff373d6279eb3fb8d3e03ed466
SHA512 85df00c23c02e4c50d117e559d18f0574cdf14d1821fc3e33b22a66549bc6f7545d1cda2ffe091f8787f5ae3794db421f2438488b4ae5a0f8a16cee59c7bf5e2
SSDEEP 24576:kXYfDtczAksqjnhMgeiCl7G0nehbGZpbD:DtcJDmg27RnWGj
TLSH
T102850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c6b4e8db7dd1e6173a57a6035ec8b4ba0ac35d6617188e1098821476cea278f7
MD5 a8f501d99126d7549fd061a4c716e0d8
SHA1 94d61103420da94392f2beaefb93502d6cc3dd6c
SHA512 8d012174d6a3727f5436b4263ea71323e3a9fde6940d287a72e91f15817a88846117b505dbadb36599a138eec51acbe0b0a85dbd7cc6795a19463e626999a85c
SSDEEP 24576:s0Le5ji0hmxYrM1sqjnhMgeiCl7G0nehbGZpbD:sPji0A2ADmg27RnWGj
TLSH
T1B2959E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 331f1dc0a312ed454350754046c3b94c82fc8dfd332b75eee48be5cb6c901adc
MD5 ec28228aa16fb2e48642aeaf830a61b1
SHA1 5410c90baee814626d0b880d00793450499a88f3
SHA512 a7e6dc3ae7b85d585060ba2655ce24b7c72e4accf0120aea955e3d4a4da5f15ce6e0c8f33a30b4735fdfcf0e1b4eecabf07449fa873d1211d958d65ce131c5b1
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyursqjnhMgeiCl7G0nehbGZpbD:L/ezSC6vUzPvxHjyMDmg27RnWGj
TLSH
T155755C25F5788323D0B2D0BAC5D6BA9AFD7230465B3089CB0246D76C3E277E58636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b67fa4281b850dd75b4481888817b7f31eec412643a675c373cce3fe1b094372
MD5 c0f0266f53d3f7523056f3f3a6a4c073
SHA1 590c521fc1bbf696eb856de4d2b6b46dcb591d6d
SHA512 14864e93f7b64bacead758756ce7d9f2bf0b1601d579e248394805eaad1affac9d8fe5c6f591b1f5961dedb2a7f3c0f8b59079c581afe402f08c771cbd8063d6
SSDEEP 24576:yVbqPb88hv/l+6GsqjnhMgeiCl7G0nehbGZpbD:yVO88hXl+VDmg27RnWGj
TLSH
T103559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ad3ed947ef0bce3e68231faf0b3f86f51b537673ecb7a9cd4673c8e64959eb9a
MD5 d9bbbf4def42bedda9159cd2b7ea90e4
SHA1 4a9671777a5d7af0ae878240ad5d4ab66911a3ec
SHA512 e1c49034f2c503ad8d452a5624863d077c7ca672bbbbb8b36fe1ad1da94a96f6022bbef1d42fcfb2620929967ba217628aef266e60f1f0581bfe001697a76d3c
SSDEEP 12288:jHpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jHpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE6523BE834C11CAEB7709B5C3E9F15EAC177E56982008426A637DFEE6B5454CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ef5a115527af57479eec72e39171cd6cd05d6759f0749b0e58be82dff95826e2
MD5 2d927df5da9c68c8969070331cb7ef0a
SHA1 26691524007a54545bc7c05544f6a1f13d32d3ed
SHA512 2eb349f4798b4bd5aed5bd687cf467cec20fbe91ae39260b69ab4c541a3fbaa447cfec1abb17be5da9336e390e52fbabd70789048444d0f7a93db8e59495e220
SSDEEP 12288:zeBNUbTVO86U+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:zJIU+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A085CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 66353b351f43a70adb30461858ce37b849e35381e6db8e55942803feecfce905
MD5 6ed865da80a3a0ce56add9b75f75e91d
SHA1 39422d2c099d51e85c2449220c92926a9242101e
SHA512 127b8057405c5f847fa77acce0f53d6957f589698487495af9df13f36636c8fc8525f4cdb8de0cfb4a95ccc4439bb51bc077f721b981b67bffe208f4407f4fb8
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:IQvGAdlCEL8c/yRNw5CvD527BWG
TLSH
T1DA266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6d9bbf7553b24d29d53d1ddd77a8cb483d5ea5c862c5144176fce454e89a06f6
MD5 ab75398b70adacaf67d1631024e8eada
SHA1 be100210bb69f2b0392a0c37c10a3b75c5581b0c
SHA512 7efd1dd75a11db8f49a6f57f2c4669128300d1dd7502c828d41e628665067e26884c74d6280fabf236d38abce947ae6661db9dbacc0e5e891d00e0033e5b8d19
SSDEEP 12288:SAwSfxL/2Dc3SDLLmt0LDQewsAj0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:X7ewsAj0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11085E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0430c7576025b5e3386443123817a5b359f2cf9da21e797682e63ae8870d18da
MD5 1c4541aa7d07d1a9f7b16e6ff0170dd1
SHA1 cc564b4047b181ab903ca11ba505d3968b39a846
SHA512 a962f5d66d509d15b03cdff1900123f63a606a929d9e505bb0918cd03ba018ad10af06562b38f3966cb00d410ee9b2157ba1af23271a03ffcffed2c00ab165b5
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoVQBWG:BUEtQevvqc2W1cpV2EI32vB
TLSH
