c89423efc522db862e3acd855ef99ae3e1af69384571579db0a07a38d665c802

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 4.8MB
Sample261027-csswfsay4n
SHA256 c89423efc522db862e3acd855ef99ae3e1af69384571579db0a07a38d665c802
MD5 f3df558c4b27b6b935d2466fb954c1da
SHA1 4d10f00c7dc3a49de9e84c3c94e34b371f88d2ff
SHA512 135170d51a0a9abf652545fa88a51fe8e7c4a907468dbd82947286fd8b7ca78a0c77fd23ea31aaa5eb6e48f4b62693d7741f69d3f7686a85e3017a6881d183dc
SSDEEP 49152:oLT31iAVS5qQ5JnAPqUs5XjPo/iwEkoT56zFUZGSFwZMuAsDbvtftlW4aqaJvmva:IiL1GSejJzratmRqiiratm
TLSH
T157366B0273E90B89F2F78778C936A2129476BC299B11D7EF1654414E1F23BE08979B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2012	elevation_service.exe
1508	elevation_service.exe
1296	maintenanceservice.exe
1580	OSE.EXE
3096	PerceptionSimulationService.exe
3260	perfhost.exe
3872	ReFsDedupSvc.exe
3440	SensorDataService.exe
5912	ssh-agent.exe
932	AgentService.exe
4620	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43ad7064b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/764-0-0x0000000140000000-0x00000001404D3000-memory.dmp	upx
behavioral2/memory/764-71-0x0000000140000000-0x00000001404D3000-memory.dmp	upx
behavioral2/memory/764-146-0x0000000140000000-0x00000001404D3000-memory.dmp	upx
behavioral2/files/0x0001000000009344-144.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058f45c14ba65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002536bfd0b965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e5df013ba65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0aee7ceb965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037b875cfb965dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fead53d0b965dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022e063d0b965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	764	2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2012	elevation_service.exe
Token: SeBackupPrivilege	3872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3872	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	932	AgentService.exe
Token: 33	4620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4620	SearchIndexer.exe
Token: SeDebugPrivilege	2012	elevation_service.exe
Token: SeDebugPrivilege	1508	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 1000	4620	SearchIndexer.exe	102
PID 4620 wrote to memory of 2288	4620	SearchIndexer.exe	103
PID 4620 wrote to memory of 4548	4620	SearchIndexer.exe	104
PID 4620 wrote to memory of 4348	4620	SearchIndexer.exe	105
PID 4620 wrote to memory of 5380	4620	SearchIndexer.exe	107
PID 4620 wrote to memory of 1440	4620	SearchIndexer.exe	108
PID 4620 wrote to memory of 4264	4620	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1296

