a97d2db77b350d810fbd0829dd9f91473e50becd7edeab382a5b8b01082289b0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Size 1.7MB
Sample260701-e3sdsaes9p
SHA256 a97d2db77b350d810fbd0829dd9f91473e50becd7edeab382a5b8b01082289b0
MD5 6e60519d19908204b38f30be60a29bd9
SHA1 84615ea008af676fd1bdd3f5a5c0e3a61939b804
SHA512 fed75d382fb173238120fb163df50b179024f587131779698a63052d713cf513bfb1e08c4b1b3f346d29ef8f8de4b45ca8e181aa67435111d2e718efc1d9c507
SSDEEP 24576:jVf+k1ixOFthHE8MEX1XsdIAhb0VECwN:5flixO3hHE8MEXWI4bMQN
TLSH
T1ED85F10A72D0A2D4E9E5713CCF91C6785362BCA409124B5F42E53E5B3DFF2D74E26AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5760	elevation_service.exe
6028	elevation_service.exe
4300	maintenanceservice.exe
1804	OSE.EXE
1856	PerceptionSimulationService.exe
3004	perfhost.exe
3676	ReFsDedupSvc.exe
6084	SensorDataService.exe
3876	ssh-agent.exe
5344	AgentService.exe
3788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f0a6d6043a2495a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\javaw.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccd032171209dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a27c48141209dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009daaa8551209dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000436c2f161209dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017baf8151209dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeaf71171209dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ac1cc171209dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5344	AgentService.exe
Token: 33	3788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeDebugPrivilege	4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4264	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	5760	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 6136	3788	SearchIndexer.exe	99
PID 3788 wrote to memory of 4132	3788	SearchIndexer.exe	100
PID 3788 wrote to memory of 1704	3788	SearchIndexer.exe	101
PID 3788 wrote to memory of 5920	3788	SearchIndexer.exe	102
PID 3788 wrote to memory of 4080	3788	SearchIndexer.exe	104
PID 3788 wrote to memory of 4128	3788	SearchIndexer.exe	105
PID 3788 wrote to memory of 4216	3788	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2792 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2792 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 35e02b245e9298a27d4b5a3914a10356f0223b69c8944fc6e684f2e1f9ca3aba
MD5 99c8c6070a107d3a2d42f3c7ec321e60
SHA1 2f656e3a6496fcae34164ed42d2c1abaa08b4a31
SHA512 965600ec5c901012326e93fa7aad7cbd70968ae798028e6afd1389900eaab9bb3df324853ea4cbc087c8edf7c110b089a9aef678d6a7270ccdfd76aa4953cd23
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnaixO3hHE8MEXWI4bMQN:h3q6HjBmo3tzfG9btN
TLSH
T1F1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 7ecaa07762fa06061c3eb1417f44fcbcce3f728299ace35a8583980ee86b3fce
MD5 1bef28a133eaa978bbec6ba5a786d0cc
SHA1 07516570b4b9f85359d1705e962166e200be99aa
SHA512 d13c03e7f300f2c470c711e0fe898bcd1c301c834b94194c0e75f6da5a50b15c4900e2dacd969490257674cc97f7f91f5f7e2e50738c4d8ea8a2a08f2981ff84
SSDEEP 24576:mXYfDtczAHixOFthHE8MEX1XsdIAhb0VECwN:Ftc4ixO3hHE8MEXWI4bMQN
TLSH
T11785F12977E405F9ED6B923CC8A28615E673B8910760E7CB03A499261F333D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 0ab43f233763b32f0b4a8b50afe93e61774fd3bcb072fa30ece8367de8818405
MD5 3ed38c0be45fe26b03080ff8fff67257
SHA1 ef57c08e27df6d89404a1e2246ddf5d1388b2ee0
SHA512 a0dab3497851e0c4f120fa97cb7ff43da224cc07cf25668f714d5dcba60149dcd24a9ad8f6312a551cc4d2aec26f099ea7d43fbadf6bfeb9b21f05f75dcdd586
SSDEEP 24576:30Le5ji0hmxirMyixOFthHE8MEX1XsdIAhb0VECwN:3Pji0AcJixO3hHE8MEXWI4bMQN
TLSH
T146959E16F6748375D073C0B9C5D2A69EE97230821B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aece4f9746f2fce7a88c7c1ef86e91f8958cf1badacc9ddf9d36aca21be472a8
MD5 161ed031d8e7caa6af85d99665cdf928
SHA1 692fc0f519006c3f3d2d0140e64b0fbb35bcdd67
SHA512 49faa6eb4cfd4efd200206c2018deadaba9a799896c73ce0dbb537572d7548740658810fbbbf439b0001bf1c272a34f4a5353bc31db6e19ef1841cb21c83f05d
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyuIixOFthHE8MEX1XsdIAhb0VECwN:L/ezSC6vUzPvxHjyVixO3hHE8MEXWI4H
TLSH
T138755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 835c39c1479ff798dc2f4653d01c4267ce1486ef8598507954596ab2e9a62fe5
MD5 c135107713d9f39296a464f3de10f1ad
SHA1 fea2df5c696ca21a19a83aab81081a1098408ed5
SHA512 bcdd03aed5fa81887dac4242e49231a96f47cf51aae8496b4e80366c972f1684032bdf7fc95b360b2cf501b07d97eef693ab9192a0f8fd642dce1ef259cd07d1