T133474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d8f5f23826052fc0624a512c02c22c5336099b4baa94550129d4cc59d1982839
MD5 7ca08b97a33b807133368fd311308f50
SHA1 d9138e13a25a1d094b2ed45bdd94107a25d273d1
SHA512 b0ee25813f6973e3711b254a13f98651a8f5cb5663bca3479dace0b15e7fcfd65c57d60ddf7ef0045b8ad59bf41b9cb03bc0894fba865b978f52feab0b552f4e
SSDEEP 49152:cCbRquA/m2yL5zTfFiV+XenmE3/zwDmg27RnWGj:VoquVjnm7D527BWG
TLSH
T11FD58D1976B8C1E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e48d0a7ef86ac9a443750f0a4406c549ca404964db2354e2c6d8118751af6ed4
MD5 43a40b565fb4f277d177eef793cb4cfd
SHA1 76d38d8ec8d4c728a10eb21ca012aa9945ad85fd
SHA512 b74f7b4a76a1e5c517204f9ab690105c7da0c44064288d2b0f7e832bee9b58f2c0d42df800f965a8cd1d5583779fae050eba73f65760cecf6378fb829810f60a
SSDEEP 24576:wAhGLJIFoiwtA5l7S53HsqjnhMgeiCl7G0nehbGZpbD:wAMyFoiq5LDmg27RnWGj
TLSH
T1F3359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b2e34cb14df528f0579c6320e19ecccae905074f0a36a948b69459c170c8b8d6
MD5 59e90635fc8285be6dd5111ff3b2983e
SHA1 e5a0e1b47aff5c16893e0bcb0064ce7d87cf8914
SHA512 13e3fb78a43e93a9b742d0e6efb0f3724110f74290ce2d5817c516a48d0e3250a6998c108026ad2c6b536f9f51d919d29cb287b5652bfad6adc3e65d04f51fca
SSDEEP 12288:wmw5HEjsChNzBFgl0WDm+CFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:twuSOWasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C285F14A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F37250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 262a102e7a58e23a265e4c447a02082acc1a27b5e119d40dbe2accb9cbc7ff7e
MD5 f0e3bb1946858736df39aa7bd419d58f
SHA1 14984f433497bed0a69d81a478aca63263fb92f1
SHA512 9d7fa85ce86fd64d859a68fc3285b98a8be0a58668a169363126fb24778cc579f4d521810364187fd96c46b41c09ff039115f15c1faff52163ae75950803a446
SSDEEP 12288:ijZ1IyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OZutsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1487512AE239820FAE1A7417CC5E5D609E7337C62673003CF166656AA6F739C44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 397193134a76697f2819cdfaef42fb7c878ec2f5d3ecdff2d1819512bda29565
MD5 5cd88f01e52ce05ec84facc0d8c65331
SHA1 77c67e399ebb67f54dfa6b186ac93036777ef5a4
SHA512 1e2c0ffe27ad0508b1b9a5031ff91373501125ba82d646995b9d966f8569e6c50eb2bbefce429e4c23b2b8f4c4462a40fe1180bdd3389a600b0a8b9130b9b195
SSDEEP 98304:rQRQyi36YOcPQLvw2gAf+PN3+D527BWG:aQyiKayX+PNuVQBWG
TLSH
T1BF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 297e706456c64692bce9334dd95bc63196eca07e8491ea5491eb6de1927b1ff6
MD5 d3e6f1b5a43b37a81894fd209bde55c0
SHA1 d8b2726de2704e3e3b0c19c7fbc6269bbeb4ff6e
SHA512 21adabef8367cc9ef301fb605d076f3a197ba1e4b43e4609058c56dc9b7648a9c05100d0c262c355ba84e4881d906d5f8efcf408fdf9a9500f1b0a81f5b78503
SSDEEP 98304:VQRQyi36YOcPQLvw2gAf+PN3+D527BWG:sQyiKayX+PNuVQBWG
TLSH
T116667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 68e84c9680c77573095c76302f5a5caf9c0ad265a76284a5a3f21a7bbc6c3a92
MD5 89c1067e64ff41fa2b4f3fd569f09501
SHA1 55af906c9b217cf547bb749f97812da1f73d2d7f
SHA512 fcff06237043949c4a19369555190bef9206c26e1cfa9223a863165b9c772f4061fdabaca81cfff0b004c9e32d990d58d4bee7285171dea4d8b7503ba8938c8e
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dsqjnhMgeiCl7Ge:F68Qg55nhheWu7PNU3/ADmg27RnWGj
TLSH
T1ACB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 17cc8f458eebb23e4fd6a12ccc9ee36750d7c0e82d04ed5d4c80a70f609f1a9c
MD5 8bbce4e0a5bbed27d825674c58fe2a91
SHA1 add319435cdeffdfffeffe3a3e65b10c1f996f8e
SHA512 d3dbae741d2c52c1fabc2c6591c0b966a26e66b5520addaa38c06e5f2347b168c8225c08e3493a4b0ea1ab34b5ee049a7ed14f8e07dea79ef2ea6aa0574b3fe0
SSDEEP 98304:ey5112gYy5azzVvL69nLKnhZtD527BWG:PLIHmWhzVQBWG
TLSH
T190167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0f73e36bcf4629ccfb2ea5a3d05f9a3a4aba0d83d0c90420a1249e8d8cd2c40f
MD5 58610e5b47afa9c915588bd1524df0bb
SHA1 95912aaa76b8f66b3c0c7976343bb6c64fd14035
SHA512 50e4d9cdd479e1bdbb02716788d634e1a14cef18675b20aa2188de33069b56cf079ddf931badd5940bbfcb1f6112373d08d5749a8a9e83e287e8a15e52cfffed