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3260

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3440

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1000
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2696 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2696 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b598f0167f2c2ed2fa8c2f186542c4453cabe6e4b8ee2125885bae3782f093b5
MD5 3f9034d10fcc6d1bd5bf37c8d07b65a2
SHA1 d481f954602bbec9174ba8cb1b15e68b8f9e9f20
SHA512 6440c4502ffe3f9f1c115114a1e6b06830ba2482950583dde4dbbd4d197e52c82fdfe4cb691a8788ef767f040aa8e799840fba6dfddbf79c62221dddac6db763
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7W4aqaJvm:G3q6HjBgratm
TLSH
T1D3D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5baf83bc9df109d06da7f005b1bce0146db993370138324568579dabdf6d0bbf
MD5 df5f6334ca66b47373f8defaba0c4974
SHA1 f998004813cdb4ef77bc3973b874365a05e1ae5e
SHA512 22a7e9598e6694eaa07fad9644605154d16ffc56c3ce3f5b933601dc84a46288e8962066212a1b3d08a20ccb78a2e57b952039de5ca7c95ed475e1f30a2ec669
SSDEEP 24576:hXYfDtczA2fW47yfqas+pPzbSedM08a0:ktcVW4aqaJvm
TLSH
T14665F12977E448FAEC67917CC8A1C501EA73BC9147A0E69B03F499291F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 899a09726c36e874115c05316879f6357a61db0ff28ef1255e60bc930109fc3a
MD5 ccb46edc8ab7072f16ba1f2ab7507c57
SHA1 aece0bab02dd541043c5216754ab081e3867e8a5
SHA512 662ed403f659f87167dd383defd5743d7c098cfe78fc37802169571f31e1e3c3fd6d0c915591e0bdba0cf40667c98c8cf8195422a28bb971c388d48e1c202c7f
SSDEEP 24576:40Le5ji0hmx8rMJfW47yfqas+pPzbSedM08a0:4Pji0ACgW4aqaJvm
TLSH
T157859E16F6748735D073C0B9C5D2A68EE97130821B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bc28a6100346ec663499733be320157fe19d6f2968535a0735c99cb67acd0587
MD5 6a5d0741f66337eb92b377904e604f73
SHA1 a91ab46ea05c388f401097b7c113ec772b361bf1
SHA512 1aa4bf44ebaf51418a8c017e0b82cbab0a14d8be0a1ed2abeed7b892ab57e3433775402e3b08cb2df78691c5d44d45426093200593302e1712f6e729dcf43e4c
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuffW47yfqas+pPzbSedM08a0:C/ezSC6vUzPvxHjysW4aqaJvm
TLSH
T1B8755C15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d3851fb8eafc12a778f6ece241aab0433abe7a0862d793041ede8075e09dea8b
MD5 91a1104c3fe097670458499f1f096d84
SHA1 28ad1dee28f2078e61a9756f08a64dda172475da
SHA512 7079f2013a15090359ce024685914fc01d6b1d0508c53f3f8408ddb0ee06d07b0a2e2eb9c79442b9f9512c352380aaad690a4ee106107b122bd676ae7ed57d5e
SSDEEP 24576:rVbqPb88hv/l+6gfW47yfqas+pPzbSedM08a0:rVO88hXl+1W4aqaJvm
TLSH
T199559E66F5B48331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 09aeec5c933cf81f58eee9fc384bcd7dfcec7044e8b37282daf8869ade7f043f
MD5 181d645e6353a2df7988691061589f9b
SHA1 b6c1373caa35ad8bb4febcb19782cd5d2cd71d0d
SHA512 e767e004dc743027c9666c414c470c1b01839a84d5a4f7aed97c1c14e622410d09d525cf76fc08dfc6c3eb46a9bac87081aebcd40b0e17d03621d5c22affaa6e
SSDEEP 12288:QjlfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:QjlfW47yfqas+pPzbSedM08a0
TLSH
T12D45238A1BF5D87FE938F4746580DAC5D9A5ECD109906C6F60F2BD1D227D0A2C81BA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e07e7fb39e13f6d7ebecba0f4af1e4df564db0c70d6d92943ea11525dd7bbb54
MD5 972fb7dd20b40a358277e0e4def7f016
SHA1 be4b8f3c6ced23be9977550897780cc6b4821410
SHA512 042117fd09a563844425b37ea3237ece01a22bcbdc64b9174c9fc6ac3c47461a5da5ad9baf5ad126c3c5df5ab2a77722b676af9ebc80a1f410291996a025b4de
SSDEEP 12288:EeBNUbTVO86UYfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:EJIUYfW47yfqas+pPzbSedM08a0
TLSH
T18165CF3BAE28FCE2C27E9DB85691C640D77278704F51A3CBD175820E9E235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4837ede59ca9d50dca23ec0b3a0e3243779b1279f81564a64073a74819eef0ee
MD5 888200b8d1c5935d9cfc8dddc2eeae3c
SHA1 e90f567b83bbdc64bac2dca677fa6a5f73b924d3
SHA512 21632a2b26820b5367963f49df46ede3d71f5ba0d6ed4b74674dbc1bc8b17272656a1c30ab67733cf69f7b2d134fd005e24e4fd99254279191c6b8864fba5017
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:dQvGAdlCEL8c/yRNw5CXratm
TLSH
T127266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c50ad4ac37de356f0a556ebde08ca93d327bd77f1dfaa30efb0eec7f43a4c4f7
MD5 b5ad3dc839f5117aefa035e0bf3ee345
SHA1 5bbff5bf18aa095406ba4912b8d4837577f993c9
SHA512 7ed18da792e259d6125b102a14078b4694c576932c5430c72744e1052753eb7d0428695eedbd590c0f9437dbcf768fab0ccca22ef48f695b6a49846da6c1a8c5
SSDEEP 12288:pAwSfxL/2Dc3ODLLmt0LDQewsAjOfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedv+:aHewsAjOfW47yfqas+pPzbSedM08a0
TLSH
T15875E031FEB4E436C27B0DB61B25C706587CB9600BA129C3E3E89E9D59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4c65377f786cf54891994e4af0a19d991635461ed733abad894c1f9a364c497d
MD5 7de8af712c8781a3d651540fec291769
SHA1 f284e9782ebfffa08a5c80e7b47dd422f6994a5e
SHA512 f38becbad56272028cb1c0c43647301c2b843df1a08a1f6040b5f7594366dee7384386e84a593df4d65b69e44789fa231d4509511d1c7ae324edfcb49e0868e6
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHMraI:CUEtQevvqc2W1cpV2EI32maI
TLSH