SSDEEP 24576:JVbqPb88hv/l+67ixOFthHE8MEX1XsdIAhb0VECwN:JVO88hXl++ixO3hHE8MEXWI4bMQN
TLSH
T148559E66F6B48321D073C0BAC4D2AA9AEE7234415B318ACB0246D76C3E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 cf4880551c739a1acac520ad7fae5f8c0d55434c461861385a22e60997c5f265
MD5 8a530b500376737fdb46135ff1690450
SHA1 383fb7c546863e891515a246656a38d5b6961cad
SHA512 8a1885d85485b006eeca6e65ab5849fb8130d126372a0ea48563c64b24a91af53b12eccbc333dacc8f45e55375b514c150e4bf22ead35deb1bd165cb741d7c06
SSDEEP 12288:6Re5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:6RGixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1A7652303ABD481C6EF8B2B3D609A6BFD66D2DED008144DC3C2533566687B2D6D93BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f1e5eed2efaf3fe968e753cb790da0a09da078ac9548dbac62e4fbac44aa3c4d
MD5 02925d5ab8bd9c6535047497a6c8624b
SHA1 af6ea59962f8bb34a6eae923c4aabaecdb7d764e
SHA512 d33d348833c529f247face824f6573a5faff0d5469987f877fc6945253aa4cf4f462db8e0bfb6c883bc901c386debad54d3d28ec1b2b9c6165c248659d7fc081
SSDEEP 12288:SeBNUbTVO86UJ5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:SJIUzixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T16985DF2BEE28FCD2C67E5D7856918740E7B278704F21A3CBD165820EDE235E15E7AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aa09e44fced965dcaf0af5f1c4f050aaf44ae331db6c87a7bccba3b4f763b5d4
MD5 61a9be708b8b4ac3dd8ecba56ce27e00
SHA1 d853a8342abf0e92e983718dfd4a4516975deb1a
SHA512 2ceb1a42320d6a12c48fe71bdcf05572e1dc08e14b8cbc0a708bfc2e315f1110dd4d188a3fa6e47e8c95dc99de7530399b7e66f0314e38396091896b1879c050
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:HQvGAdlCEL8c/yRNw5Cjo3tzfG9btN
TLSH
T1E8267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e49990ce28c3bf52020c5aa1ceb1fa433d3b31ffc1e9d818859fc27f1dc337b4
MD5 4ff4c2fa53f037d4a80d1d56a4c1a2ae
SHA1 e6a282c8518ee4b715b7bbe32a3d711c3d1a435c
SHA512 5ce050278888c3a52078fc4c7932ab6de9300bce8b99b42e3109485011dd95cae622b0d32f3c220d41bfc69a9f71bec91995b516d08dcbd600c74faadd77d1b7
SSDEEP 24576:IdewsAjZixOFthHE8MEX1XsdIAhb0VECwN:IljZixO3hHE8MEXWI4bMQN
TLSH
T13985E031FFB4E036C6BF0DB61B26C716146DBA600F6119C3E3A84A9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8b7407dcfa1fdb58307acd25bd3f3a553268e8818beddcfb7a8a8c79a455e050
MD5 d06df0504b7da41ea9c80a1159f5f57c
SHA1 f77abc4fe0cb0ab2dafeae5101ff58c9d9ce92cd
SHA512 61feda1e50545f0f520be9d90c5cb06abe8a725e74b8d4192e70234f72403cfdefad0f6630cd932b1cee1b76dfd9dff784e43e8cc64efcab33f9435b4e017c4d
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHR3U:EUEtQevvqc2W1cpV2EI329
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f90cb60ac6d63dd8eae9588f553e95309e060f0421c53ea5d254661e1d493846
MD5 68e6a4fd1285879085b1c244f2d11d34
SHA1 d0b9335979f2771eda48184a2b0af6af54a3f571
SHA512 a92845d46096556296a8d8981979ae01c13af2ced1c9ed00341bd26799950ed387f7db8a0bff9c716a2da36b021fa8ed99c7e46612f57647a55c1b088debe345
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/z5ixO3hHE8MEXWI4bMQN:AoqtVjnmfo3tzfG9btN
TLSH
T19FD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 48d85f668b341bd0116fdfe147413048861cd24a6656483a8c2ea8c1d88cd13c
MD5 6ad58cf7319ea825f2c434a1cb57b30e
SHA1 44c2cc4f68d45b6f5f99562000d39308feaa6703
SHA512 dba08c92a04eea0cf2a6b723ac7b56e94c62d36eae3e9c11a708ccef6faee4eeb44e98111dec5ca5d7727afdc25048f4c8c75dd6c0bbd3cd2daafb2df8b7e25f
SSDEEP 24576:rAhGLJIFoiwtA5l7S53kixOFthHE8MEX1XsdIAhb0VECwN:rAMyFoiq5UixO3hHE8MEXWI4bMQN
TLSH
T13B359D81EBF951D4F5B3AA7899B69171EAB6BCA51E31C20F2150D11F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a0910b3fbfed8f46965829be286b63e03aa5e601185848c9bf15651c76e71c2b
MD5 b1f1acb0935fd630f31cc5b486f512b8
SHA1 e1878e9c9c2fd6bc3ac4d7a165916c8ee69f5ae0
SHA512 76bafecd27ea4dee82624721ba459f21a07743644c3a8c3fcfbfbfc656604249ba2d85960d0f1052d21364373f94d499d14a84493c1c2f9a479db026e9c26337
SSDEEP 24576:1wuoOW1ixOFthHE8MEX1XsdIAhb0VECwN:1wDOgixO3hHE8MEXWI4bMQN
TLSH
T16885F14677E408F9E96752398557C236F7F2BC012A21DB1B4360C65B6F373A1AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2d5ff8708f36e8e5d05e094e00f2aca22f321d5e03c81b77e126ab7d4e127d05
MD5 d0e613f87edb54a7cd75b3885536f3d3
SHA1 1268a4b864e044c65a226ce423d91739bd6164ca
SHA512 c075df611b6439c416611e8efba2ca2e74a89a4f0e63e6e09390596247826af885151706567322c8c46378767f7f057dfdb06daf532c156c1c06e282fc5c7e09
