de0fcb0d31ea97f15b6a7b7ae1d79dfc8c2365fe4fc0775fabce617dd46222eb

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
Size 1.8MB
Sample260723-jsnp3atfna
SHA256 de0fcb0d31ea97f15b6a7b7ae1d79dfc8c2365fe4fc0775fabce617dd46222eb
MD5 19aa2586a92c29489629f069d411bb55
SHA1 cdeb3621d9258c3bf6e690207e8ba08f33bb332b
SHA512 5fde6a233b5a920c12948477cd64d26226d581c52e975ccb6cac76acd8ea4ad01ca53db7a957c07092aeca8d74378f7c0fbd2efd7c48e8dae0b4eb39bced9b14
SSDEEP 24576:qdy4mcrQDfwsqjnhMgeiCl7G0nehbGZpbD:Vh4Dmg27RnWGj
TLSH
T19085E05BB26850FAE86B913CC883D509E632B8124B21D7AF17A1466E3F337D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3600	elevation_service.exe
5616	elevation_service.exe
3532	maintenanceservice.exe
5708	OSE.EXE
3808	PerceptionSimulationService.exe
936	perfhost.exe
3952	ReFsDedupSvc.exe
3864	SensorDataService.exe
3424	ssh-agent.exe
5816	AgentService.exe
2416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\622fc542209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088b023c1781add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000608f51c2781add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a580d802791add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000733e10c2781add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c1085c2781add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5816	AgentService.exe
Token: 33	2416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2416	SearchIndexer.exe
Token: SeDebugPrivilege	4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4460	2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	3600	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4468	2416	SearchIndexer.exe	100
PID 2416 wrote to memory of 5640	2416	SearchIndexer.exe	101
PID 2416 wrote to memory of 5316	2416	SearchIndexer.exe	102
PID 2416 wrote to memory of 5828	2416	SearchIndexer.exe	103
PID 2416 wrote to memory of 1180	2416	SearchIndexer.exe	107
PID 2416 wrote to memory of 2128	2416	SearchIndexer.exe	108
PID 2416 wrote to memory of 1416	2416	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_19aa2586a92c29489629f069d411bb55_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:936

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a1d2a0013c4f655820fdbd4796c097ebe6967d25364943ee67fb1ee607c718de
MD5 3baabb3fc336773aa5f23d8aec8763ce
SHA1 c867912ae5d5a9aadbe7fa81545344fdadaa7449
SHA512 017577c0d2dfc5b7054a174e7b1d421758f1987e6db1799b4f5299ceee9e56916b58b81a70a709818728cc8d626ea9493e41c375d7c04200f5394a189bc88372
SSDEEP 49152:ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvDmg27RnWGj:C3q6HjBUD527BWG
TLSH
T14BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 840b0f29e5b2cb0bbbe595f62e664186929e675436146c5cc969aefdaf502cba
MD5 739ce33eb1455dd29f26bc557d2fa63a
SHA1 b258ba2c86b70ee4902c06e6d39fe5192a13550a
SHA512 ebdc4b0a70e405ae3eef5cd445bb7b801547756e2b0e355634708c87e21a2c742b8bf545e42aaead1335215a05c836c46379f6dab0147c6f04e06258b7a7a2d6
SSDEEP 24576:hXYfDtczA0sqjnhMgeiCl7G0nehbGZpbD:ktc5Dmg27RnWGj
TLSH
T1CB850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b5e0b6b88c77497536b7626bb9d1c687289e45c86a80c9f6823f89ed95dcfa79
MD5 65d6cc6149d101a07d8b3ad560937517
SHA1 c35c329c828c3626c4d36cfa89c35f7da6ed620f
SHA512 4d3c64cc6bc727b037c0d9c329ce5f6432141fed7ef5246f6755c1b8c903b79ba6c40c344d9e158c74c38414573eb1776c4dd4c04ee1365bca5ab242b7b6889d
SSDEEP 24576:s0Le5ji0hmx3rMjsqjnhMgeiCl7G0nehbGZpbD:sPji0AZ+Dmg27RnWGj
TLSH
T1F3A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5b8ade4f6ce8ae9db0735d514cf59302a80c599238e12aa56cf70f2822be3848
MD5 1688477cbe70113dd3bd034c6e93a631
SHA1 310442f960b8d7125279ef8785beea569dca9240
SHA512 7e4087a8550b1eb6f9c7a304cc017119ea977a926824bbf4108ee5f83ed0f071201d9ebaf4c5645af6964e4e84f41d95a3dc7401af1e8e48fffc75935f20c9de
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyu1sqjnhMgeiCl7G0nehbGZpbD:E/ezSC6vUzPvxHjyaDmg27RnWGj
TLSH
T1A2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 917f545724ed21d58a92ae796272654be9c8002ef706d6f86c30ada50bbba1c4
MD5 5086f3e5f08b9a46cac3d4603c56bed7
SHA1 15a5e4734fa4df4574187c040896b55cca8de024
SHA512 f3e2b5a2307b0acae3c3eb4272da34a0f142b6d74de1a2507971201ac0b20507c10c6efc6640de06e4ecafe194eaaa5a316b180a76cdeb32894b688768cdcecd
SSDEEP 24576:lVbqPb88hv/l+6YsqjnhMgeiCl7G0nehbGZpbD:lVO88hXl+DDmg27RnWGj
TLSH
T104559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 567f1257754fe5643b538f2d82b18be0506dc6755dd740eb8bd9e720f641433d