T152474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7a49cfe4e03589d9d951c99e329473aa9f042dec31a6117a1260b7670f171bda
MD5 6407ae8cef6fbd59ba66be3cad014645
SHA1 f8eb09fb7da5bdcab532617892d1b4938c1a3f42
SHA512 23e0e895e50ba1792e9ceec38b817b03c5448c590cee6e8bdf644da4a2b67245aed5c007d2e9b046de32f78c4c242074715309f10fd73bd8f4d07fcd0c01502b
SSDEEP 49152:3CbRquA/m2yL5zifFiV+XenmE3/zwW4aqaJvm:goqHVjnmzratm
TLSH
T116D58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 30333018b3b22b03b5d6716cb650e64ebaacbee688d3296b155f4319c1394d2e
MD5 f2d8e0772cf95a1336e275b20e2449ce
SHA1 8b0e5f15c34495c6d4fedf4255f54b764f3e1d6b
SHA512 ed07d1c0b692d77452a56c4590c84a605049839b0a8c778151b222d5aa251f7127b07054687ef846f504e580eda1e39ec15dad8b53d85a073f704650db9ae82d
SSDEEP 24576:BAhGLJIFoiwtA5l7S53jfW47yfqas+pPzbSedM08a0:BAMyFoiq5DW4aqaJvm
TLSH
T15035AE81EBF955D4F5B3AA7899B68171EA76BCA61E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c251c952ce8f4bd2d5af978f4ea0750ad701409af900eb7ead215fe75f724328
MD5 e1a35ba70e2f2118a6d7cd479ef8dc67
SHA1 754b391c7b5c06d929badafcc1f0373db6152106
SHA512 2f8b26d98662cec2bcbd55e43c101651a8fc18ead8d231d165993c9ccfaa45b8e1ecaca17d2cda3f25d8e7330bd217009588629a5ac596d2d00b2add2bfa7048
SSDEEP 12288:Imw5HEjsChNXBFgl0WDm+CNfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEo6:lwuuOW4fW47yfqas+pPzbSedM08a0
TLSH
T1AC65F14637E44CFAE96691388587C536F7F2BC412A21DB1F13A0C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f4ac5e59f7c28f85619321c7f07dd066537e61f84de9cd0f6fd42821848e7831
MD5 1d208e1d4783caf76518767f9a0df61a
SHA1 a92ef5886b935a1a3d8754f8d571e341b3b1b31f
SHA512 bf2391054d7c4df8065ff29f7b77f7bb2a4f6bbe9b43105dce206e030c3ac04b818cb603312c2cfe1eb7a5771ba3e75f6a896debef482c3da44f633dd1e8ea15
SSDEEP 12288:gHZ1IyefW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:YZuBfW47yfqas+pPzbSedM08a0
TLSH
T13A55128A37E4A0FAE066A17CD9D08645D7B2BCD2177143CF10B1566D2F37AD24D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fa9dd074f9130cbb432443bfaaa2d0b9c01dfac0aed15de378e1718f458ffef1
MD5 6644f2f78c64bb49b26047eed2451a8f
SHA1 2a9bb393f4ad754c27b879bfa8450426338c0362
SHA512 6303ed229ca2233f14fb113c6ca5e3354cad4bc3387ced12e1b56960e7f33cbc829310a477cb93401e46f0a9f3124e2dd53ff84e0ba3a61a1ca82aaa87731dce
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ue:2QRQyi36YOcPQLvw2gAf+PN3aratm
TLSH
T13D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 643156d2ac34c788b1a443b7a6a4c08f22f382e2e62b720685bae63855d93a50
MD5 173f1bde16544841b48916ebfb230e87
SHA1 18455cbb81b1340372cd68f9632d8050a9d1cc12
SHA512 6d9c7ddc4850577455080591d257e966e939aaff85571d2f28f84c1cdf9dc41541784f1bbae8f8c674c28021e1e477d4fce9b2e805f2227e74371579aa393546
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ue:ZQRQyi36YOcPQLvw2gAf+PN3aratm
TLSH
T1F5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 992dc409735915f9068c6100c7496f342b96eebac02bcaafda48cd746a80f919
MD5 b5654fab46dfd16f8b45c25fbb743dbb
SHA1 f3c439c0f1cb14dfcfbfb5c443fe3a3703e4d76b
SHA512 284ac219ca1f235e8ce6bd281bf6cac5ae118063d9c8c5c8134c54f4e70ca1b6f40672e7d4543ad9b1e154cd01325d493238f0ae5a61a1f548d68a4e09885401
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xfW47yfqas+pPzq:N68Qg55nhheWu7PNU3/gW4aqaJvm
TLSH
T13BB55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 effb1601eef7e4da32a2240f0783121e0d7b568c5e33196543e5a3414c4cfd5c
MD5 93d910bd5b6288128e8a78478206a78f
SHA1 8911966c83d538814eece5f51ed1fe670ae36f08
SHA512 e96082bde3bb1595f7570627325b759cc3ac40b8d95e80c17e8bd3f5e3985a0b80d75b9953991c64d8ca34c3dabd1486e603de75bcd234d198fb68b31c6e8464
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:Ty5112gYy5azzVvL69nLKnhZlratm
TLSH
T1DA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 658d3edcdb4251ecbebdd9b1cf79b93a0520e7e25897765498981a5d59ee96ed
MD5 2336d36f491f330717306ee19caec2e7
SHA1 bf1243ee1c3a6586f7c9de2b47023e6324f2028e
SHA512 dc10c3f940832fa71ef89e55d8ce641da30b776af44ce0671e5a3dbe74d39b3b2d8b5cc9613485fe2852fa9291b9331b295f85e2fd7295a768a1ffc5a3fd2cbc
SSDEEP 49152:WB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4W4aqaJvm:ku6JmVxd2dcratm
TLSH
T1E6D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 daa3fe96855efddbf170515b995a1a14f332b55a1cb5d8200e1bb7d4dbc143fd
MD5 e2980830f677a240dabaa2a3e11fe5de
SHA1 b9111cb53c720550013562b564ecc33df9cffdd9
SHA512 9e66f64f5b9ed59b6d634c2a542c92a0952cce8762161d635d13fbd061a0d5fb7c272462c716b9d9eba1aa21ea27a39e0641c236754a8d8b3b5ba26da16a6896
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4xCW4aqaJvm:EmifPbRzratm
TLSH
T1D8B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0552e3e79eac1d0fc1181660f19a658b0b558e73e1b48e57143a363261c7cbda
MD5 36dc008ecae53b0bd3248febd7105de3
SHA1 de38591e9e2550078f686573bf53dd35c07684b0
SHA512 74c49f5e891b5fd33006358770f7f8a3c49421fbcee169dac3021fb202c2744dd75dcb4ceff6369540cbc0e7db319e53a36281050645f19a7ff91edfbfa0fdb6
SSDEEP 49152:PSuZQIY0Be2KRRVtOnks6NMHqhW4aqaJvm:15dKTi61pratm
TLSH
T1D6C5BF03F2E940E8E0BEE67487659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e50afb1990284eaa5f474058104d2bab7c4ea50273315a06f2ba0d52a5fd501a