SSDEEP 12288:jBZ1IyX5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:NZuqixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T12975124A37E461F9E597123CD4E55799E3F2B892273143CF422202662F73BC65D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9083aa9e9dac8548cf674b763ad2097b210bc5030bdc41e5a530661c4b3d5807
MD5 5fe6512dc980d61c983217421664edb2
SHA1 7dee39416f83ab5b2496e2149ffcb74f8f1888d0
SHA512 1a3fc732c2aaaf268d97bf671bc1fdecf525daff19cfd0dfbeb0281d760258ff935762e3ef627c165db1ff92dc867de9b523152adb2bbcb64e5752bc17d031ee
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN3qo3tzfG9btN:rQyiKayX+PNr3U
TLSH
T118667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c3ae0aaf4542f344447296d5e278aa46c48fdd3768626f52476a80318b2fb61d
MD5 ac814ebb1c44f2d94dcd3adafad20fe5
SHA1 24b047b3bb9d664ef9f038d976b50de3e193e0a0
SHA512 2e05fcc6a8c5201bf2c948f2326dfaed91175ac090edd6a2527f15d1812daaf170e3550b454610d4036c380e8e11a5bf22f0cb64a1640eb132febde0aada1e21
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN3qo3tzfG9btN:cQyiKayX+PNr3U
TLSH
T1E0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0a8046083188c2d22377b40ca70aadfa99eedad5aed04cd2b5e753f80726d78a
MD5 3fc05c3605efc5b823e2fb65c37d28f8
SHA1 a5780fcc861400545e953b5e3d58f943579eb8ae
SHA512 ae191a68113564dc275a03da55310740591aa80c0b780cbe8deade49694549407a6c7c09c49ba572615b54bf8495a9ccbfd069ee90a9bd37cfcca35d4bc31baf
SSDEEP 49152:x68Qg55nhheWu7PNU3/JixO3hHE8MEXWI4bMQN:vthWRc/go3tzfG9btN
TLSH
T133B54933B2F60099C44DE1769F4A973196D27C758FE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 73b4cc38ae816692482034f5b58ea25a4ee6fbd08dba3dba6e36986e834e4e0f
MD5 f9878baf35fe7e1ebd2fa38cd74c323e
SHA1 11e61ab9f1568025ab95a7b5cbb33d498dcd61d4
SHA512 6347fb30b809503d50055996985daad2d7f0256519e1acf8b7b3726b83ed783b105d681e5e32ebc8e6b6fcf7bfff70b234ba940ed195aa8c8edc58a003294033
SSDEEP 98304:gy5112gYy5azzVvL69nLKnhZto3tzfG9btN:5LIHmWhY3U
TLSH
T111167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ff4b96176866f2759fa1ebaf0a658c38ba97b7afa47c11b274f1994756aa512f
MD5 43a57f98c58654446dd50911edc31ffd
SHA1 ca67129f9c648c3aa8e669c1230b97f55456dc7f
SHA512 d8f7a7594babddec17ee1e8849c3b5d7325386fd696c5c46644018cdd553f251123cd3a265f40acd1b29e496e1a9842fb05d27ee9c6c9cb6f6ce406c799a98a2
SSDEEP 49152:4B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3ixO3hHE8MEXWI4bMQN:Su6JmVxd2dSo3tzfG9btN
TLSH
T127D59D13F2DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5023d76d4516a67db85ea5e3c7024c7779412908b4c7a5d42445ae23d2a99daa
MD5 339ec17742d4723940074f147dc79eb5
SHA1 5b685fe62715f439d74b50a99b079c5a3849b402
SHA512 e55e6b15b9a2abce9bb8db76626293b2e358562967c8c918754f3f92d6b924880924df4d986aae07837f10c24dbb1bc5cefb1725be0d0c6dc9924d053758f6e9
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xTixO3hHE8MEXWI4bMQN:hmifPbRfo3tzfG9btN
TLSH
T1F6B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4889df2fe4863ad71a2b06ef6be1e80559af1847cbf780f49beaf70a7a0edb78
MD5 6c5b21fc261998ef48308b85baa8d57c
SHA1 f8a465a7be32f49d77b5623cf947145c7851e139
SHA512 d9325f2b761485e456af6b34d7b55d2fc8ce320789095034e3c9a70aa5d21f09a1378c56e3c649578ef779dbe89e798179f1ffbfa832ffc33e15375ee9078057
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqqixO3hHE8MEXWI4bMQN:k5dKTi61xo3tzfG9btN
TLSH
T1D9C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9f4c7deb8175d13e07accd837beee7d882d2cc8baab0947fef1a295c993b5209
MD5 2514364d1a6a34a6f4fa7f32cb4257fd
SHA1 17ee43034035911fc2f1d001fcc7bc827cbc2d4b
SHA512 3b6e583fd9e13f9e324b38227a167a60ed3f0a3c9ccba45e653348b45b3ccd962b9c7ec12eefa0e52e280bc46580470afabccbd25610106dd5b2881d721a4da2
SSDEEP 49152:2htSn8EApI0figngiDn0AP5wHixO3hHE8MEXWI4bMQN:XX2iyph7o3tzfG9btN
TLSH
T15795BE13F2D901E8D05ED178C7468632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a8e656283acb159fa1c164e66cc1432d714b8a1ddd17d5a23fcf4b613a1791b4
MD5 74e04aabdd611d20262a4787d80e5aa2
SHA1 08002c5edcbf193c8ddbfc47d5ce6bd7bdbfe00a
SHA512 59a590b024d02b31c0575a4ece04fee45ce04946f88a59d5b9c12cec806e8ebd079290fddd853e1f73da5131c1ec542f0b7b74044427b085591dfec0c99a958f
SSDEEP 12288:FW5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:F+ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1C4652303BFD5C2CAEE4A273D909657FDA6C6EED1281405C3D257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 998b66f94bbbe9d31b7f8aa32f34384ffbe051d9a5f00ced2d59d0e3129d610c
MD5 9ca87d0b97dea1135a164a40299a14e9
SHA1 49f58e57d7e2dbbb96d9824dd14cd661bc7fdd2a
SHA512 182b0e8a63eb5b420b8b10aadc841870622bc9a85154ae76dd4982ce52e4b55b67b5ed69fb56ad2afe991905172f928029d6c8e0dba210bb29110d494e9c6d93
