868e831b43826ca8d23cb0f3b32c5961c9e87f5e2ac8de4efe9727ac35a196ef

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
Size 3.1MB
Sample261027-efv66ax16k
SHA256 868e831b43826ca8d23cb0f3b32c5961c9e87f5e2ac8de4efe9727ac35a196ef
MD5 e7633f675119a0c3acf68681c9ddf6dc
SHA1 7039eb2cd981efcc9fccfc9bff2c39f1bdd665e6
SHA512 99e63cdacc1aded1040a81e149f982f1cca22347c6a2d4a7da85cd51a6d539acf731dfa6a7fafe57211cd278293af331829bc6d52fa465ade8776a371105f248
SSDEEP 24576:JmmBoHjto1GFxlXutIs1WZX5ARS1pgZ6SdCJn1tuXsbvpWLKoAaLXmoHjto1GFxg:omaT/M+w4pg7dCDt4cYLKoHL3T/M+w
TLSH
T1A1E5E1616A051EFCEBF0B674EBCE536553A52EA2013744CF13D03F8A3937952BEAA051
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3240	elevation_service.exe
256	elevation_service.exe
5976	maintenanceservice.exe
5624	OSE.EXE
1260	PerceptionSimulationService.exe
4412	perfhost.exe
1912	ReFsDedupSvc.exe
3228	SensorDataService.exe
3520	ssh-agent.exe
2540	AgentService.exe
4348	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c039f917465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5600-0-0x0000000140000000-0x0000000140322000-memory.dmp	upx
behavioral2/memory/5600-86-0x0000000140000000-0x0000000140322000-memory.dmp	upx
behavioral2/memory/5600-253-0x0000000140000000-0x0000000140322000-memory.dmp	upx
behavioral2/files/0x00010000000093af-191.dat	upx
behavioral2/files/0x0001000000009337-190.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8e47dc7c665dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000452c16c8c665dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b4ba708c765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cd8d1c6c665dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5600	2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	2540	AgentService.exe
Token: 33	4348	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1912	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3240	elevation_service.exe
Token: SeDebugPrivilege	256	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1848	4348	SearchIndexer.exe	100
PID 4348 wrote to memory of 2456	4348	SearchIndexer.exe	101
PID 4348 wrote to memory of 544	4348	SearchIndexer.exe	102
PID 4348 wrote to memory of 3460	4348	SearchIndexer.exe	103
PID 4348 wrote to memory of 5028	4348	SearchIndexer.exe	105
PID 4348 wrote to memory of 5608	4348	SearchIndexer.exe	106
PID 4348 wrote to memory of 3364	4348	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5976