MD5 53349f308a498e72cbd9360332a16207
SHA1 c6f3986c0a84ecf1279132cb9e3002cb829533a6
SHA512 5bf3f6453e3131e09bff036606b781f209841b06c7995be3f0599d655d47a04fd374a26a5abfe2b210576ec73ca225bdb88db4d25d963eff2787044764f47fc9
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5w2W4aqaJvm:iX2iyphvratm
TLSH
T18795BE13F2D900E8D06DD178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ea294b699178dc918354f974c1fe19b2bfd227b57774b36b87a0326f7814758c
MD5 93d0f9c8a6d40c73f0ce11403390c29d
SHA1 b75314f458c4f7d5ed137bc52f7e2dd3ce3b3e0b
SHA512 24ac5676c3d4331f3a3ea251e586c957667b4fd7888dfa3a9e48da8937fc6081a6340d635d60369ddf871f5d4c6e83a101a76c4488db65aaf902f2d96b9441f5
SSDEEP 12288:i9fW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:i9fW47yfqas+pPzbSedM08a0
TLSH
T1A545238A2EF5CC7FE434F4B5A580D6C5D9A8ECD60AD1286F30F6781C237D562450BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 43f37bde004c13323386d769570a8c1870be094f1bb7b42d94988067116a9c41
MD5 263504d510eae59141d5105773218e20
SHA1 876111d515c1f99a5c2b9e617f06f13c6c43488b
SHA512 8168fce11eec123e2565806f5c1eb8499777ba8c949cb5823f61029297fa2cd6631fe5e676505b26ed183d524a871dfd3573e3be69c8989b6751970c287db9bd
SSDEEP 12288:8qfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:8qfW47yfqas+pPzbSedM08a0
TLSH
T19A45238A2EF5CC7FE434F4B5A580D6C5D9A8FCD20A91686F30F6781C237D562490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8ddbdf12b3829fb7827a275bf91c3f04f15e690662f8416d370d53abd0037a27
MD5 0801c6de81ccb9e62738899a5ce29d3d
SHA1 e1cdd7a6d93ba4b07d631ce7a46e17b8e189ee5b
SHA512 0534bfe5e31e0034a9002df61a489b265c8a9619350973cb518adf0a611381e40a576ed860f2f29b3eb600c0679b4c5faba823c94a372f4499cd1d8b90649c64
SSDEEP 12288:jQfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:jQfW47yfqas+pPzbSedM08a0
TLSH
T1A245238A2EF5CC7FE434F4B5A580D6C5D9A8ECC60AD1686F30F6781C237D562450BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b514cec081687078fcaa6b493e135d889f75fea982c1e83ca0eceacacd0f717e
MD5 55986cd4cde7dc633db079a2c7d87a71
SHA1 2c84c4dd9203bc8f1b6023c3543e949bfeebf95e
SHA512 2bdc114962b27a106516ac79b1f6e700866025b6f17bd78efc5ca86ea4192419050b413d76d6c6c77cebc2d38490b3375f6b907ddfafd5bdea1b2cffbdd07c95
SSDEEP 12288:pVDfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:XfW47yfqas+pPzbSedM08a0
TLSH
T15C4523862BF9C4EFE834F178D580D285E6F5FCD10B7169AF60B1281D17792A14D2AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 be298eac61937064dde45e7490a4bb646c8337f520dcabde2aac235c5edfd203
MD5 915a69c6ea951a9f621dbd9bc9e98013
SHA1 2cf84f6efdec2a202c3787d97b99e31b1b3ea592
SHA512 e5eb8ce3cfe3644359e8edefc8d6bd115bc6f62d07ffe0dc1d2a689e2ba4740f7744590e0d558cafccc66102f44345faa1447e9244036c1d7e2ee4e2cf74e8bc
SSDEEP 12288:ArfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:ArfW47yfqas+pPzbSedM08a0
TLSH
T13445238A2EF5C87FE434F4B5A580D6C5D8A8FCD60AD1686F30F6781C237D562490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cdfbff21fd0fa90d5bb7dfb8ba1de9080fa7eb07d6217d7534fff7696ec24cf3
MD5 39edbb68e164c7fe5af82474fb3393da
SHA1 5fd1b170822f1ebe3a6195543f8a5044f588fb39
SHA512 8ae81fd4dd43577b7ef16f7613bbd74fd979793e77b5f7233112616dd97c68d614cfd461521d1268fbfc7925fa040d73f0b3ce4b7ec7913a6fc27fafb0175e99
SSDEEP 12288:HGfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:HGfW47yfqas+pPzbSedM08a0
TLSH
T14E45238A2EF5CC7FE434F475A580D2C9D9A8ECD60AD1686F30F6781C237D562490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ef6736ee64cb31e6de2476bcaf690b09a88553050fb85240009c117258757e12
MD5 72083641c290b7bab9528d31d26bc2cf
SHA1 614bd03ceeb1263a42725aa8c5c0a14d9813b270
SHA512 62025a5bcb52fb0a629965d242c0a425f9f82f1e04771edbfc52c85c7e8bd4494cf9b842cdf13d3e55e73103d258acbd39a569b33a900fb036c6868714760662
SSDEEP 12288:ESfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:ESfW47yfqas+pPzbSedM08a0
TLSH
T11145238A2EF5CC7FE434F4B5A580D6C4D9A8ECD60AD1686F30F6B81C237D562450BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bec5d07056faf1a4e37a29efcd4b71d98ad34b2076507fcffb47e2e6c760b8fa
MD5 01ed5bb46e3fae27c3eeaae3ef1dc9b5
SHA1 b0596b591560ea46d8b2f10bfc619a1af794e32d
SHA512 98ed1508a38a4b26aa04eff08a2ec0895eab7d96c200acaf3664ef571c71b6e97c4e9385e257354042be6b71202cf782a9b93323be4c5b667d66fce4180aac5c
SSDEEP 24576:cZMozFVSOKfW47yfqas+pPzbSedM08a0:cZMozfIW4aqaJvm
TLSH
T1E865019573A05CF9EC67813EC9518946D6B2BC9A0B60C61F13F4362A1F373A10C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f97257e0fa5d1e1d0a468b8df80b465c71fb5afffd4ca7d4adf45b8a82526fcc
MD5 e676fdfa9df67b82bae651b88ddcc9b2
SHA1 8d9046c8fa07c4e6b4f47189944a08c0746cd10e
SHA512 b07ac702ba4f6c90a7a072acf31b6e8c82cb386e589a22768c5764847c5188af7c824ed3b424f587ee90e95b2928ccb49187e92855a3a0a477eadf4244efec6a
SSDEEP 12288:bRfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:bRfW47yfqas+pPzbSedM08a0
TLSH
T10145238A2EF5CC7FE434F475A580D6C8D9A8ECD60AD1686F30F6781C237D462490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7fe60c63fed1380aa9f19ceea339c5b8477817039eece53dfcdc0f02953b0888