SSDEEP 12288:oz5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:odixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F4652303BFD582CAED4A273D909657FDA6C6EED5281005C3D257202278BB7DA5D3BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 dd0365434893142651d19f67de960d83ef6c5c08dfa9f818bd447a98f3fd8f56
MD5 c23b2e8b863ac116bd2c559e1a0e6d52
SHA1 7728603764a4f2b98df3ecefa03b8dc9819858b3
SHA512 fc91702ed1bd616ef795ad9d480ff6ed609c7bf94a0d7fd531d0fef522846be8da8ae0efed79ac743882632558cb170173a70580cd23dd3ed0acd07f562d8a63
SSDEEP 12288:DB5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:DrixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T151652303BFD5C2CAED4A273D909657FDA6D6EED1281005C3D247203268BB6DA5D3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 34ac190581a71946e1ed69a136900751e21e053a87bf556204b4d572701585e4
MD5 332f2f7f0e9f9e48c69559eeeef44cac
SHA1 fe7faf10eac37adc90a9d9169483bd0383de8bbd
SHA512 5b9ff2ce408a1c3bfafffe881e2eddd7a26336810a346104a36bff4283a8cd461850ea049af795964dfb8331637c84acb1dde9b7e731bc1beee33eebb3ee73fb
SSDEEP 12288:6Vs5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:dixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1676523037BE981C5EC8B673CD0A697A9E3E2FDD02A3156CBC20215261DB33D59D3AE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5de77705ed063b05cdfad75553c09a27ee99531de4fe978524801fadafa150e0
MD5 6a6866a1d051a5a172a4fbae0590e567
SHA1 4b571c0f3ff942918e3d0a1faf4c3abe40553c39
SHA512 b29bd65ec42172877ae2648597060bfd1d1206647262a02ef0ec645fe4629b2edd7c646ea54ddd535dce75c761b4ca19599f2c24c6dad6f7b39eaefdb3ca65e4
SSDEEP 12288:905i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:9MixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1CD652303BFD582CAED4A273D909657FDA6C6EED5281405C3D247203268BB7DA5D3BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 8ae5827b4dac49b36585e94a042529656c22d142ee224be71345d56e7d2bd14d
MD5 a5ebc47d0f8d3ba2bb42311f222dcb53
SHA1 885a54c16f3c72c299934ce73647b7efb64efd75
SHA512 ff1a108c4c0caaf7631586e80ae5c9e03a56abb1669bd04aff1c60fe6d0a6bd7242d016d713d6e1af91558400802b0377c5a3c4cb19453db226d2ae8e841fbe6
SSDEEP 12288:s/5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:sxixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T121652303BFD582CAED4B273D909557FDA6C6EED5281005C3D257203268BB6EA5D3ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5fa60e027902b9c91094a38e2526affe656e823ab0b4285747c0c1a405dc12b6
MD5 829b3f86ca748d62f6090a16917b8495
SHA1 2908a5ea02b8f5ee6c26d5272303568fa1e17677
SHA512 61843f2ecdec53589e9189ceaf41c674050a741984a21d73e692b3e5043a79a52a7fbbb414526a553d3eb547009835e48ee6acb188713f245af9460acf65df17
SSDEEP 12288:U75i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:UlixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T164652303BFD582CAEE4B273D909557FC96C6EED5281445C3D257203278BB2EA5D3ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1e7bb50026ef0acf23ccc17befba0a02914e914bec216ba4b40473bc2a53c484
MD5 2ad6aedab25a42e6109b43e4f2e4a9de
SHA1 88ac4f1870a106d5150616570142ad0a52ac92cb
SHA512 0ed1f62db59170888d229acc6e88237c382bf49fc139426791dc6851b61e65971affcce6649860464976e32a0650ddf07c7ee8a6cf231e67f5fe25647e345a77
SSDEEP 24576:AZMSzFVSO9ixOFthHE8MEX1XsdIAhb0VECwN:AZMSzfBixO3hHE8MEXWI4bMQN
TLSH
T1F2850195B39018F8EC67823EC8558A56D2F2BC5A0A60C64F03A536275F733E11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8ea7db3d682da6616b4db1adc7e133c9186da3f78ba940eff058674e960eb15d
MD5 aff6172c7f7c982c7b9a9127e0617c30
SHA1 cba9ee044fcc82357c4002bc4e29f4b2cd31d47d
SHA512 38b96650c03da5e5eb7cd573b7a7b88f22dd4cf3a49e7ad728ccaec64ec4b456dec61ad57c0dd09b0fdb40b1fb1c87f6c4304d30d6b1e397d7fa35313ceeaaf7
SSDEEP 12288:VK5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:V6ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1EF652307BBD582CAEE4A273D909657FD96C6EED5281005C3D247203278BB6DA5D3BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f596e4afac28b788520f7e559204da6450435b0a210e1db935449b8d5c353e4e
MD5 ade6194f7952e7d23ed18953414f664a
SHA1 f3ab61cfc796e5fae0286f92621392b55c24302c
SHA512 a9e96ff16b1ae020ea246464d12a3798fe10d9f21036e2dab0bdf15fa7ff66eac0d96ab204193567263c7905cbd8b7ed3d1ce9cba13e39b81760a7b8be77a9c3
SSDEEP 12288:Lu5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:LWixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T160652303BFD582CAEE4B273D909657FD96C6EED5281105C3D217203278BB6DA5D3ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 db6f8e5b99f3e556078e97c6a2ad2954dcc0b88046b19cf4920ce231eead9fe3