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3228

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4973f5e40603d23da977309bc5c7cc709a8554e12f71773d728e18aeaf18f130
MD5 defb1d05ab534772add9ddacd1cb4e28
SHA1 d078a52de4625dcee6ec7f78fb2ce042fba7a4e6
SHA512 43a513ee0e7ed0b96937c1542ba17a3f6eecc08a315d0c8fc2ac0142241d72b6b896bc831885420f31b872b34df5d9f558a27690a906192fd49595b6acc47768
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJT/M+w:t3q6HjBuw
TLSH
T1DAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c48337c4ee1a44944031b5a0ffc53ff23bc82f2a161695b83206840ecff3c493
MD5 1e98bfbd843fc79ff391233791115717
SHA1 4634a7ecd4bfd2f91c9e452f3d0750bac79fa010
SHA512 e1cc1385df7d13e1df2ed62417dd8098001db07126f68023f81f8b16a1ae39f16532b524610e2c88f1a50797ee6a854b4afcbaeb2df96e1de500f0f187ce6489
SSDEEP 24576:4XYfDtczAnoHjto1GFxlXutIs1WZX5AR:vtcbT/M+w
TLSH
T17A85F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 0a3b2632615760fc52ae72482726c23430986812e62e3824f78a3ca28e23fd38
MD5 9d485e93ec740ddc8e58f1c64da3ef20
SHA1 998647a26542dd8d12298a58d75a133d587e92cd
SHA512 f7ea7f6da46c8bf7328ac587aa80d927c79177cb55de90aea17912c6ae6038e29b19f89dcae1f5db70509f326bfa867e6d83ad3c0346978a590cdd274f362c99
SSDEEP 24576:X0Le5ji0hmxIrMwoHjto1GFxlXutIs1WZX5AR:XPji0AG+T/M+w
TLSH
T1DC959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f81cc2bdeaaa236fe0af9bc3c3393242056ff2cae3c183602b0ffe33798d859f
MD5 8dc6910f2471e48220e2311cc39a61ca
SHA1 ec8b18bfffe325765d37232dad0978d13d07b3b3
SHA512 0349eb4ca101e869b9a98056f1db74e19e1d1f8da55e993c6513190b12413f7bfa7fdde4dfee8fc203c64a144deac8ec9dacf226df9229a58fa488282c6ae5ee
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWE6q8wyuSoHjto1GFxlXutIs1WZX5AR:w/ezSC6vUzPvxHjyaT/M+w
TLSH
T18B756C25F5788323D0B2D0BAC5D7BA99FE7230465B3089CB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8234c073d1269a00c180a75a9b124eb39f39a4419bf5b0b40a8852d1acc7e9ed
MD5 ed808dbcc027f937bfa4d2e971da67f8
SHA1 6d6c90e8cee6f54c76c21509c6c64fc137958f00
SHA512 d529ab203f765fa31c50f7dd36683efc71db65cd5b8d5a3edcf26a04816e8f3f2acb02d03eb384554325a64c01e4e5a5bdeb084b16df81e1d8541e3bcf68913f
SSDEEP 24576:bVbqPb88hv/l+6joHjto1GFxlXutIs1WZX5AR:bVO88hXl+9T/M+w
TLSH
T16C559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9485d6f225fe1156c16a435d9856ee265d68f34adfd3589b6ae4cd0f62dd2ebc
MD5 780a5cb03275ed89c54fdcc132e70f2c
SHA1 546777467d072f4c8491d92c8255a097ab2e72a2
SHA512 58b98e2466c228cbd4630fc37e7fa131892b4e5543d8b7bc326d3d6962ce283d8bcb488b7a8ff4cf5ed4c2cceabfd9b775b3c78fab0f9fd5294892f93d9b91ca
SSDEEP 12288:YHWhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYuN:YHcoHjto1GFxlXutIs1WZX5ARXN
TLSH
T1C465236399F250D7F77A11B02DC77A61ECB7BB06084824BB8B50FE190E3D060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b6ad772a33b25ef5f7310429c303f61330d0b1ad3c84056fc89a39eda981cc79
MD5 77fd4a88d8830247154e02ec45c601f8
SHA1 03e341d6571a12181cb73250481e4cc9017c819e
SHA512 fcd9ecd61a2d00eb28a55799ec0fe8fd9316c199722dc68be0cec62ac824c168a0dc9a17162a9fd05cba7c45e563000a6850bb794a9076554ffa304ab552b9a2
SSDEEP 12288:seBNUbTVO86U1hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:sJIULoHjto1GFxlXutIs1WZX5AR
TLSH
T10D85CF3BEE38FCD2C27A5DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d1521d829392e17ba4e61dadcf3c91c095b834dcd6e5ffda005c69321a8176aa
MD5 44aab3f355e92a71dd952734f81542cf
SHA1 2964a431fe2865aa7e5d74cbbe33104dc74819fd
SHA512 96d1f7692be7fe3b999b8dd0021a4987fdb681432068ae08cdd322ceea91781545bcd0270e188d0bfb3c229cec122063fa1b14b33183fbfc033e66c8a0603cb1
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:CQvGAdlCEL8c/yRNw5Cnw
TLSH
T140266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 abb4b9ddd9153ec250601e232a1999510238d30c839925d64b05e84276137bee
MD5 1e09db70d92a0ff5edc6466ab2e2293a
SHA1 73c327c83a9006db74724d535dc1d7b8d951fc2e
SHA512 1d920d4c2e9a3efcaf429905439b575df6a056dd901683c1029cab3245e79e02a94f5e78d491dfe3f50aeafe5537c7b6605449d98dacb4925a584981e829584e
SSDEEP 24576:w7ewsAjdoHjto1GFxlXutIs1WZX5ARXN:SljOT/M+w
TLSH
T1AE85E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 39aba2e1905158e5a371e8085ecbc8ec40a3579fb3729a76f9d0a3864d3b953d
MD5 21ffdc36deb9bb39c1d30892da4deac1
SHA1 2f9aa59c878166429e0b644e7e653e546d548a42
SHA512 3578c1efdeabff4b881454b0853a271cefea94aadc7cec701265975ddac8407203e33d72f819d42f653d8eea8f6dc13651c5a3d4139527a7c1108f498622ee7b
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHp:yUEtQevvqc2W1cpV2EI32
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 29cf37744a703f102bcd6201378efd475d830d403a23272f1f430ddc1ec10305