MD5 108b5b43882b05d229e05497327e4cdb
SHA1 1e301e81e223556ae9820fa9aeff236616583a32
SHA512 d4a43634b0cde44504bddf9c3e15e34ad664a3b5dd01d0aba23340465a40c892f53356e4ac8297db3b2e07100ef267b16908a1f97fc0c66c486706db7908d757
SSDEEP 12288:k1fW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:k1fW47yfqas+pPzbSedM08a0
TLSH
T12C45238B2EF5CC7FE434F475A580D6C4D9A8ECD60A91686F30F6781C237D562490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f6cdecb6869e1da8ebea7afb6850a5551645068f101f75dd3d3ab3a703bd2e0d
MD5 9fcaf27b30795af6a506a45556d7cdd8
SHA1 cfbf212e9ffa9e1ed5a97f68a9b1ab3f3ba579ad
SHA512 fcabee2a4ae979369da1dd72cd29c6d99dd02f91e8087ebdfac455a6064aea00e702acce9f3f11018b5d898d98bbd0397650d79a283258927bc74fa62c64fd2f
SSDEEP 12288:aqyPz5L8efW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:ozyefW47yfqas+pPzbSedM08a0
TLSH
T1A255024737E170FED0369138C8915A41F7B5BCB207609AAF12A0567A2F376A19D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 883933b0b65c847b1b564730b12e1161527dbb9160c3c5c3a8ce8a20b97cbeea
MD5 bc354aa772708649c311d60dec047e72
SHA1 0cbf0bf95c8e4cc3efe70d6e24e04a2815617f11
SHA512 68ce33dfe5cd65ff2f9e26080ae954612235da34a518363d3a48046e44d3614a80c03ee06148572abde168bde84e4d0565ca3284e558bb31848d1159fdfdb569
SSDEEP 12288:3RfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:3RfW47yfqas+pPzbSedM08a0
TLSH
T17245238A2EF5C87FE434F4B5A580D6C5D9A8ECD60AD1686F30F6781C237D462490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 15b7ed59d15c064c5c9632d9737f0cfb7462106085cd1df7a54a41034da31cc0
MD5 83a46a193a0588037057e55a19340ce6
SHA1 a998eaf3db8a981920d0a48951401b8f114d5078
SHA512 a17cc410d44aaf0b0160dc60069a1eb13b64cee50122f568a017447e0119e03f595a2dd9d6791e3f1cfb797746780966532495c30575297b55a2007f918c6af6
SSDEEP 12288:6RfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:6RfW47yfqas+pPzbSedM08a0
TLSH
T1FB45238A2EF5C87FE434F4B5A580D6C9D9A8FCD60AD1686F30F6781C237D462450BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0bb292e25bf8ffbe09c172b6d9aa104b0f76198ca112f16803b9af64243fd304
MD5 87166f4999e3bc45a643281fa1c2bb17
SHA1 1fd6f3a957aa1f1e7facc39cd92fbe4ea5afeb81
SHA512 24cacad6be702cd248649c8a55653d83ad9a010dd82b636f9a76f47b162aacfd53a187ec91f75528dcc631d95c9e2743515b414d512c30b3e9dd66119ef6ed7b
SSDEEP 12288:NyPz5L8efW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:kzyefW47yfqas+pPzbSedM08a0
TLSH
T14555024737E170FED0369138C8915A41F7B5BCB207609AAF12A0567A2F376A15D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d507cd14a53ea70586ccc04817838ec13b77a2a34f9370547787d487680c478a
MD5 5e4243bba17951d4e28a3301dd0e8eca
SHA1 7541706ac4f351c1900a92c79fecb5dfc9114ae4
SHA512 466693d58f99357dc5b4be1d8a4d8bafb865de86088d26c498e045ef8aedcc8ae85d605bf91f88a7571a4e21852e704d25c3abe8ada4e1eed78754eeb50e632f
SSDEEP 24576:xTZaLl3z0zDAfW47yfqas+pPzbSedM08a0:xTELljHW4aqaJvm
TLSH
T1D565019573A05CF9EC67813EC9518946D6B2BC9A0B60CA1F13F4362A5F373A10C2EF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 fdc5aaaaeb87db03b24aac45d28e671ccde639ce3d1a9fbf9cadacca99b0d751
MD5 f115d67f7896305cfe2fb46c356e140c
SHA1 98df85a6709dcabff0f74c8d9bd30dd4e15d1b4e
SHA512 80db94e1e94dd3e0d018b1b121467c4ed4670fd6e9670a11c19c6652af19ee8a792543adcfe48059b4540dda4c72585c3c896de062b1fc321ba820b4962f8fdf
SSDEEP 24576:P3ld9CHKy7GZcfW47yfqas+pPzbSedM08a0:fld9CHKyaIW4aqaJvm
TLSH
T15875CF90F3E414E9F0B7DA35C9628511DAB67C9A1B71DE8F03A4261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9dd4fe1c5c3ec22fc79a7104c21ff16825fe8efeb0673f06f533b15139e7dac3
MD5 aacd6fdb93837c7ea254ff3f65834602
SHA1 9fc3c7791e4b4504029f2f7c223ab72681e5d1c5
SHA512 402f09d3bb6034848df3565905886e5e3903122b816f28485d6db3e2390d18bdebbdba210dd86598edc94f1572bef8bbc346c767a971992fb9752c978b4b6a6c
SSDEEP 12288:GwfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:GwfW47yfqas+pPzbSedM08a0
TLSH
T17045238A2EF5CC7FE434F4B5A580D6C5D9A8ECD60AD1686F30F6781C237D462490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f775f7e21bbf662cd777a38238530814c1b6c308fb420118140daf32cf437b7b
MD5 80374c63bcdcfe46c4a8e41d8fec43e9
SHA1 fdd56b5dcd18f198b6fecbcb448cc59b65c55e0b
SHA512 ac91fba1469dae53a859301f9deea738ab6ac4104e33848ea60ae3aea1bb85273ece655d6d60744cc0d5e0046d5823825fae69b06d0c46821754aaa323a5e0e5
SSDEEP 12288:4+fW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:4+fW47yfqas+pPzbSedM08a0
TLSH
T14245238A2EF5CC7FE438F4B56580D6C5D9A8FCD20A91686F30F6781D237D462490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 df2f64c928cea159339675aeb0eb068c2b4565c7e4d8edf5dd3d5dcb8f144e29
MD5 54674786b1781cad797de2637779207b
SHA1 d189504871149a81a5e667791da05b0439b508a0
SHA512 b07ce45cc990303d53379c5aebb2059f07f01bccb923346e5a99a78530a816011b6c4d1748b0ab5b5438a68517f4e70b1f7a5429ffabc6e5ccfdf3d63ad1762a
SSDEEP 12288:LnfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:LnfW47yfqas+pPzbSedM08a0
TLSH
T10845238A2EF5CC7FE434F475A680D6C9D9A8ECD60AD1686F30F6781C237D462450BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b8d0f50cff1620d0305616fb6f86d80bbcb71104ab867c5424419c8d6212ca96