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glwDmg27RnWGj:Pu6JmVxd2dwD527BWG
TLSH
T129D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5fb2345c158cf9649e81daf8ef9f4a51299dbf0f93fabdd9dd9d4fe736597757
MD5 2adf440c73a90efa67f38574202d7f85
SHA1 660346d04336ae80912307197f122c775bf02380
SHA512 61965b85e3426438f5ebad84c03370b7d43a70f2dc93530de7bd1288452bb82b1c5ef424082648dfa980066b241dc2fbbbe8d2d645de6af38987a8ba52a37237
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xyDmg27RnWGj:0mifPbR7D527BWG
TLSH
T120B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 77ec31415c1533405c86652dcd30cbae646ad83c98e2d34fa73195ab057dfa52
MD5 5f26ed9ad8cf5506d406a8141211a8e3
SHA1 d9ff76d6dd94fada67186ce0c23cb14d5d1be859
SHA512 771074dbac790e2ae1ac62b79e945af529009e6f597e55b40e13b0be7ae875ac4a3be510993b5a81ac0ab977566d220d1dfa1845f09f6a037b2455c1a88a4d68
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqRDmg27RnWGj:I5dKTi61RD527BWG
TLSH
T1C6C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d5976e162dd328520eebfe4b21c6cd42da9c5039dc5e073a24afe4d974e90090
MD5 3dca6b9b52ea3b0b1553d74b6400d151
SHA1 42d07b1fb8116bda3bc170d1eca68814d92881cb
SHA512 6d817f72055e09d6d340d798d078e1ec89f15683f951affa12a31edee13b9a31de72a4a381c1dd21148123b0fb14a274a5712f14a5e28cf9382f5113eba57f91
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wWDmg27RnWGj:GX2iyphnD527BWG
TLSH
T19795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 b68c9a464d0eda10be76c9a54cfdb3772da0d9f8dbcd26883424c687a8a083cc
MD5 133a5e6d1ed73b707afdf0f58a7559d7
SHA1 17b1f9c1cf1d3567fb5c31e9b2145f3633b05608
SHA512 23ac6aa546359288720fb301613418215adb67d4d7d39d1e9086f984abb88500031c533ca2e0ba57ef7e818bc2c538c7ba7f6c036913d3942f5e5153d5f32175
SSDEEP 12288:/BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1176523BE924C01CBE52645B5C3E5F14EAC073E5BE92004937A9B78BEF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 24ca96823dd14e5aab9a4bde5de331ce44dd2bd90eb4dc31ff9aa2db82fbbffd
MD5 a8a68b5d57c565dfea5a1cc68ae3ebfd
SHA1 f2f5b9271a60087dd87abf857e2abf3d84cc0afc
SHA512 6119e41ed4c533541ca08b5a2bf7ae579ea9bd7f8269da1c53e22a7ff8d79ce76fdae5441a5a6c24220e97447b8beba7e5c3ddb14ce056cc66747a39361ecbc1
SSDEEP 12288:nYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB6523BE924C01CBE52645B5C3E5F14DAC073E6BE92004937A9B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d11420eeb74e885265af3eb09508999970828be3f9fe2ad18c88443b3e49f469
MD5 faa04ec4354a4ab9261ac938febe0698
SHA1 826eeed8d8dacb7ce46ae1e8da7a182c0512373f
SHA512 cebbd1a0652877201533a815253f8b195a53001a30598ebf8de15d65685257256fcb04623ec2e70e5ae504d32163adb1576c4d8933517ec29ee010be2fb1055a
SSDEEP 12288:Q2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF6523BE924C01CBE52649B5C3E5F14DAC073E5BE9200493BA9B78BDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 a7c5a722a44d97e33e415d328e9ab3d0633600e710715a6a3418ef4827b9bcc3
MD5 8559adaf425c04ebe145fb6490e2cecb
SHA1 de18adfb999fad098120dbe81ad323f8f617f720
SHA512 a4170db060c7f4461f336e74eb7d9f0a066c8ad195ad79ce6e0a2316ef482ea46caa4d07de36bd3ad72ff239e61ce743db2b885bebc4ec65afccf94839c72bf2
SSDEEP 12288:pVnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16465236E535C00CAD83785B4C2F5E11DE8277D96DB30059B6B532CBE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ebe98f2f0ee06f0d9a947fc74e8cb8a77c6d03c4f0c17d3e3e8173f593ed6f98
MD5 ba2cb02fd8455cbbc405c6f05ce268ed
SHA1 08f5743a1418993db0d51e4d200330a23622ed5a
SHA512 c31cdd03107b82e0eb2d7b4d656420f5ab867beb8364351ab287a4cdb612c7a6e7ea42ccdb10335406cc021d36161aae71ebb35018a777bfc1588b10c9bd0373
SSDEEP 12288:ovXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ovsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1646523BE924C01CBE52645B5C3E5F15DAC073E5BE9200483BA9B78BEFBB14584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b38666741326b3b5a8c18ac267685b378deefda4716479b11f087e00e9f29833
MD5 bedf0011184e7cf39b415bc6eab86e0f
SHA1 77131d2c10f036b15b46e6081f89b1d1e18a4f6a