MD5 42a83401dd200bc625a466b70106a2b3
SHA1 22897cc14f6483eddbb0f220522848387a1d3a88
SHA512 ff6cf185e184dea521c63f9f3befa5038281e8b65ce5bde13cb70606b7d7d799aa757006526c11a69bc938b8eb867a5a6e1854acf201db61043faa93dc53b0b8
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zuT/M+w:MoqtVjnmrw
TLSH
T127D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a970893d6dfb7087c507896f7580269a088ff122c36bd5cbf1a9f312860098c8
MD5 4722ee0f00064dd701d3590c65c0849e
SHA1 20b07fe33a47166745c9cfa11e26ac4bd135b8dd
SHA512 e8d9654c08d9cf8d059db47413e16e8b814c616094ab315dd0ae365f89050e2eb3b941e0fd4ba924cd7c0d22421b818333898a3bb3b26909c7ebea2344f1c442
SSDEEP 24576:AAhGLJIFoiwtA5l7S53soHjto1GFxlXutIs1WZX5AR:AAMyFoiq5VT/M+w
TLSH
T1FF35AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 bd9d60dcd103c12870be87fe508f123dbbe34884294f2c4ad3f40c12c38d1dba
MD5 dcf6173c859f686e54b3bddc6150e819
SHA1 9d87b3405c9cb14c5ca2d74321ead006cca2fe9a
SHA512 22d4f7871af32ac87fb966c2a5d983c78505c3233821e61445efd1858c190b5094ee81bc97b0b0743df8d2774cd3190f4a046d09f64b8591db201ffb856ea53a
SSDEEP 12288:amw5HEjsChNDBFgl0WDm+CAhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:zwuiOWhoHjto1GFxlXutIs1WZX5AR
TLSH
T17E85F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 7a80f8ba4c58fb41496396b1909bd44b4ed35669103d903b1cf4c5c958189df9
MD5 8b50142ca2757fc37479e82f9a2950e1
SHA1 a14da0ab38513270dadc25c0cfa61d03b5f91ac9
SHA512 39246d06ddcd93b663e120e23f21e2e7d9ce129400027e38f077cfdd170d87f63365f7fca6806ae00fc71e20a8330ac087e45ddb49f211f1db093339ab03edac
SSDEEP 12288:tTZ1IyhhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ZZuaoHjto1GFxlXutIs1WZX5AR
TLSH
T1AF75125626F020FAE2A752789DE36A55EBB3B013173503DF07608A2A0F375D16E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 36fd9d882b31b683d98cd4a3c375350ee179eb85bb3c77601b68591efcf2bf96
MD5 175c650d290b87ca46e971654aa2f5c6
SHA1 88bdd03d1546d942d3e9a9f69e34b2695fd4bce6
SHA512 be2f75cd303450023962bd292fabebe7de41493568b2f0c4b26ab1907559e9381d0d720606f4fc32ece7c263214a6969cc8c32deae5da22889799c07c075dc02
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:GQRQyi36YOcPQLvw2gAf+PN3ow
TLSH
T163667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2908834168e07a86264d1d5de0ca4a3bf5f9edcb83ea70817ae670c881524357
MD5 ab44ea3082088da5d3033de3867f4ef0
SHA1 3ad634d2da88d8eaf127ed1f64a315aab9625f14
SHA512 24095746e25440784328ab89bbfa6fce5b27c4847bc1f5a9cd7bb48de1d9149eb7261c5ab83db10273614e47bb84f1fe817e5827b0bdb6dcb140cf46c3df9406
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:rQRQyi36YOcPQLvw2gAf+PN3ow
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 577bbbf4b688815f48025cfffa395033223a4862510789aa96b5fee431d07959
MD5 632f2ac343c5c962d8d7b9390354d9e8
SHA1 ed448b0f496796706e20b38020d8e38cdc55cd6c
SHA512 90a848742121c0dc9dd161bd3e76dc7cddc6040b658c0f94efb441493882385f18118be8fa9a141cd57b20d85a97bea69938b101470ce512b83ee6ebe3cdc8e8
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0qoHjto1GFxlXutx:968Qg55nhheWu7PNU3/IT/M+w
TLSH
T107B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 553f4fdf149479394552cfd100df7c3949a589d0f88b9544fa7e4a5e6482cc7a
MD5 100d4ca5507dbe6d620d08b76c6d0a6c
SHA1 72689961cbadd08841effee3363c1ff66d133983
SHA512 58b9444a9d0d0bb561f023fdbab10b130132cf265acddc3a63502bd0ba5496f3243636172b1fc10ab993694f078c87941075bd24148ff12d4c657a434fddb87b
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:my5112gYy5azzVvL69nLKnhZzw
TLSH
T154167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1529ec9cec6c795a11b9d01097b0c04f6fc7a222cecd8c47f6d775e74e80a248
MD5 9e72beef0fe05bd93d0c4385ebfbed6d
SHA1 c23e18e9570f7c4ad1f7ce2a405e9490fcdda793
SHA512 2433f3ae3b38781ee034d7a94c4676e6e432f1610f05cffabced3e67ebc88a93b2f9108e6cbac88c026d4081b98fc7e68751d3de2dc3212c5b6ed618e2e15917
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glYT/M+w:bu6JmVxd2dSw
TLSH
T1CAD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 35ae184be8ddc547bb3d30eb94cb33c3946192a8630dd4e8be479b93abd3d3f9
MD5 ed20f54de81757e2a09be93c9257336b
SHA1 f6595b5ff8332e516942746e8324b667387b66a7
SHA512 77fb916f0b3c0356fee95c53bb5a58d9698310eb66904b31bfb55a3f67af1a4e841ecd9be2e2f11e94d0df415e319b2231b79811ae945574af792ce505c405a9
SSDEEP 24576:Fhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx35oHjto1GFxlXutx:P1hpsNoJpF1A6UU44CwH7R4xCT/M+w
TLSH
T1E5B5AE13F2D900E8D06DD17887569632EA72BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2d0ffd0608ba032f93648a04256cedb3f783a54e91bf5bcc2efe3854ec814e4d
MD5 de38efcfa5f9b70df10ffcc857fcff76
SHA1 267de623d6d12e364d811041dd74501584134f1e