MD5 40ba4c9527c4415b9222d10e9c8e3aa2
SHA1 d2c46800e7ee19a61039446f6d995a7b7bc520c3
SHA512 882e7560d3c18007ae2a1d1c3b8f5b921ad7323573e2dc3c092ed309515743ee00baab8a0b9aaa5badef3996d6ad0d454d39c1adc73d51969f3016bc852b3747
SSDEEP 12288:WRfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:WRfW47yfqas+pPzbSedM08a0
TLSH
T1DF45238A2EF5CC7FE434F4B5A580D6C9D9A8ECD60AD1686F30F6781C237D462450BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f049655b6ceb226bbd5bc8fe8009bb1bbdfa8f1535c8d46cbcccf5bafad31e96
MD5 a3ef75cea64558beae5546937afd89f1
SHA1 c192f1fa39a948891935b709fe29716f36f94a36
SHA512 b7812a253337509b62a8c1f8e909dab7261c179e6fc4798aa30325edb55456d9227719ab94725238101c5a20f86f5f2295fa0e4525bb034dd241d5b1c38b3ebf
SSDEEP 12288:ywfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:ywfW47yfqas+pPzbSedM08a0
TLSH
T1F945238A2EF5CC7FE434F4B5A580D6C5D9A8ECD60AD1686F30F6781C237D462490BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8d21f97a80988118a596dacaa1b2fb814201d74249f426b524dd9cabd6a0bd67
MD5 7fb0b377054bd928768012ade1eb3a10
SHA1 5e43883a7747a60c802ce999f9c7350af7f5eb1d
SHA512 bf8d3e01fc928c1a28db503566fccc5943ad99485fe7aad1d7cc91a67f2ffa59f5c296985759b48bcab67ac3002902076a0fd1f83c69de639d1c361b67a73d04
SSDEEP 12288:n5fW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:n5fW47yfqas+pPzbSedM08a0
TLSH
T1BF45238A2EF5CC7FE434F4B5A680D6C5D8A8ECD60AD1686F30F6781C237D462440BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5f3f1d0c5fb4ae8930dd2c314029e20d9953263606714203a851e96e3e690147
MD5 32fcfc99cdd578cad0094ef9aaa49f49
SHA1 afc8013df0e15bb2ecf42cb10643016448b1d9db
SHA512 306b67afa8fc5ed689d354c0310f06801bf37e939ce44e15a1203526a8ed0bc3446fbbf54e84306984a94470cb7190dd60c59f501cabc6c0553a0ed5ef13f66e
SSDEEP 24576:Qfwv6k9RX6wkyAIvfW47yfqas+pPzbSedM08a0:KMnYI3W4aqaJvm
TLSH
T10285D029EBDC44E6E077D13C99A3860AF6B178590B31C6CF12AA536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f9a9271163fa69395b571a453bd13141ac6566cc995f41e2b86056cce9209b5d
MD5 856f87f9d7d78d54e54ff74b3cca2392
SHA1 2dcf133be3324f2bc2a36ff59ca75c08e4fdb738
SHA512 7b1bd4cfa32b8833410f53f9eafbccac5fe60f3b9b0647873dfc84539a05a30109a77f8ed3edb1cde6d6545a1eba7c2d655211804f527985760c0a1509a8d22d
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WW4aqaJvm:yySzP6ratm
TLSH
T185066C56A1A841D5C1B9C1B98F0BCC1BFBB134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bbbc3c5c67b9f0d7a67a92b93ab52b5298d4cf8a92e9776f2772f49da222cabe
MD5 d4a3703fef336d510f037ce2ca85306c
SHA1 d7969471023eea930181524cab687c505a5766dc
SHA512 95786b0736a329782b1d175f4777f24489e62f151ab142c7f4bb82829b02199346904f0c0a97c468384ac6e29ba10eeda43f3e2635c9364b78b4436821ebc8a1
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYafW47yfqas+pPzbSedM08a0:D47JUQj1irIhCnDHUPfF/GW4aqaJvm
TLSH
T10D65AE1EA3EC01E5E17A927885158A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 da115162d37704f990adec6de1736e07a37b2f96e17c9b99ac653daa2868b82b
MD5 2ddd2bdaaae1c180dab1a4ba0f1f4bbd
SHA1 f4b1e50dab9d1187f5afe88d9e6f4b7112b0b25c
SHA512 ad63b22f4c3132b4fd80c563b45b70d190e17e51c33be1e2a321399618c97cc09bc7a16f168ffebddce1de5bc9bb325c96d39d6cc72adbbf71d392202951c388
SSDEEP 12288:sHsfBfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:vBfW47yfqas+pPzbSedM08a0
TLSH
T1B655014AD2A841E9C06EA179C7418681F3737CA547E1D3CB22E0F53E1F7A6905DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 93cf2cdda64c2741f36574d66407e25799136c6237b9e79521f6bddae3f8d211
MD5 17bc4fbfbe7478b6c43caef9b06ebb07
SHA1 d1fa5362692ff9f3fd165f5d270eefd509d669a8
SHA512 adc9cc5323d81b7d9553cb437b57e815e1849c403f4d8aed425ff2bb58094e0c2acf8732516dc1a8dcef5452d963d4e9d6b29e80a51a31b44585dc89193c7205
SSDEEP 24576:DUfeaUPrVwiNSMHYBTArtf1yVqm16WWkr7Fqf:vaU2x8JfcV716WWkr7K
TLSH
T1AB4517017626CB8FC56940365E76C6CCAB707C06FE44AF0773C9873F9476A59B6B2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 4cdb8726e2ff7ce4ec8262aaa6367dd80d787ea4c9652c824b1303f3f3b1d380
MD5 a20f0d3cdfeba9aad82fa034db6cd71b
SHA1 7ca02efde402d4f140ed0bdbf91f6333ce30d2af
SHA512 0974be5f0a2caa6321bb2570c5cdea2f14d4719694cc082a89aabd608458bde2b95d8a4e7496b35806bb07ed09bda5f15b7ff23382db97b127e4b6302a727803
SSDEEP 3:OlH/l/y9XIOu/mwn09iSttBl3yjIl/lllo3mCllltGlslslslslslsl6EslX:KgXzu/mwnEiStZOIXymCtEEEEEEEu
TLSH
T14F8192A40B001A32CAE391311469A3194322F208A0C8A7BB214659624D806C90C53B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 ff06c110bb91e68c1dff328f32a695e059503421a3e013f592e786e6f6636843
MD5 1ec5c7c1f47103020fc43580bd16d48e
SHA1 251699b8b26b6bb313f62914e92d2401d4f5167f
SHA512 0f9b046f3257a510288a8dbfa1e8bdb5938d3c635373994a741cb3068e508410158bd0778ed8152db2184b7a2732d88004d26172f4a5f2adab9a558a92ac08ef
SSDEEP 24576:Ppqi5e4mLPZ9zv8to6P2VXFVEJ99GZFCua9N8gzASXQcRrpp:0rZ9zv8u6qC7H8gRr
TLSH
T132653A0165B7E70FC9BA4037423286CEBB786C07B7493F05738589389867A5EB5E27D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 17e4334cd296ea85454f4fb793a69528efd2d0a6b618c4b0665d5ea7fa4f765d