MD5 c51f6a319e2130848996abc1b129d61d
SHA1 99cf188f864efbb82413d8b3eca1b8769a37fcca
SHA512 3b68e6dcc1dab9f2d547e8ffd72cc81a96f31a9d0c06b8aac6abdc6ef562c59de8be346eb0871a90b5892ea6cce7f518b8ef9cc43c7bb06725e3dc92bfc5850f
SSDEEP 12288:TyPz5L8X5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:ezypixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T11675020777E121F9D5675238C8A21B56F3B2B8720B208ADF536106762E376D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 71127351ca713450d67b28aacdfe042b85c17548cc359a4fc192022a79361ed5
MD5 dbfa49580aace8f47728034984338253
SHA1 6c75028fbfc60540d55f3ce48c9980f60c918562
SHA512 8ad93d7df3a7f37feabcef8f5360ce7a34afc59b806ce8eee26cdd9e1dc6e58fdefb89541fc42081608e2e2a7e13a08f8bb9d0e6a8381d63c74dd048ab591a62
SSDEEP 12288:aK5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:a6ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T171652307BFD582CAEE4A273D909657FC96C6EED5281005C3D257203278BB6DA5D3BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 501b9b0eb92e2330cf6e06858aaf8b43fa39b4c16773b8d67bbeea2ad7152d5e
MD5 ef102da76bc7eab84af92c72ff0e1124
SHA1 95c5af19a7c088d4a8cfcce63a128467ae40b1a5
SHA512 d510d75d49678ff163f3eea34d7973d8251a424f429175eb1c088f14bd06a5372bb4575073d01a02ab3ad7adc0533cbe8cb1ff6ecb98dd16780aba72b5a249f3
SSDEEP 12288:8K5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:86ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T147652307BFD582CAEE4A273D909657FC96C6EED5281005C3C257203278BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e70d4eb0d6650bd1cdd3a3bcca232d66876e04562b77f85ab5493c2c57e51fa1
MD5 2ac3cf2e434e79ddb5340f3fe2f6b874
SHA1 893089891aea3593bba12ceb98427d60b586a1e3
SHA512 f438d0493bd1c62d2e12b69f27ea0ff25f3181015608958136e7000b599b99b58e70225df1ca9b9fb0f6daaecbb05460d78cc065b2af82a7b3611a596fa2d7ec
SSDEEP 12288:MyPz5L8X5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:VzypixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T19B75020777E121F9D5675238C8A21B56F3B2B8720B208ADF536106762E376D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 b7f404b0ab735a1d5f127b09fb621eef2238f452008cd9b32a07a474714b1d88
MD5 a00c3dc5bac306fd52ed2e56e644cac0
SHA1 19ba524db72f8926ee095b981009d4e164c1dbd8
SHA512 89ef44b1a781ef91df888ed489b188a6c6e7e945552d6facf3bedc2bdc2e3878bf56cc64bee2cef2e0d06308560bf18dcfd9e9c5130180a1ef8fa4d70a35da7d
SSDEEP 24576:yTHaLl3z0zDbixOFthHE8MEX1XsdIAhb0VECwN:yT6LljIixO3hHE8MEXWI4bMQN
TLSH
T10885F195B39058F8EC67823EC8558A56D2F2BC5A0A60C65F03A536275F333E11C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 80d17a0e82297b8311b009be3043b14ea660b7af73b16b97e023e75459500fae
MD5 9bb472f31b3f355bd17850bdbaf68d84
SHA1 3e7d38b1cbc400fdccbda2b637d44e135946ffd8
SHA512 be4e14c3c0b7a086c2f92572ce9942577323eefbc74a8825220d029c8ffaf4e9537de3a05c745656b8dadb6091eb4508566e03574e53fbd294665ea420b56297
SSDEEP 24576:V37d9CHKy7GZ/ixOFthHE8MEX1XsdIAhb0VECwN:17d9CHKyaBixO3hHE8MEXWI4bMQN
TLSH
T19C95CF91F3E410E8F0B79A3989765611DAB67C991B31DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4475b287063d5d9e3a9e98e8b1b990348c05f0b773c3a31fef6dfd2d5482bb92
MD5 904607fff5c275270f7304ad9a52130f
SHA1 2f37d8ab2ef19a78519f1dc21eb20416ad8bc650
SHA512 f4d951a20277c170e3628caca52820db3a1dccdb3509b46ebc06ebdfed69c97faef508c28454f6999bb63dbc3bd34e0fe1c1f4fc5869d0519aa55fdd63a4008d
SSDEEP 12288:dh5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:dLixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1C4652303BFD5C2CAED4A273D909A53FDA6C6EED1281405C3D257203268BB6DA5D3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 a3ed5d20cfe275868ca478504fdc5d0f8620041771303e0f4cb0113953350f70
MD5 c7b353181159e210635902af21198abe
SHA1 29a90005f283abd5f67b1ae5d92d2a6980c39c57
SHA512 8507be7977464a1cc9e6a8db56a34f86e321b27effc7560c54a6beeb1228a14c723f139f679211027eecbd010ce753f4279d68a0c440b9d0ac6bcf3593272708
SSDEEP 12288:Y35i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:YJixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T124652343BFD582CAED4B273DA09657FDA6C6EED1282005C3D257203268BB6D65D3BC60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 d4b8effadf2426a9989ac584ac95290b583b0ddc887ad038a21a0f606ef132ce
MD5 9df24126b41a955ccc6f37bf52c83d8c
SHA1 bc832cc8a12ecf0908b6f4ae37f5961f44c025af
SHA512 52348b96eacfc1d9c597c6b05f77118859497c3d4f5f1c63fc487819e78b7d9dc688f37d6f2fdf3d3a5b40654c064a64762745ef401beb74f8b06898b4587d7a