SHA512 0e8b0e49524117ef7416bb699cd9ec32b8174e17c38d7a143667fec83124dbabf61ec3a953122e44b840e91d291a058fefebb29be932c4f758145719f827a4bc
SSDEEP 24576:j4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqaoHjto1z:tSuZQIY0Be2KRRVtOnks6NMHqTT/M+w
TLSH
T1D1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c8b02e46247fcddd9adf6388973d7161433a9ee79bf75c3242dbe1fd9057e1c8
MD5 3cdecf92d49a9e2d87f3e97959613871
SHA1 d55cd055f2984538de105bb3025d4e3c49b51af7
SHA512 fcb950d67f324c138e2762409e87494141e84d3ce816dd819adb88827755f243e6115a0b3124bdfa5626823181ca2ce9e14bbd87f7888672fb73efca307c89b2
SSDEEP 24576:YhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QL5oHjto1GFxlXutIs1Wg:YhtSn8EApI0figngiDn0AP5wWT/M+w
TLSH
T1AB95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 152a2a0383ddf889f5cbe8cb48d9498ca71ffbc0b34286ca18be6ee62866560f
MD5 fa423971d6f4050984f85209da0418ab
SHA1 26ebaa6b9c21fa31061f08d4be9047cc176b7f6d
SHA512 f0351b732ffd270340db1df8501c9202804b5649bbb84f4da890ec0e2b39e72c9087249ed998e44729aeae501260fb6d7f471a34dadbb8ac32b023db6664ea22
SSDEEP 12288:BUhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:BmoHjto1GFxlXutIs1WZX5AR
TLSH
T1C66523639CF340C7F62551B069C77AA5ECBBB307594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 e46a544dd2a98ca1e3c55d0e7e0168e1158f74d14b097e53531fb87668c24d83
MD5 485c50e48b6574ad9fc7b640b9e3a937
SHA1 98c3f7e09521790103810e82ce3a988eba37e24a
SHA512 816e19cb34b0734046a0e42d03179b4ed827cba37f5ffbc1359fd0f78834781080cf36ac4746de2f5e703807893ece581a2dcebd9c2bbe274e1156cd8a02b5be
SSDEEP 12288:uNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ujoHjto1GFxlXutIs1WZX5AR
TLSH
T16A652363ACF340D7E62551B029C77AA5ECBBB307194920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4102a9eb5e8eda8e0987c887efa751003deb3fc66fb8559c852e9d816eb7c2bd
MD5 5fc2eaa985f53d8affe0ce7315c807b4
SHA1 451a7f67a7dc20ec8f8e69ce4d3161cd5fce8e94
SHA512 a84d4b1e1f010332766de6efb31f255949a1de92d0fc6471af94dd74e09e5ddbe34255e9cca10b983021d954a1a843183bc6f824caa26aa7e4775f6fe9696df2
SSDEEP 12288:13hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:1RoHjto1GFxlXutIs1WZX5AR
TLSH
T1376523639CF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 320c1abe3c6931a7250c9778741c15fabb73e2ab73f29405727fa57ea75dc471
MD5 6c792ac6dc4968ca54f5d711e93dc337
SHA1 50e41ce646a1bbef99962bbdc78456c137f18180
SHA512 5c95a29e02ca7b2676e405536a7b9b0b6207784323058f0fd98ac5720ad6d8058a76d45b54d48184cda7d10519daea08829817f4f5813b4132df9326260a0cfd
SSDEEP 12288:dVmhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:0oHjto1GFxlXutIs1WZX5AR
TLSH
T1FD6523236DF200C7E53692B49DD36661ECBBB6465B2521FF8B009D190F391A0BE75BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4eaf07d348cf82ccc2f691b57be63156708401e8e685cc887ade9b2c9655a9e4
MD5 8edde7d63de5e30e8ec14fc3f514eb1c
SHA1 bf3530f0e4128e77ef34a03acbe1acbb44cd0a2b
SHA512 368abb0185b1f61c610f415000551451019b761afc16c41b43b585e838b6e89ef8fbb3dee150746829faaa69310a59c6a3fc960abe41bc68bf67116a94c46d66
SSDEEP 12288:7ehKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:7EoHjto1GFxlXutIs1WZX5AR
TLSH
T18E652363ACF340C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 97140328c66ef4ca9c9588f588c8d3005c2be46ba097f97e646d84e61e6b890d
MD5 b3b72c4a3108e3a7d8d0db8569855155
SHA1 84bc27f9ff3c449b6cff44cb9b5b1437c0bfc902
SHA512 b2a5b48efd2a21651446be10645eeb5555793d4bdab2e8d3c22415f91189a5c9a9a7e4c93af1b09b851ad93231064817d3fa4a0f1bac8e3b38114a35d5524648
SSDEEP 12288:rZhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:r/oHjto1GFxlXutIs1WZX5AR
TLSH
T17D652363ACF340D7E62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6da616d425d58f0ddda0da815cdd854073c8137ea35678ad78db33296ecc7820
MD5 eb105c0bd9cbadc47f6046af2478be93
SHA1 8b9910ce14b61a9c83fff701b51f586cdad5b2d9
SHA512 7e3330d08fee726a0610729ee4fdcfa19edc2d7a107c3813f63965a5c9efbd00f2c3ade66b6fad1f3b4b5ad452d9e8f550d45272c39eeb3f83effda0f7694834
SSDEEP 12288:cFhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:c7oHjto1GFxlXutIs1WZX5AR
TLSH
T12A6523639CF340C7E62551B02AC77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 0ec413af96373454c847e8e30c57fe35c6f935b23e6608cef7c0c04606588ce3
MD5 70213c6f857800c9c46e883f40651748
SHA1 466923f02f870d1b856415a5fa5af45c7cf80cf6
SHA512 523ad11ed2b3b08c5d82d0b4d6e5d57729acf3ac1a3c55a8545b5e1f3e4e978b7ac67bd1c1346ea7bed5cc84dc207f56e4dbb1e074de9e52d4eadbb01feaddcf
SSDEEP 24576:iZM0zFVSODoHjto1GFxlXutIs1WZX5AR:iZM0zfwT/M+w
TLSH
T1288502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0920aee7ecf517bce2c0e5727fddd1ea6b5eb572188c398ed4fd8b7f537c9b6e
MD5 6581e5bd52f7ae7dd415790921cb62e5
SHA1 3192c0227490e7a725ad0837bb3a16d05b10fff4