SHA512 ae255d92f42ec66ee29cf2813f7dc1429bffa2580a0d862ef1722128699420e7ac834859c33ce16e5d9e56f99410e63f5a705bc111a4f4af87f07d3015b9b1a0
SSDEEP 12288:LMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE6523BE924C01CBE52645B5C3E5F14DAC073E6BE92004937A9B78BEF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9302f7015b1794e205413108faf5d4a44da87b3a109d565ccfca4f068716bee0
MD5 01dc635cbd7bb3239f9fa5aee21d279a
SHA1 fa2656b3a373e5a270c71c482070bc8e2acb75a1
SHA512 11f8aa60d8c16bac57e34eb194d175ff2b0dc9b28b215e2b87b0c444a6d8ac8eb180db08160feec63ed6e2578b9052825bddcd941cfb6dacca917fd92bb5e28f
SSDEEP 12288:dgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A6523BE924C01CBE52645B5C3E5F15DAC073E6BE9200493BA9B78FEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 6421653fdbcd44bda4ff3a1e25c8b2ed9e151949acccce3ae5763315b237d8e6
MD5 4c184142594a785560e1b0fd81e0c335
SHA1 8b536745c2eaec06645bfc3944a565d71d2fc0aa
SHA512 ba2ae615fa82f007a589f7b0d811836d1b2d0ec7522a88c72e4c94181d4ccafdbeda2025017e9f00e82fef6d219783ca6c5c70c280e7db0f9872287f38527fe9
SSDEEP 24576:VZMEzFVSO4sqjnhMgeiCl7G0nehbGZpbD:VZMEzfIDmg27RnWGj
TLSH
T1E28501A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8d26ea014960514aa26109150a1dadd26effde26a96d5a1884c469d9476462be
MD5 fee5cf6dc6fa1349db45ffe79049512a
SHA1 3e7750a3d30e62a4e53efdb2567e35d8c8337001
SHA512 bda941b7fc402e649368fd995dd187f53dfa5b6d994848da7894223600a4707ee171d7e1432f486d1e19c5e7028ed1a75f689e3629bd91b18d52b5ebac7de9c3
SSDEEP 12288:89Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEq:89sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C36523BE924C01CBE52645B5C3E5F15DAC073E5BE9200483BA9B78BEF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1bf6afbfcb156c990da5b9c22d8e094dc98f4b3b4030e04a38c97694cffabdb3
MD5 9b5bf9f526ad0efc365e9c9f37050447
SHA1 6425f4521f20910753cecd976d6f42855b4d3118
SHA512 ceec3b2a188480a34f3d4b8ec241725d6df29669a9ce8656ede4d84e91a2c5d008b431c03ffe133254a1d9bb150377313684df0dc0b4079d506ab088afde480a
SSDEEP 12288:R5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEq:R5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1366523BE924C01CBE52645B5C3E5F15DAC073E6BE9200483BA9B78BEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 21a806713996abeb6be4f9236d5c7e0f998f7d908caf20aeec870a4f19ee7ec2
MD5 ac2da2cc8eb2daf42ee40b4b145e39c1
SHA1 c2c9d78c2ad5769dcf178546c6d2c30243ee32c6
SHA512 1fe455f701968958d5c7c8ffcf89a48d3d14c27912467cea4d6c5d520de8e45baaf181ea38859dbf371f1002d39af36eda1a242b6753b94554126501a9cc340a
SSDEEP 12288:/yPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E375025B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 7549f24ce98f8b0bd78f18a6355d6778ad78c8496b3bbe843b060026f322953c
MD5 a438bbbc2269acbbbca39bab0e5fc255
SHA1 8d49408ba4e8e9a9cfc9f96f75f947b814ae3a73
SHA512 f84ad00f8ab57cafceeeffddb633401cc9b56b8ecce97180657b1bbd6e467210fbdec67d364b022a24d19a1fb7dd74552805729d5645feff0599e7e80a2ab597
SSDEEP 12288:m9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E56523BE924C01CBE52645B5C3E5F15DAC073E5BE9200483BA9B78BEF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 55953577353748c8509c1adb6746edbbd8a242858d072453d23f7a15884c43b0
MD5 7a4f8bf77b333172bac0c7b77fa518c0
SHA1 99ff91d78a08cf53f7cabf58bd0b250d2ca6e58a
SHA512 56d34c22af8d85946d6fb60311a30b6ed5d64c9ea00b3620a85ed4e13ed0ff272b32af6d510323cb6253675ed536fa488c0d445ad20654db4a40254458c7cd01
SSDEEP 12288:G9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F16523BE924C01CBE52645B5C3E5F15DAC073E6BE9200483BA9B78BDF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 34cc8524891c14761a1ae8ad22a7f5101061058c463bb7341ba3107bb0fe886a
MD5 8fdd9d4ab2a1740f9449d19b5518fefd
SHA1 b51cddc11e7eb2d2163b5282bb206eed7df8a6b7
SHA512 f6b4ffc467917b86e34a7dc83c31c6bfbffe4c882ca212114f8f49c8bb31408fd4e40f93e0e73cad667acd936f3348b30f1a607cf09484d58e1b438f3d4ffd94
SSDEEP 12288:tyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EzyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC75125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 65ce651dffd68ef89590bcec1578c123275ab477c0d532f4cc7308a94424dd6a