SSDEEP 12288:WA5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:WQixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T121652303BFD582CAED4A273D909A57FD96C6EED5281105C3D247203278BB6DA5D3BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 6b515f981c5cdd2516107904f68ef5dee3059f96b3847c3f86823d351cf85669
MD5 017e936455b57f59add4cd0e2ac1a004
SHA1 f9b7a3cfb6025e2a90f04b48a93b952459d775a7
SHA512 a50a157284afcb3a543684ba7209f8ab4d3cdc7a3415d338b2be2bf4a1e82e9c86045902c7cfb5aac82181582a576fbead248dc1a9776ba6d0ad14182c3289c4
SSDEEP 12288:XK5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:X6ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F7652303BFD582CAEE4A273D909657FC96C6EED5281005C3D257203278BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 83e5912cb4c16d2b336a3c5ba509b5b434b3331c476ec2ccb5fec70f831e7cd7
MD5 f8249a42f959076bf6f1b92d6f3c6a15
SHA1 c9e61f96efc97bde8ca54861ad7639873c37f87f
SHA512 323162a90622298179f5d920206d14e51260871f6b4d22e9948e834edb4154621008dffd93463c026899fc7dca3536161195a4f4f3abb5a07b0aebfea8a6a929
SSDEEP 12288:Sh5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:SLixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17A652303BFD5C2CAED4A2B3D909657FDA6C6EED1281005C3D257203268BB6DA5D3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 ba4bf5b9227e8da3f23e70e07f875e6471d57551002b2d6726c8fda73ae1d59e
MD5 02c968ff0e33b466e9ef425020e6047e
SHA1 fda39c987317a07e3e134c999ccacf371499496d
SHA512 cfeb23ef3af7349dc2d5641e775faa82d10a93925a6e8c0929b7df850972be747b9e73ac621e64a3a06cb0a671472b81ee7aa4f977923df1f3b5681d20e42281
SSDEEP 12288:ZS5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:ZiixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T115652307BFD582CAEE4A273DA09657FD96C6EED1281105C3D257203268BB6DB493BC60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 77de39245f1fd6b988de429cb29370a5128faf4a0870355c5d5f092dd4f989df
MD5 3d38b224729572d5ebff0b8243b4913d
SHA1 df9c10645fed4acca9e2a8452c4fca0f8350d3ec
SHA512 9262eecc511362628d5d08471862e86cb8ff84325b58f5ca2a67a9645a96ddf5f195ca236cbebd5501219aea90dac61f3a2afdcb3068294af5f6e488ba4f7c21
SSDEEP 12288:O05i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:OMixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1D6652303BFD582CAED4A273D909657FDA6D6EED5281005C3D247203278BB6DA5D3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 c1a4d7428e9829ffc7a821c238f6389a3b4ca254947910aca7a5072be33878dc
MD5 b0dc84268928ea83d8c4756854caae1b
SHA1 e43c4510fa0d6fca95a9d0b5a0222bc0a42eb327
SHA512 9bac304b95a2a77e49595c1930ad3b81ff2299cdb217a0e1ac155d1200efd1abb9311b391c1f17a84500d4be5ed68b0d79fbd7962d8b15f5ff50f109947b9d1b
SSDEEP 24576:Pfwvok9RX6wkyAImixOFthHE8MEX1XsdIAhb0VECwN:pMnYImixO3hHE8MEXWI4bMQN
TLSH
T11595D029EBDC44E5E1B7923C89B7460AF2B178691B31C6CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 584b8be3f5e4b21dc036d225ee89d5a239bfb9a95a1eeddb2a5dde6ce807cc2f
MD5 d2293ae6ee5e5321be0d74e4dd311336
SHA1 db388e95a2f6d4694f584699e18d85de4a722275
SHA512 200e11cda2f95a051f21179ef84919ae54976260d749b8e6e7545222ab015132e58e52cfccd75a92e71adadd58600ed3bf6f6daf812e34bd802cc183a400eff4
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nixO3hHE8MEX0:fySzPKo3tzfG9btN
TLSH
T146066C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9c50f99ad254b5b85a869156d6c85c262d7e3855792883aaf8d19c707ffded4e
MD5 3b460e41603a714cdc67b5015b219c8e
SHA1 f25199f8bc0ff0a0bad0741241518ef921b28048
SHA512 cc39d5711050faf846fc09152d9d746a164d9b8e02a97da98cff42e0c84b2005071cef2b7c773b87fb2840ee5e678d5231dbd8785871898666749e4e4ddc2cf2
SSDEEP 24576:R47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYNixOFthHE8MEX1XsdIAhb0VECwN:R47JUQj1irIhCnDHUPfF/3ixO3hHE8Mj
TLSH
T1EB659D1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e2664d3768b2be473443c800369ae4a43b73c7bc36d9bed8ebfefe460407632a
MD5 7c122535c67d779cdf4027f1e33abe0d
SHA1 3060a19187943803c7a8e456e8c747ce93a92832
SHA512 b669d193a2c0f9d5e3e8c862cc84f95e07c2016c00c07318f30c61e7418bbabff4b98076ce43c841dda6f2706da895e2bbf5ddf25f1386d5cc91b295eb3f3d23
SSDEEP 12288:5Nsf65i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:+qixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1AE75F10AE39842D8C45E6239C7564B85B3A3BC6147E1D3CB92C1F53E1F766D09DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 bb8a83dd421fb7f224ebeb51d8d07919539e63f09efcee74baa6bde219587ef6
MD5 609f8ab8174fbad80a5ecad90062615d
SHA1 dbb5e7c9be4bb42781e4f80dd706429f2031eb3e