SHA512 444bd3e88ae48707f5b83e0e2d1b272385ca26bd1a1d5e2e7f92e5c54eb7be3b4d2250b5a10a83517df8a2e5e6fb0cb9a890bfb0aa1a0f1fafc4f2a51ef66988
SSDEEP 12288:g4hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:gKoHjto1GFxlXutIs1WZX5AR
TLSH
T12F652363ACF350C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c809bc3318d57d3daa3ca424430b063e09cbfd2ce13d350b65ef17f5d4bba130
MD5 df83b2aa4632002269c4af6ea6bbb22b
SHA1 517d08610378c684882ecb4aea314c8a40a88b56
SHA512 aad0c7c128b8806219183e9b511b4853732cbc285bc95c391dc7171996f0d9626aeed2bc81b63eefae2c34b91feee231034d968eac01a33aa15c141a59fbf39e
SSDEEP 12288:echKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:eOoHjto1GFxlXutIs1WZX5AR
TLSH
T1E5652363ACF340C7E62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a4cbd6c497437dec13a81d8158379086a31b1c014444081abefd3819d6b2592c
MD5 3ea3277343d2a7ea16a96c24a96076b2
SHA1 899cf13902ede608d3959700f845657b0c021ed3
SHA512 f7d13d9d3a68e7e3c7f3b341bf6aac8b5689565a755b80a9c3062b4174152ffa11703c700e7003ac5d5edc6d8b275de48867a167c8844e05b2bf4e87b4b8e12c
SSDEEP 12288:ayPz5L8hhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:HzynoHjto1GFxlXutIs1WZX5AR
TLSH
T10575021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 85d9075195b62b6e2eb16a2b0be013a621fc8dd70d696c891df2cea432080f90
MD5 8de4cc3824120018505c4e2d5acc063f
SHA1 309c6ca2115b34befd7745a0caecdd8561805513
SHA512 e338f68d93c56b998d079fba88efd9dd9e07d1d42ba2555ad3300e063b5f77e9ed19412d9c37a613656e4d0c9602f9c8ec383cb5110244cd0f810e01be8a02b6
SSDEEP 12288:l74hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:l7KoHjto1GFxlXutIs1WZX5AR
TLSH
T1D9652363ACF350C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 efd2f1bcff122b6cae59bc6ea700f6c4cc8081642d2a77decc92b40c3605e849
MD5 6aa03c0cd46fb85ee9f2886b110a6e59
SHA1 e4547977cbc7840dc5f27ef5ae05f2f50f21f5cd
SHA512 81a6d4f508f8cf363512f74c0df49a8f04c5d31b755965f925cc6c0660b8b6c6890d1afc4f4568d3dcff11abc8929484326f0a1b1b7ab4ce6643fdf1021538b9
SSDEEP 12288:/4hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:/KoHjto1GFxlXutIs1WZX5AR
TLSH
T1C7652363ACF350C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 ed045c865e29f2be0da84216bca029fdf125008d63d9d7740d6a80eb18cd9344
MD5 32a2da6e5cfe21d8c6ae40535416c01e
SHA1 fe0e421cc499fecc46a675c443b1dbe9bee8ad31
SHA512 42437cfbbe449fbd1eac1d15bbe139e5e4278d913ee1b93aa63cb9e0448bdb100180af7903342dadefe777c92242fe7891caa482e2cf1f0825d96a166efaeab5
SSDEEP 12288:ZyPz5L8hhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:YzynoHjto1GFxlXutIs1WZX5AR
TLSH
T14E75021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 0f93b314609f589d5b39bbf69a3214b53ccad765ef3d39b58cfb1d902847a9e3
MD5 c468d8b8308ec38432601001e39af47b
SHA1 010fc602c155b727e37cd1e603e5c46bfb0301a5
SHA512 e9d4c73cb95920d7e1ffe27daa57d380f6a6f213c11f9396eca48206f177338bc6dadf7f322f25dc9540e59c435f632cbf3b899170bc7631fa3ebb5574abf1bd
SSDEEP 24576:0TNaLl3z0zDhoHjto1GFxlXutIs1WZX5AR:0TALljpT/M+w
TLSH
T18B8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 df0e443166ad3c5d1a077a84096e9725b8db643c427e52067b954a99636c78b2
MD5 259f94ab94144e9f37c6bda1962ce66a
SHA1 15d029d2c1a740f993e178cdd1d7278be12baf33
SHA512 3bbe5b82906be4335d3d5366c85e87e065277e8db49933182893999835b36cc44217458130c6585c179ecdf34bd6a434a8fbc9042ab6546087f4568e4c7daad0
SSDEEP 24576:i3pd9CHKy7GZtoHjto1GFxlXutIs1WZX5AR:Epd9CHKyawT/M+w
TLSH
T1FC95DF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 bc435b8255a40748bd88c2fe697be59ae4090a4329747b7a7388a3b6e09088b0
MD5 732916fc33f0d370a78d7349a98fd8d3
SHA1 32fea8354c52939ea7e25b227ee450dcd05bd335
SHA512 45a54eaeabf9704185406707a4edf44fa4bbbe58ffe3fc88cb71aef6ac9ed316cdccb87890ae997c5f71b537b8e4593bb05c5b4470262d4ad37295c158ceefb1
SSDEEP 12288:EXhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ExoHjto1GFxlXutIs1WZX5AR
TLSH
T1F6652363ACF340C7F62551B069C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 58f78cae569c20be253f581f5a5a681766eb00c2b0a843343253364bb4fdcb93
MD5 7f33b9661d77a42422f486b496cec9d1
SHA1 361b35e0044eac549129e7b0e40590dd90449bbe
SHA512 4c79e36a349385c12c2b9976853bbe770c5bff7dd44236bd136a057963d30e2e2a2c81a9cd0d233975365f457fd20be6b5d97b0d161f4f1811d71e0040191c80
SSDEEP 12288:hBhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:hHoHjto1GFxlXutIs1WZX5AR
TLSH
T1906523639CF240D7F62951B029C76BA1ECBBB307594910BB8B90ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c07aebffe84e47a721b1994f68cc2567367eb3640b06650f5259975e182219c0
MD5 9214c64234362f713d2b32cf38489e4a
SHA1 8acb3c2774a65d6799b0fc145cfee01fd97b3584