MD5 547030b77b9baef62c4f0d2a42b80bc7
SHA1 e6a636df47a6b553cfcd8aa8634f875dc959e143
SHA512 5bae017c25e992ce8dc77b9863adb0d993eb52a4e1b937f26c63cbdcab16a481937b219377100a3fa28de28a346ddcc32d2bad78a1a31cfc939b3dca9b147af6
SSDEEP 12288:W57jfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:GjfW47yfqas+pPzbSedM08a0
TLSH
T1814523861BE9CC2FF838F5B46584C294E569FCD10F80A8EB70A2791D22795D18D3AF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8d383592476d5c435e047af3ad27daae7dd379193bcc684d98124903b4638fa6
MD5 ad537b03549da2faac6b70f9cb7f90a9
SHA1 698fb224ca2e0d185e2f06e180df75cf1ac50ec7
SHA512 a3e2dcecb9725a7961cc4af6650742644b9478fc7adfc26dd9772d48df66b21b7fabc960a1f05eb2febc536934f611e015fe40d4bb060e64076628472877f3ea
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYffW47yfqas+pPzbSedM08a0:4gb4mBIBhGFUW4aqaJvm
TLSH
T164659E1E22EC02F5E0F9E2B8DDAA4417D6B278160731D6DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 67194dffa38828c2892ad2b32c4060599332ae69e4342298171c62c7e73753af
MD5 22c7182bf2ad21fe0559da0aa3f2341a
SHA1 4c8275737a2a17716095f095083e87a98b06b98e
SHA512 4c042ca99409a425b1031f93758087825eb8f12abedf087984766c14e2cda75a8561e2e73fb00dae77499b1492a5045a6725097bfe958dfabf83fe34a90c697a
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmafW47yfqas+pPzbSedM08a0:H8MwBtOmUW4aqaJvm
TLSH
T17755AF6EBAF845E4D1FEC6B4CD238512E6727861073292CF5290C13E1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 799c55a55a66d6d6d2e5f85ceb5c670d3d9f34c210431d62888e346311a36a3e
MD5 1e13b1768fa1e1bd23baba6e2c436c3d
SHA1 ad38d562a88a702de934d747fddce6013de0bfeb
SHA512 bb59028df5bd087a244af38eb330e9bab9b794163890a30ed49dea3bc3e31d8da70a8eafd276dc09afc5f41778249f107634ead102306221e7cd0c47bea932a6
SSDEEP 24576:5G88u8FpJqH1dzria7/mwfW47yfqas+pPzbSedM08a0:s7ZFPqVEa7/NW4aqaJvm
TLSH
T10785F16577E101F5D47BD13889828663F6B2B8250360EFDF06A88A551F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c4e9a213980c149dbe925e4e509262bf6dffaca5a83026563013e1777ca0a374
MD5 710488a85508cc102024fd7509141188
SHA1 daa5384b40ac129b1e3d41035002efd2cc375eae
SHA512 3ae77399720881c21dfad6ce15fc24218e7ea438039f11964d76528bd89320893081b89375610c754ae135b4a8c3c82923de74e7fd1693b9a9ea3457e3a5a135
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeW4aqaJvm:hG05lO43b/ratm
TLSH
T18DD5BF6A62EC11F9D0BBD17CDAC6860BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6c0b2feccd1fac3e7d5abb81d86adfb6520a0f3e565d313c46ec6e7547e5235e
MD5 8d1de5ca5a093ed51c72d15af65b0e4f
SHA1 a16bafdc4a2d07e016e0e78b1d272fbbfed1b4e8
SHA512 06a610276ee330f541164efed54ef2e5d292696faf290ed6aa04ee82b61765f39941ff7e62c1a84ddc801f42912f8c3295bc88357947a94caaf7bb44af3d93e9
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnEfW47yfqas+pPzbSedM08a0:la5POZ3+Jt2pasx2+mgW4aqaJvm
TLSH
T1A765AF5EA7FC00D5D579D17DC583861AE5B1346213329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a011894c3b5fe037452ed08783a4d733870ed78cbebb8e839995f891dd8e56b1
MD5 ea0ac339a8130d656fb85acfb45de638
SHA1 f8298aa43fb96471b9d5763bf3a942cff59efbd3
SHA512 eaba800d3e111d4f0d59267d2a0489b9faf9f61c17cb19bd1d3ab45793df56d0c8776f950133424965ea0334748569d77f047808aef1f26ba10a36b5050b6f61
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkYfW47yfqas+pPzbSedM08a0:eNc/zEOVHFtW4aqaJvm
TLSH
T1F5858B1623E901E4F5BBE1BE89679546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 4ea30001c75d06c1dd3dbe3851654a866026d84766491d3683ddfd14a6bd0a87
MD5 195f807166e01db361fe8aa26b9b981e
SHA1 c5d2eef53945c98de5e5c76efb9c96e9d46eb6a4
SHA512 6fdc301ee2c00c2cc6ca72728ea81cee28f6231fa7ebc9e384bdb16479350b0c0717759df7252d11cca7c1f44e635d36e5cd947a185020643408da85069aca9a
SSDEEP 24576:86DIKQJJvvIZ3YJHzNxBEgPLlpxUAMAcfjSpXRN:86DI/JXHhx3e1LMhN
TLSH
T14625121C637A10B5E16BE13E95838562D2B2F0B1976256DF07A4C47E1EA3EDCB83CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b18081d31d2b498cb7a9db29b2b35b0db329ed2dd91b5a6d6575be5fad7630c1
MD5 88bf87186d58f1df7f3b6b2476e3bf24
SHA1 3efc2011c9bf95f01cc699a92680b97f66652dc5
SHA512 ef3f19c9ff174ffec2dc0044e5143bb97bfc98c77c3605eb8e63af458198bd397bbeb201e2f61b21c6b15ca432625107ed308355005e880281d0d813d5a789f8
SSDEEP 12288:tHvUrBFrEjwaQsfW4qKRGFnUJQhifaRab+p9xn1bVbnegSedvW1EEoJ8apaL:tPUr+NQsfW47yfqas+pPzbSedM08a0
TLSH
T19665E11F26E91CE9E676E17D85828709F771B8A2071192CF01E1817E1B77DE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4bef2cf6f722c81be4dee296a7707eac0735df74cd5d6744d733776f11ab1530
MD5 6fe8ba6fb5ee0e358c08bd753cf4644c
SHA1 cd54bc6684653580bf0202b9ce6e59ef7f5d1b29
SHA512 df596eeb8070bb106a7664b8a2904c5fe8dfa5ed7592e84a9c43e8ed2e89ee0e75d49ea0795821fe7dd0927d4c497e3f3bc1592b1b982f289222028091a96a73
SSDEEP 24576:uD3FHshBIYQgAXfW47yfqas+pPzbSedM08a0:uDVHeBIAAvW4aqaJvm
TLSH
T14F75E17EEBAC04E5E47AD1BCD6538A06E77138E9032165CB11D081B91F6BEE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-147-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/764-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/764-146-0x0000000140000000-0x00000001404D3000-memory.dmp