MD5 3dafad004981711497c985f1ae2fe16f
SHA1 b14db1a1e541f35caf0e6531cc558eb4d160e320
SHA512 6c3f5df933cb9d6dbea470f7ecd7fc2c889cc29667d8f7f8e51d15d7c52c6221dd45c0770ab40cfef91213d5689073a3c54bd49670e6e338e9ab1498817cda1b
SSDEEP 24576:ATdaLl3z0zDmsqjnhMgeiCl7G0nehbGZpbD:ATwLljfDmg27RnWGj
TLSH
T1718501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 ce77349014179855167010548f1a5865e042f8bb9e2b601051cf3ca9ad62e21a
MD5 97fb1bf4f96d576491dd6f01b5fb3500
SHA1 f0ba2d60c284c171b9b868aa5db4923aac668e2d
SHA512 a41e43ba34f4b9df1a5e172b5eb16dcd9b44705d1d3c280aeccc6f81c03e3184b8f1980630e455c2639a99701e4d9705a71f60d0f48826c3e235129caea2c0fc
SSDEEP 24576:E35d9CHKy7GZKsqjnhMgeiCl7G0nehbGZpbD:O5d9CHKyaIDmg27RnWGj
TLSH
T18895CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4e1792cf7383f13223f74cb801fbb746ef9580d3681cd370916a82310d9255e9
MD5 653088ca0776a7c9d0fc7aaaaad06b46
SHA1 89e8dabe45286107fcdef04d1a1371c1054038dc
SHA512 3f6c4cd53c15a15b50fc830709b5b0987d73c414c131c9f48c1f1bab5c175a752a1904a3e7474cbe3b1d85cf6a9415dd8a4da0529920f903c54f681480ccf2a9
SSDEEP 12288:9WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E6523BE924C01CBE52645B5C3E5F14DAC073E5BE9200493BA9B78BEF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 35e071af34d3e0c0a3c02457b6db97f3d18ebe54496990ce0f486a6ce3694fc0
MD5 8fa8a9b97f5127800921d882cf6e7748
SHA1 76c55fb7a43ab03c2c98a0e1a48cd7829ae2a1f2
SHA512 2d7340f1bc0deeda0e80c77c7e255346a09e6feaafc4fa133d2f42cffe706f05f6ef257a15f93cd39e8e7e6a2902adb4c2a75b01cd64df978a56c2c29378e21a
SSDEEP 12288:lkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lksqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C6523BE924C01CBE52645F5C3E9F14DAC073E57E9200493BA9B78BAF7B58584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 aed2507a36659520a888d5a903c587782732346237d7ddf007940aa0f9783fec
MD5 717a9f2106267ad9b11491566460eb09
SHA1 ec8a284513fac9a0a9c3063c03f9f556023d46b3
SHA512 2265f3684854a2bcb2aa23f43f70d0a0d325eb6e233991e11c3e80c4ce1e6ab177e303ae8d2297553a52c88b71624f236d842460a56495aa255bbac2dca690e1
SSDEEP 12288:ezXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1906523BE924C01CBE52645B5C3E5F15DAC073E5BE9200483BA9B78BDFBB18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 9d2e5a87b69ec07238dc57af7d974b2ed61341b625e56c01f97074d10ac6e1c4
MD5 dd18ac679608ab050db15057f38b3b9b
SHA1 06f0453e56adffc15632e4dc64633c03364a24ab
SHA512 2341204531e33091172958df46e3884504b9be1db35a017fe560f3d128b00d75f7e5b1d9cad9b78b7e66f3d72425cceb61bf123fbd8c4d5c1aad295857f080df
SSDEEP 12288:99Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:99sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F6523BE924C01CBE52645B5C3E5F15DAC073E5BE9200483BA9B78BDFBB18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6b61a23d304b04ed25ac99295a4b442aeec7012a807b37b01fdbd6a51a8cf606
MD5 d62da74c07ab34b9dc6d85bc249e354f
SHA1 624513964307059a5389bcabdc53089cfd0c731d
SHA512 3dd0272ee781846839a6022077a7ddad676911929e5d8328608a947d5ec744d5c6da2a8684c72ca3c4f1ae3ba3c4edd7dec4bddae43ee187fdae8874ad87da8a
SSDEEP 12288:4WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C66523BE924C01CBE52649B5C3E5F14DAC073E5BE9200493BA9B78BDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 c724276277f4e5616f5338661cad9b1e74204ca20a6bf72a73d934cdf9a3f652
MD5 bd67022c27c94bc65186ab28faaa2b31
SHA1 9f65a674f6c39b27770afab6287957c49f911b3f
SHA512 a1b30085b0c4f7b2ae154032b75e4ba5bdc86e02219b4e1519a0017d14820a3182dd314afd35a0db0b1a85cf7a22d222a165680477836ffc6efc4afb95eab789
SSDEEP 12288:tlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1486523BE964C01CBE52645F5C3E5F15DAC0B3E6BE9200483BA9778BEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 aaccde2b69f36342171fd68b336ffb3b4e865c924cc69f58f3870c6f7f6eb096
MD5 d2ab37841d229158ad7677fc707de23c
SHA1 de3f3396f35b67deef5dbe9955e8ce47c6cf0c7e
SHA512 89c8feb79a937c1123131c0a6628cea069c1e5500019fdc558e564701818c7e02d2cda0a7076e35e78dab8fda1c53c301d9d81124ff376878ef5e7cf46e5c2a9