SHA512 ac2f7744ca7af9e4cdeb59fff0f3097c7819cf706c5bd3acec3f814d705ce268a2f6f005e27fd28f5dc4144ad38f076a3c7f472dccc86ecb7fe2dfa1027b9b24
SSDEEP 12288:a6hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:aAoHjto1GFxlXutIs1WZX5AR
TLSH
T1D1652363ACF340D7F62551B02AC76AA5ECBBB347194920BB8B50ED190F3D064BE765E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 6d10b898463ff001c68318bdac4b054f6811d836c0d472ea16a433070342abee
MD5 d437d04c93e5c407e30a2a374dce0d59
SHA1 ac8ab592e7ac1ddeadaacbeb103e2bc95dd54527
SHA512 a8ac6cc726301fd8764343305882eef8593498069c46aa4ebffe3cd551044e11a49e38027328a810139a17809c900baefef6b9c73806226aacecf535957e188f
SSDEEP 12288:x4hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:xKoHjto1GFxlXutIs1WZX5AR
TLSH
T154652363ACF340D7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6dd2705fec4846d2038f14ed84904588f3cf2489cd716f5d076b37bd7166a958
MD5 eea025ac659a94facfb1b963af2f613f
SHA1 a34f668f76962dff2984e299343d70804bf11441
SHA512 3783017b109555b4d0fd80724d534d8600e97fa8216bd7e8696b217c03a153edd5c92c5bc6fd9909f7637d58fa85297e593e455e0a5a71aac4b70f0d1acd9864
SSDEEP 12288:9XhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:9xoHjto1GFxlXutIs1WZX5AR
TLSH
T10E652363ACF350C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0421a76fac19bcd9be2965cd8789ec1c41cf384d151123709b905c641084b2c9
MD5 adb426dbe225f76c01f444e90a5ef0a4
SHA1 97d300902c9280848fa668d1586f9752dcd15d1d
SHA512 5dc071bd295b33906b12f409c819e671ff13f6c33f40082a0ebb2f62c0fb40a0719ab51aae4bfd68143c1632f8741bc38c536d875892987b886ef791b1187399
SSDEEP 12288:nwhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:nCoHjto1GFxlXutIs1WZX5AR
TLSH
T1EE6523639CF340CBE62551F069C76AA1ECBBB347594920BB8B50EE190F3D064BA765E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f5d49aa30997cffa62509724b8a9e9f8264ef8e4610a593a66937baa506584df
MD5 53895588f4142f873b45ffcd310ea6a8
SHA1 157a8a1668a27d7ccc5aaf2561fd0df0da64be9f
SHA512 409fb1a0da0a47fc1c367d161707e5b9339bdf73728f994c53819df0b55928b986ae17b89849817a106f1f102c18bf237d9c3dbf8967b8debc2f93c877f6b114
SSDEEP 24576:Mfwv+k9RX6wkyAI8oHjto1GFxlXutIs1WZX5AR:CMnYIVT/M+w
TLSH
T1E595D029EBD844E5E177913C9DB3460AF6B278591B31C2CF029A536D0E37ED46E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e8bf78de6c12387e9e3610ef08403bd988687d45f5a132a002e2dfecbb65d1b2
MD5 5b5f2b5e7efddc674f0994baa259c082
SHA1 343f3ab214d549b4162b67a22e1f99e9debdb4a0
SHA512 b51e85b2b91bb41816ccab96fbff8de6876f54f0402f5a9c1e67cfcc5f24143265d31b9536b6a4eca8e1f69e8b2670f712258723adf1cb6eff40c12a3c08a5e8
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IT/M+w:9ySzP6w
TLSH
T1BF066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c4691d883d13cf1461b052ed25944e970a14272628d9df3d1e292d58d608fde4
MD5 4b4effe87410ad95eb6798028161b67d
SHA1 0810beedab5298c9b41162a7eef447effe494d10
SHA512 6cb006649272eff6a1ffd6efc03e9f36dc4ef6b0079b6aa3983c26e454389cdd582d01e7bfc8bbfb160be99aa92924cd099bce0c023fa50cdb06d79fb96596ff
SSDEEP 24576:m47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYJoHjto1GFxlXutIs1WZX5AR:m47JUQj1irIhCnDHUPfF/YT/M+w
TLSH
T15D65AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9162bed6851ada86068e3c3d8335fddb422a9b6f6655889026e82672313497ff
MD5 13f6a623f494df4856ae91341e5eb0bd
SHA1 b44f64f3775b2c93a3dfdb5fb116f0a69c00ea59
SHA512 e6b15e251799c573460db209df803f7691b37eeaec9566cbce28498b8a7a437ef633d4e1763c08177938515c70cf57abb205ff0f6ebbac1ff1cf2c9cfeedf29a
SSDEEP 12288:bzsfohKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:2aoHjto1GFxlXutIs1WZX5AR
TLSH
T12B75F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7212debc32c5a8eb19b63c9fe0d9add80920687395a74b1ca99bf1c7ed18ca12
MD5 f1e07927fe3bff9cc824acf7b364f674
SHA1 061a19c0ff3631eecb9fd648d3c603608b209c22
SHA512 f43dc279f90a131c586cc2096d4dfcfc479e7583ace843bf5405d47ef12e42b0f922edf70242aaffe4aaa3b876dd719a8c36b42a9006162b33484cf0f2fcc6d1
SSDEEP 12288:1ApNtXBU3fWeT/H/K7OCY85vCA069/oxHm/hGi:1Ap/xUPpCg85Zh9/aG/R
TLSH
T1A03538507666DB4FC6A940321E33C2CCAB707D41FE089B0772C9872FD476659BAF2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 3fbe3f6516c0771aeeebccfcb24fc266eb2dcd7d7c2e2eafa3a8b22011a859fd
MD5 d0fc7cab930d37573eed809d7e7e9268
SHA1 32f4291b2c05008dbfa774623d0972837a01fe14
SHA512 13a80983273273587e5a1031bf9c08cfa76dd179675f4b8ba9c962436c2279deef65a2d57a1e07727b63b9b2348bafbf533cca743ef88fac7c84113f92d011a0
SSDEEP 12288:S0tr0usBryEbH7fb6hRCw6GC4OHkdO/XQ2VN4epV8cpSX:S0tQutWVNxEcYX
TLSH
T178751A415137A78FC1FB6032033A9B4DAB64EC0277096F27B3C9453AD866B56B0B97D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 04deeff821575bae1a5cdc1096bd2a35966e0a76e11fc207707dd07b3d60961d