SHA512 0345d5cf51e33d0b7e8cb603a42f38fefa50edd42f8dafd1842bd9a59f2c8770892258ef4e95a43798cd66b932a9b0d60675eb6b59f98c536dc8977f56c090bc
SSDEEP 24576:i4mcUPrh9mYwRc/RCnSlDUp+pMAiUE0Sb3saWwnap:gcUThAccnuANdb0Sjcwnap
TLSH
T1D6352940B626D74FC66980335E32D2CCA7707C41EE04AF0773C98B3E9576659BAE6392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 efb61b307a098ed2a11511d517874e897cf7d2052ac3877a52b83aeea270b64c
MD5 8bfe57247e235e7341b8f0fed608c1bb
SHA1 c4821484d34a97084eaf126b39bc5ca3b202d968
SHA512 d8dadbd5d1f507610de660979b673281a5da3e241b4cf49d21b45deb856f02f920964c8abf2cc6bbfed412cedec0275867b2678981be923db8dcc7a7e76dd95d
SSDEEP 6144:tw4TnXmXUe4LYFU2KoK+PJn5SSrItMxz6rjrQr9rErlrPr4r/rkLWMDYHaJH2aHb:BXkjmY1KoPPL/vRVo
TLSH
T13F65F9419537E38FD1BA50320726AB8CB764AC077A456F26B3C8453ED82BB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 669500ff5c7e6c87b588f4448e343e81da7717ad6ba9e96246932f8d3d72375c
MD5 82b51c4dfdeece26dc36b067ea338cc1
SHA1 37d9c938875562c78fc34eae7b268e9b924d1ff3
SHA512 a90c8a8409548b39632e647325153eb721ad5e11e53a4972747b1bc64e859e8702e9cb009d676bb695e4e9f32e880dee413d951419d65f2e77764ea37b6ce5f9
SSDEEP 12288:NM7C5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:mSixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T161652303ABD8C2CAFDAB373C505A97B866DBFEA41F1084C3D103216668776D69D36D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 942a8fc12da20fc457b9295c6132b2cf520736700a382efe37e034d0bcf319d4
MD5 861d6fc26ce62dc6ec55c4c8fee3de38
SHA1 dfae927f43fbc2f7c70e2edc8e3f2a7e1c66a8da
SHA512 9dce1c0d252aacd711e7b2a692fcfbba4cd1e98b7f7482b6bfd0b400834cfd365779befe04a53840ea6b1b1b77daa676301a488652cf35dbc2186e529432b85b
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYIixOFthHE8MEX1XsdIAhb0VECwN:Lgb4mBIBhGFNixO3hHE8MEXWI4bMQN
TLSH
T1F6659E1E22EC02F5E0FAE2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 914ed2568f1641390fdd6b113f41c796f4ba1cd0ec6288515f7927969691e633
MD5 e46b9e12c8c091f37f9c8667ef991a22
SHA1 2d829132f7e8d0d7269f430e38fed0fb8080d00e
SHA512 cf99a937d3aea482c586760d08500625c9a09ccf6e69506ed53a2f544467876c042f6b9921119879f642525a2aefa20f30552619908ab4d662c350ca2f985883
SSDEEP 24576:fG88u8FpJqH1bzria7/m9ixOFthHE8MEX1XsdIAhb0VECwN:u7ZFPqVea7/wixO3hHE8MEXWI4bMQN
TLSH
T12E95F16577E101F0D47BD138898647A7F6B2B8250364EBDF06A88A511F33AE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 53c8476e23a5bc1117dd2c7ad651c0734145be8740e1fbe1dffca61ffd5faed2
MD5 306a4a67043f92c1ecfcf3d01dc46132
SHA1 7bbae2624b0f062bc80cdfe5ad4f58f90b3c1556
SHA512 b9256821b36117f2788dbbbe5bffea0b8af929f827e8ec452eecea78078600f65d27a2fb2dc169092fde255b65ea0b59295861f5f06bc8958b98ca1729d30108
SSDEEP 24576:RPUr+NQBixOFthHE8MEX1XsdIAhb0VECwN:RJQBixO3hHE8MEXWI4bMQN
TLSH
T11B85E11F27E818D5E67AA13D8582871DF7B2B462071192CF0291817E5E77EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 98f41960992c92b1bb80cfc077fda5a98f92985e096a053082d26c8a46b7657d
MD5 27e06d8a269d3c9fb98a00a2377e4c59
SHA1 8e091808a7702c020d313e1932afc355d177d0f9
SHA512 bb4bc29011cf42949d7d0a4aa349191ff7a2456dc6a276a6ab2ee940066cdab2d36aaf6a5ba82902750a78e7358b3a43ec14edb99ce93208b2f538901fbcd9a5
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxixO3hHE8MEXWI4bD:fG05lO43bFo3tzfG9btN
TLSH
T146D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0848d6dcb30be900ac0397cc242165f9e52ac4d4646730f28d14ea6a6a2bbe8e
MD5 11a347ed366aa568fd5c9de978fe2df4
SHA1 811fd79b158ac3d58ed66ad10993af0b6f73e17d
SHA512 69af9a2e000b9d3d1c92de435638eaff840ec765223cf1a94538caadac15e800b16d1bf03cb959954ad07d4bde10ffd575ba9076e916937cf40753e28494fc22
SSDEEP 24576:Vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnixOFthHE8MEX1XsdIAhb0VECwN:1a5POZ3+Jt2pasx2+mJixO3hHE8MEXWt
TLSH
T11765AF5EA7FC01D5D5B9D17DC583861AE5B1346213319ACB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ccdbd2cd1abb99dbb49ef79ea954fe8ed390e9646158b3a39b0c5ade635229f6
MD5 8d52b8ac2f2dc6da19edc59c9e083f8b
SHA1 d4e17c8106804950ea03485bc472b7caebf9b334
SHA512 e6109228bac02a8917898311bfdd57b59fdb5e2f05629c6efa9602f74ec73502e03790d9bb525da386cb09a993f4ca54305b3cadddce1a36e3f205afebb7c433
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkVixOFthHE8MEX1XsdIAhb0VECwN:ONc/zEOVHFQixO3hHE8MEXWI4bMQN
TLSH
T10B857C1623E901E4F5BBE1BE89779646FAB1786517308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fe8771eac3f695d03f03b7fc88638e2678f491e4a9a4845adbee4f87d0c16612
MD5 cc7de473f5781689e37894ac62010e58
SHA1 e164536264856f82d90ca9da6a684bfe24b658d9