SSDEEP 12288:2vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E6523BE924C01CBE52645B5C3E5F15DAC073E5BE9200483BA9B78BEF7B14584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 d20ae127073b452c71a8597363ed4191ec74cc08f3432330820d305ae38a030e
MD5 995f05f7c10bebcf3e71949d001c7eeb
SHA1 5d24e1afb03046289c7d7810bc1e18a3db6a09ec
SHA512 aadce82ce8aeeb3eec79b7e53b22b493e4b7cbe362dbcb1b18d412ae144798619f9efa7c628a7432a5bc84ab469a29722529360ef98590fe1d4fe97dd8731723
SSDEEP 24576:nfwv+k9RX6wkyAIbsqjnhMgeiCl7G0nehbGZpbD:3MnYIPDmg27RnWGj
TLSH
T1A195DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c0f4ff78d9448ac07a5f359ce9923967223c2940f84f102b36903eede5fdf33f
MD5 23b755f78ee6b5db047f97a371e1a5ef
SHA1 e6d31f44d3a7c73a240d8a9b8436a55d9e9c7d4e
SHA512 4d446977ec940c8cf77e3245f80e1718fee1907faf2314b20ceb032af58e14ceafaedd99abdc8cd9ac8fd40678062b17668687fb3cb24e72fac7b9d6098db491
SSDEEP 49152:KYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02Dmg27RnWGj:kySzPeD527BWG
TLSH
T10F066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2ecbfb17de0a13692d6778975a0ad1a60ac5eb0c038745d178cf2cf6c1c1ce07
MD5 98ab650bb285c4093927a6d6ce80b2fb
SHA1 e15ff6617c30faeb69caa0e788f3da3da3f500eb
SHA512 5829779f26869b71319e8fdfb4fcdc8267b32f423a0aa53b173c5d7b570e94f14bccf4ca8646ed08dccad927aba38fa0c7350d5fa77f51a605f25392975886e4
SSDEEP 24576:G47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYIsqjnhMgeiCl7G0nehbGZpbD:G47JUQj1irIhCnDHUPfF/GDmg27RnWGj
TLSH
T1EF65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 2b454dd64762e4567476531b340d907fcf1c19dfc48e8e3360699dc184506de1
MD5 452a6a8b1dd142a9e8003d67551623c3
SHA1 f972e3769f029fd89ce226f289b767445f89c7a5
SHA512 de602757df7b4cd3cd5dd1cfe5eb5cd110741b6a6e43b2417432ec2522e8ad768acea3041e816b543c604ea33ba41dbc3fa9225814f643acff7d58c132eee3e3
SSDEEP 12288:MzsftXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13375015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4c0aafa96f4ed8f45740dac987d6b6bb7dcedf6b15be05e6a4fb61b2644a49b4
MD5 4b72bf9196ed7f7fa2913f2a23149a13
SHA1 24da803ac442b852fd23c5a51fc273da5922b196
SHA512 5f6bfa9c12af0b5a4c64e4c635f036ee717c3b9b0bb7a8cd4b5630eb7095d364988ba9dcbbee39a3a750c4eccac2e3ab3e730dc34dea13a0f754bf9ee7844797
SSDEEP 12288:IemEDvfU3fTz2QZHtxmRQJiGQbfKYbO/4ZaqJk4T7JiTiC:IerDXUPziRb5bHZaqJXT7EGC
TLSH
T10C45F6407626DB4BC6A940321E32D6CCAB707D46FE04AF0773C9873FD576659BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 6b60837989bdf1e50deab81403ae2730807f50b7ba58d19920619c67ce9a5213
MD5 3a9537dc7c8fe138b1a223615c3a0870
SHA1 7b5db7871da17bd2a52e7ea75140b0077e45e9db
SHA512 0124e7846598dfe984b0368758b34ff7cb53eb60adda078c3da11dba1299056db8a1b336296d96f262ffc048a04f28435b39e240d3ec10c56e35e390f4f1c69e
SSDEEP 3:OlH/lsjqPW85dHzljxqOiBY//5l3yjJ/llS3mCllltGlslslslslslsl66S:K+EJjxNiurOjlEmCtEEEEEEE3
TLSH
T1DD8112780F50D625C961BD3145158FCC0331E296288BFBEF25B01C321C20B4CDD32B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 e04f565347e2b6755e622967c26b2bd35cd2f8167096d6c962662729ce2939d9
MD5 72f704de3386e75286af9572ba78ff08
SHA1 191aa72b6d19a18b0c2defdd566e7348ae82f947
SHA512 c28c50eeede9fbad9518d2d6e62011b4a3d1cb21bdbee4e8160ce4919ba285d359e5830a7627ce688ff7b5a2b2d13792c4e51969a772b7b7203af75d3c9313a0
SSDEEP 12288:i1VtM2b1xuzdsx2/PD7fwUaNB2f1vTKVnz/YtpY9qzewMvbk0cNQZHtxmRuQZHtK:i1P0VPD7vwINbGMSxbkLQIwfARd+R
TLSH
T1FD953A41517BEB4FC5BA4037033296CCAB78AC06FB456F05B385893AD467A5AB5F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 236a93fc64e3f41bc69fd012f049fe151468b10c1cf5184f330a5762b9db742c
MD5 65bfad3d81321fa65ac705b326a913ca
SHA1 17cca3cfac43876c0bb030e63fbe7549ac4e4d5d
SHA512 ef2aa2a530fa7dcb201232db3497a5f14ba39f947967a4fce79e2196d61925d9f1b8f9db0b00c8b3f1b7d38e7b61c48e7e9624194f07b8b20a920ab7f4f7a281
SSDEEP 12288:iO7fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14265237A934C118AF93A59B482E9E12D780B7E669F1044C3B94778FEF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5b245770c00ed4fe8e4a460b68e2e14a04a739a73aa1137ee5adff4d3659fc52