Download

memory/764-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/764-137-0x0000000003920000-0x0000000003980000-memory.dmp

Download

memory/764-135-0x0000000003920000-0x0000000003980000-memory.dmp

Download

memory/764-129-0x0000000003920000-0x0000000003980000-memory.dmp

Download

memory/764-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/764-0-0x0000000140000000-0x00000001404D3000-memory.dmp

Download

memory/764-18-0x00000000029C0000-0x0000000002A43000-memory.dmp

Download

memory/764-71-0x0000000140000000-0x00000001404D3000-memory.dmp

Download

memory/764-148-0x00000000029C0000-0x0000000002A43000-memory.dmp

Download

memory/764-10-0x00000000029C0000-0x0000000002A43000-memory.dmp

Download

memory/932-177-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/932-175-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/932-167-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/932-166-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/932-173-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/1296-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1296-54-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1296-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1296-77-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1296-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1296-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1508-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1508-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1508-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1508-165-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1580-67-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1580-61-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1580-60-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/1580-320-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/2012-23-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2012-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2012-31-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2012-30-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2012-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3096-78-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3096-72-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3096-347-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3096-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3260-349-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3260-95-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3260-101-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/3260-96-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/3440-354-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3440-355-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3440-125-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3440-119-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3440-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3440-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3872-106-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3872-113-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3872-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3872-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3872-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3872-370-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4620-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4620-357-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4620-356-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/4620-183-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4620-189-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5912-162-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5912-352-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/5912-154-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/5912-156-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download