MD5 fff21daa41ab59f1407f1673135b8252
SHA1 0f7dbbed4739251d343d2d977743a250a57b53a8
SHA512 0f9a471669c764ee17cb9a30911eb01a006cfdb594543d8732366a293be4b597967e569320af12a83ddc9eb0bfe8c444ac8a54e1b7373ddbb3b08110ed050f66
SSDEEP 12288:n+7qhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYLN:yQoHjto1GFxlXutIs1WZX5ARON
TLSH
T12865236399F254C7F57961B029DBA631BC7FB3160B4410FB9A40EE190E3D0E0AE766D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d49a330c11bcfb0a35668038f225e510a7b379bc4993110fcee342469dbe0d8d
MD5 4da4602611b21e38b00d8a782479952f
SHA1 8d7a51b2285f532dcb753f3e56b168bad133df72
SHA512 9c37773ffe4c30b05f1c98fb86b4d665f03680fccba210b1641c586d90ade594aafc3157fea82b4c27216b72395d16b8bb978835bb3001c46c4396407030d8ac
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYSoHjto1GFxlXutIs1WZX5AR:Xgb4mBIBhGFCT/M+w
TLSH
T1E0659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 fe95c871b06a7facd57317246c00f24a2836ffd199ac1d545447307575ea3466
MD5 3812ab9d06c357b2088dd397604ec32c
SHA1 e09dc3d308d9ff1c16c975bebca1e1799c726efc
SHA512 4037cc2a31037e52d3d1d3ad76a7ec06873707ec18be10c23978f08fce3ffe362293cacb94db43a4d3c230e39e86b3fd658831d0cb84d1807c4a2459c195ac59
SSDEEP 24576:O8kNvNnaFeYhJNtmZBm7oHjto1GFxlXutIs1WZX5AR91pgZ6SdCJn1tuXsbvpWLW:O8MwBtOmET/M+wlpg7dCDt4cYLKoHLk
TLSH
T15DA5E16EAAF405E4E1FEC6B4DD238512FA727461173252CB4390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5316ffaebc457359d5ad11e37613f6536a05531f81045169b3ad765448a45b30
MD5 6be023d20e8aa196d135d139f0e48b1c
SHA1 ba0353db952f39459bdd10fdc1b07d0e9d14946f
SHA512 b6587c43bfb18d1a89e5f1d9c6adc18d0620b02b3a998248b1d22c05f9491fc348947e71936f9213f45a6e36e1bbd9be9539b380e6d6de1d73438b5b71fcc345
SSDEEP 24576:nG88u8FpJqH1xzria7/mZoHjto1GFxlXutIs1WZX5AR:G7ZFPqV4a7/jT/M+w
TLSH
T14195F16676E101F1D47BD13889874663F6B2B4250364EBEF0BA88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f2a1e0d131b05573acfa8684f6c381ea69a67bec03f682f897d135e9555e40de
MD5 7a4808fe6f24786dc78c5d6879073120
SHA1 fe1ce050aba72f80799329ec5da2b4eaf0357fa0
SHA512 e630b7170556bdd4ea9b8e632fd18107bd90487e4073d321efc8c7a572c77445fad77f6783f34256f21c445a0811ced2aa3fa0ce9c44e9f10836f688aac3b196
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWT/M+w:PG05lO43bhw
TLSH
T176D5CF6A62EC11F9D1BBC17CD9C74A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ebd631b91e2f1f9cc83abb4a51cef57917ee3c00f9ac0892708d2f8683b6eafa
MD5 e8c981756205869652275d53a206a584
SHA1 699b5db8626a066cdf998acba3bdebc7cda49705
SHA512 8163c4a86f1ecdef0252540a89e7f70fc7559dd5e63f6499a0aa6a801b2e7a0a3e9c020d60c8f59a0e3c98d027e7b3e85c2fbf10b5e0fe56ffe16aa4ba1f7e6a
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHoHjto1GFxlXutIs1WZX5AR:Ga5POZ3+Jt2pasx2+m+T/M+w
TLSH
T19065AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1a99106beee1efcbe6c3247206a8d7e8d873d0c85101cd1fc6f35252f760aabe
MD5 47bdb20b21e976bddc68ef7100f10b28
SHA1 329d07814080890367c214d685c7f260d6f36162
SHA512 c5b7365fc2c1b6f3b3e89bacc27e05424393e5af26a393f0277fe4e17afd0f8c06c5a924f45eed481a507fc704c32bae3ea6ff48afd7f7f632492d5e3d75f019
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkBoHjto1GFxlXutIs1WZX5AR:0Nc/zEOVHFDT/M+w
TLSH
T1F9858C2622E901E4F5BBE1BE89779546FA717865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 793fcf8f95b3cbb2a29d17c9037a1a21338750edc5402ae6a5c053b360386b42
MD5 03294b467794c57a44d259ee6d4825a6
SHA1 8d2a02624b1dad24dc6055760e621a50103ab90e
SHA512 5db063efcf9fd8475a3cffd0e03391729c55b75fa6f6321da73694230d9354030bd126afb82b1aa7d6825c3e75a9b8e88d8c2777973d47d1a0b34cd574b5cd1f
SSDEEP 12288:F/Hck6j5ZI7sPSVugpgduK4a6Sq4CQxHSx7na61oeZnkNeebRbYbzrwcC5LKoA9V:L6DIV1pgZ6SdCJn1tuXsbvpWLKoAaLX0
TLSH
T12E25025E23BA20F9D1BBC179D5830542E2B2B07197225ACF06D4C4798FA3EDCB93DA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 0d4c9304b5cf9e5405eafd49ba533533ea9572523e1b203f94acdfce2bb2be13
MD5 7915314492d82fe5472c344cda8285cc
SHA1 004cfacdd251a7a75f18f6be84ee198cf58a7781
SHA512 84ace447a0dbee21e95dc45bf99702f50c4bde9cec56dcbfa0e1c7a86ef4c676128f3ad0227d01333e8c106e49124051911dd2da277cac3df8e311e30efa088a
SSDEEP 24576:NDkNvNnaFeYhJNtmZBm7oHjto1GFxlXutIs1WZX5AR91pgZ6SdCJn1tuXsbvpWLW:NDMwBtOmET/M+wlpg7dCDt4cYLKoHLk
TLSH
T110A5E16EAAF405E4E1FEC6B4DD238512FA727461173252CB4390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 618960994cf72a9d03a39d27a94f081b177ece4e3373bb4cffc48ad4f0c1b356
MD5 38fd63d209c9a94a0afd0b484f2d342e
SHA1 57a12515c36219775da35767f710b049bd218a8c
SHA512 c38b5f4199d572d1e783e07ba5fca2fed5a794f4b0db4ef557039347fd578d0de54d118445f8d96805ecb149539248f362065c2545fcc0a7c35c7b631058f4ae