SHA512 a7d1b0849c103bf5f2ad44cee5b6c52a085452267cb3be7de04165d8dc4d29a610a8c35d77f5b64f5bf3c2427a1074b0324d62e8aff1cab8bba9691ad66bf50c
SSDEEP 24576:P8kNvNnaFeYhJNtmZBmDixOFthHE8MEX1XsdIAhb0VECwN:P8MwBtOmDixO3hHE8MEXWI4bMQN
TLSH
T1A155AF6EBBF846E4D1FEC6748D238512E6727461073292CB9290C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7524a83ca416bef953dde6986ccf64e686cd57d2f0e7d26ae448f3461a6d88f5
MD5 f77c37231dc9a589ac28925cc5b86031
SHA1 92b302d0bcdd339293ec9da4f55639a739d20d91
SHA512 ad8db823d0d17857336470f17de713f8e130f58db9da65e61afd4eba37580b6ba6716c2b80eafb6db0c51b74a6f83b1ec1324f987adb2019b4f3e795132fab53
SSDEEP 24576:4D3FHshBIYQgAeixOFthHE8MEX1XsdIAhb0VECwN:4DVHeBIAAeixO3hHE8MEXWI4bMQN
TLSH
T1E395E13EEB9C00E4E57BD17CD6638A06E7B178A9032155CB029581B61F7BEE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1804-279-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/1804-51-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/1804-52-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1804-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1856-75-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1856-69-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1856-67-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/1856-294-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/3004-85-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/3004-79-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/3004-80-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/3004-309-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/3676-328-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3676-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3676-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3676-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3676-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3676-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3788-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3788-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3788-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3788-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3876-118-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3876-312-0x0000000140000000-0x00000001402FF000-memory.dmp

Download

memory/3876-114-0x0000000140000000-0x00000001402FF000-memory.dmp

Download

memory/3876-122-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4264-8-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4264-6-0x0000000140000000-0x0000000140297000-memory.dmp

Download

memory/4264-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4264-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4264-66-0x0000000140000000-0x0000000140297000-memory.dmp

Download

memory/4300-62-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4300-64-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/4300-39-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/4300-40-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4300-47-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4300-46-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/5344-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5344-128-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5344-134-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5344-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5344-139-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5760-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5760-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5760-23-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5760-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5760-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5920-327-0x000001F859C70000-0x000001F859E3A000-memory.dmp

Download

memory/6028-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6028-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6028-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6028-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6028-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6084-109-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6084-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6084-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6084-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6084-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6084-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download