MD5 9315abc4e90a6a08b90d76787bec4780
SHA1 f0a9be65193f0bd1b2a369d7c7fcd97babcf7b6a
SHA512 95346faf18c8b8e892c74c651b7342239396bb4b72a9da0b6356d2863640aac910fa05857a80df50ff168ee86d859e8844172e4db556fe1b4611d7664bc0e69c
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYrsqjnhMgeiCl7G0nehbGZpbD:jgb4mBIBhGF0Dmg27RnWGj
TLSH
T130659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 4cd4b707e13109466284b9e1fc3bc3b53b0035d2633185a9f1f59a6fcc1a3b3d
MD5 ce932737909c105d8df74b3e9843591b
SHA1 89dfa43ccf4eec0b77c8bc181c4990571522f5c1
SHA512 89c209709d69ea00ef585c6578792b0623a3c2202b20222bc820f3d6dda6da7e2b1dbba770e7dc24ebb7d7080f5fc48a3a55dc5f08e224817790a29330d866cc
SSDEEP 24576:2G88u8FpJqH1hzria7/mCsqjnhMgeiCl7G0nehbGZpbD:d7ZFPqVoa7/RDmg27RnWGj
TLSH
T16695016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 0158957eb502dfd04d333969d580130defe03cda8362544a2a4b7e80b58d4859
MD5 a4a0af839f2bfe5660cc904a7f7aea7f
SHA1 8280c313309909971da2a88b872cdd24d25a6b70
SHA512 aef0b4dc0c65da4b3307a4f9b479a098be84788c22d059246904a7396fcc65b51e56e060ad15b3c47f368c434cd8ba2144a5aba17366a8950163ebbbce1ccd39
SSDEEP 12288:dHvUrBFrEjwaQuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:dPUr+NQusqjnhMgeiCl7G0nehbGZpbD
TLSH
T15785F12F62AC18E5E676A17DC582C70DF6727862071192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 070bd5137e30567f153c4a78097a2104d4296897af0c8afe9542c871457e6c0d
MD5 5026c632db78ad276b000e103c33bbae
SHA1 9928375d7ba82e0ac42994054ed5f92a99d9377b
SHA512 224a43dbe639addf98dbaf1a2990c49e9a6ab5d0bc7ba70c2bac9e6f924bd547625970c2e2133270590d5ac2abcaeb7f7106328ace172a5a87dc2ef65a5bb06a
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyDmg27RnWGj:wG05lO43bHD527BWG
TLSH
T1C8D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4c4431d12800f95ec3842646135015f88c20fd4bed0b3bb6d9e8f987e7375a48
MD5 b1dbcc05bc6137da26f3bc47de5a8014
SHA1 4f061341ab33efef34a30dd57b8bb17ad9a1b553
SHA512 6eb1c2b14e674e15472ae9763077834ad4d2007bce3a6eb3e8f7282b4ecf7b875309cfbe26e21aea7a21bc93a1766362d1083d72584115ebc5ff18398e497dfe
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnysqjnhMgeiCl7G0nehbGZpbD:fa5POZ3+Jt2pasx2+mADmg27RnWGj
TLSH
T11065BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c512d4a8c462da1187c4fcdbd28d6ddd67eddd74e578744381d69860073b9e43
MD5 3f8bff254edc9ed7ffe829a962767974
SHA1 96238e6cd77be9dd2056df418fff1159e7388c86
SHA512 0e68f0f2f219147cc9ca15e4ac1de1f6798e6e234801c36fd7e4b09de69ef0a48867492c3cde90e4cecd5523870afe3495760377b55af7a97e792d4c67d24f99
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7Fk6sqjnhMgeiCl7G0nehbGZpbD:1Nc/zEOVHFxDmg27RnWGj
TLSH
T17D857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 937a94344e8982aee9f983255023bbee32797f57d6dacf5ebbdbd75882cac9af
MD5 a09d0545404bed7e923eeeb267fd4eef
SHA1 5a925db4ecf12687d8b6c693478c880e3f20a65d
SHA512 5ef2301644c75097fa315a3780404c94a91c52acf6de8e7af95f77bdd4a3eda88fb44539ae991acb19c171eab9431693b1d6a69cb774b1ae5226004017aab22f
SSDEEP 24576:w8kNvNnaFeYhJNtmZBm4sqjnhMgeiCl7G0nehbGZpbD:w8MwBtOmkDmg27RnWGj
TLSH
T16555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 68aa2fd3ad44d516a4c93f3b5d7cd783a6733cad13175b1825c3abf0bb9eed49
MD5 bcbab377d9a5c8f51c3b8ee02fc84802
SHA1 9a09a66b43566e1582d136ecb719468fc01e68b6
SHA512 0e7b337f0684e7c167f8a04703dec95f9393edc9981c8c16b3b6cc560f7cbd334fcfb46af15028a1351371b7fcd228d9e7eeb1464b3d14fdd4ecaf694a7ad8cb
SSDEEP 24576:AD3FHshBIYQgATsqjnhMgeiCl7G0nehbGZpbD:ADVHeBIAAXDmg27RnWGj
TLSH
T13295E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/492-93-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/492-327-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/944-89-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/944-81-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/944-83-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/944-313-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1452-120-0x0000000002AA0000-0x0000000002B23000-memory.dmp