SSDEEP 12288:NHvUrBFrEjwaQLhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:NPUr+NQ1oHjto1GFxlXutIs1WZX5AR
TLSH
T13A85E12F66E918E5E676A17C89838719F772B462071292DF02D0813E4F379E8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a7352111d24f566217e8261c98ec378e8d65246737247738b1d4bd9b3eef9e76
MD5 94a7cf10f62d22a846fd3a79f922ba84
SHA1 ce8f5349afa2dc40d1f8e403673ecd3c142b1a2e
SHA512 262fa65d40aef0d4713e434d0e5547ec9df71c54b75d984db826b525241cbd6c761286b5e2fff822042928de113f388010503021d53a6f20cb07ec1a02b4c0a6
SSDEEP 24576:UD3FHshBIYQgAEoHjto1GFxlXutIs1WZX5AR:UDVHeBIAAdT/M+w
TLSH
T1C095F23EEAA900E4E57BD1BCDA538A06E77234A9032165DB06D0C1791F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/256-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/256-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/256-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/256-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1260-82-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1260-76-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1260-74-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1260-345-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1912-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1912-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1912-372-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1912-358-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1912-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1912-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2540-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2540-150-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2540-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2540-148-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2540-142-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3228-116-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3228-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3228-355-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3228-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3228-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3240-30-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3240-132-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3240-31-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3240-24-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3240-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3520-359-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/3520-134-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3520-133-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/4348-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4348-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4348-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4348-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4412-88-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4412-354-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4412-87-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4412-93-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/5600-187-0x0000000003870000-0x00000000038D0000-memory.dmp

Download

memory/5600-192-0x0000000003870000-0x00000000038D0000-memory.dmp

Download

memory/5600-0-0x0000000140000000-0x0000000140322000-memory.dmp

Download

memory/5600-253-0x0000000140000000-0x0000000140322000-memory.dmp

Download

memory/5600-189-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/5600-1-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/5600-86-0x0000000140000000-0x0000000140322000-memory.dmp

Download

memory/5600-8-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/5600-7-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/5600-10-0x0000000002980000-0x0000000002A03000-memory.dmp

Download

memory/5600-18-0x0000000002980000-0x0000000002A03000-memory.dmp

Download

memory/5600-180-0x0000000003870000-0x00000000038D0000-memory.dmp

Download

memory/5600-194-0x0000000002980000-0x0000000002A03000-memory.dmp

Download

memory/5624-325-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5624-64-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5624-63-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5624-70-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5976-48-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/5976-55-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5976-49-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5976-61-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/5976-59-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download