Download

memory/1452-13-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1452-10-0x0000000002AA0000-0x0000000002B23000-memory.dmp

Download

memory/1452-18-0x0000000002AA0000-0x0000000002B23000-memory.dmp

Download

memory/1452-9-0x00000000028A0000-0x000000000298F000-memory.dmp

Download

memory/1452-7-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1452-1-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1452-128-0x0000000140000000-0x00000001402DF000-memory.dmp

Download

memory/1452-0-0x0000000140000000-0x00000001402DF000-memory.dmp

Download

memory/1452-80-0x0000000140000000-0x00000001402DF000-memory.dmp

Download

memory/1452-123-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1988-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1988-348-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1988-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1988-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1988-103-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1988-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3120-50-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3120-61-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3120-63-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3120-49-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3120-56-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3120-57-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3304-25-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3304-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3304-33-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3304-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3548-337-0x0000020370B80000-0x0000020371200000-memory.dmp

Download

memory/3548-410-0x0000020370B80000-0x0000020371200000-memory.dmp

Download

memory/3584-154-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3584-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3584-152-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3584-146-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3584-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3816-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3816-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3816-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3816-43-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3816-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4080-70-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4080-294-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4080-69-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4080-76-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5456-331-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5456-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5456-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5456-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5456-116-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5456-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5712-330-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5712-135-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5712-141-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5712-132-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5824-334-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5824-162-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5824-168-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5824-161-0x0000000140000000-0x0000000140172000-memory.dmp

Download