MD5 79269c4db4a7eef69ab51333672a0426
SHA1 514c831f9d74fc3ee0d977dc6a94f0c8960fcf93
SHA512 60b841c6abb962d5f42886cfb7f89ea91dbc3d8303fd9fd1b74c7975e2e5da6c0d1b2a31bfc152d6970c4ecdeb1ad7c6dfd92457cbdd0263a9c82cfec4b0919b
SSDEEP 12288:UXXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UXXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1646523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ec94618f3a02a180776e4db867c7213bd1e7e1e3b88237cf15b831582e6b6255
MD5 5dcb46a34f1041a61b03959871472a92
SHA1 656e1095846d0acbce7837d7f48482b30ac8a328
SHA512 d0c276f4ea7f4de5505ba4a39777182817468ff956130b4bf9ead3390920eca683bb984f24761fe35994b8acf98978d23d8f76560ff155948190e57e145820df
SSDEEP 12288:zeBNUbTVO86UgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:zJIUgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1bbbf1a5054ecafb2bf15c80c88ed1ac208013f4a27e0a33e4202bc841a96746
MD5 b07190b27bd113c1d13e05ef610589c8
SHA1 d538ebaa6b7daf10a7cb25231653349fa0fc3ce7
SHA512 5d04dbd436272781789cb269a765fb36d7948601f408e20faaa78b19c865fa2f57f7a50b169d3245bc1696b4d8d59672bf84f692d03ccd1850492996614d19c7
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:/QvGAdlCEL8c/yRNw5CZD527BWG
TLSH
T129266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 5095134d2418e32ff8d4410506aa85dddf0c1beef82dcbf9c21e78bd654b8041
MD5 8b1a961e8e5c10e7c98b7636ca376245
SHA1 76cbe1bcbcf0a5d2d57c5c607f3cc333d7c507c4
SHA512 6282a191a4237e8a252a6f35e7bbad175f469924bd5fc975241697153ca1300b09ca4e600e5951f11d34ee7a4340cfc70902de8d6f47d6e2ff2facaf22c78caa
SSDEEP 12288:nAwSfxL/2Dc3RDLLmt0LDQewsAjaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:AUewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F95E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 53688d43668f2ca5ec2bfb948457e8314bd11b0effc81592b261457604b40a3e
MD5 1ec9f2c0ec9a297d404ce4fb901a4f1b
SHA1 6d1db270f23bfe48093bbf3e8177385a0df7fc38
SHA512 c6cf211f2dd68b5bc0815f53bcb64cd2c243dff9784d465079657c22bb28ae09b6c1d20758fbaf006f3b5ea576f85388c612df11f5c7ad892184bf91196c9110
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2VQBWG:WUEtQevvqc2W1cpV2EI32JB
TLSH
T1FD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 286207cf1ba035522275c1cf41f7776ffcb7dae025a83cac8bec2d8ea5d5cbeb
MD5 3840108644185cde8694dda66cb11f59
SHA1 9583985e5969cd6d0ac577fd1b77e90331a9f16b
SHA512 5c363d40d91276da305c6d3461a98144919069992dac21e09c121dfa7da6c49c51e6cdcef37804d23be74df0ea0b38417d7d1a7cdf9122157b6dd83b2f821a23
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zODmg27RnWGj:1oqtVjnmVD527BWG
TLSH
T18ED58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 22f9d28b8714434cf2a081f89e8b5d40a3a13334a4aabd0657364c413c66f0d1
MD5 7ce5da425da2e46e020aac38454316fd
SHA1 738004871a11b0a5f05be3ce3a50f9fb59f16177
SHA512 d9a69e8fdd21a2772090e4ac6db6a71fe977afcc1e0fe8ee694f7d1726866d012f8edf8a9ecac4feb12cd5bb1acf531352c9c82cc9bcdcd0cb4f8f7ecf5e6e41
SSDEEP 24576:cAhGLJIFoiwtA5l7S53hsqjnhMgeiCl7G0nehbGZpbD:cAMyFoiq5FDmg27RnWGj
TLSH
T186359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2a805a1c7417487f71b0b7091b9d2658b0575a7de42797a50417eb79a9178ad6
MD5 e1f4f2f390ee24a0657e90b0e7599f81
SHA1 5da9f53dee7b789f9b7f295b292eacf8342b33eb
SHA512 49ccb8b13135b6d1794f71168202890c83545d095679f20e38432fa71449a9c630cfe23366d6cb1fad11c5fdc609d7c61864f4de533f4aaf150cc55646ef5aa5
SSDEEP 12288:Smw5HEjsChNzBFgl0WDm+CVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:LwuSOW2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B985F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9153f6925d0141ca4fc68335350ef2c6f9aa220c79ae644cc5b2dca553c5b5be
MD5 273be6406d72fcd7f8ba228672dfaf80
SHA1 d3cac416af3d24e14b90580c81da5d57947b562b
SHA512 ef3039d81fcd9b5e2922bf28e059d451f2346a84bd1278e39433f0a28466405c3a513c56c3f55c958edd9d181cac08ebc148002e3751602a1930e6239cd30007
SSDEEP 12288:pzZ1IyKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FZursqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C27512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 62d0f60e63a1292b19a2e533ebb6895658752dcad1c685a6477f8755c72c8f0e
MD5 a80c6c3c8990f15c9c3c01662af5326c
SHA1 ff946e3508bf7006c89a93e2f476115229ac336d
SHA512 e1e3d127f529e9c6482bd2c8caa95da6ccbc224a5eaa0953839f75e592c81c1c11d337efb4e3357f62532050806b1c3d733e5ba257ea49cbd834b3c7daff1318
SSDEEP 98304:TQRQyi36YOcPQLvw2gAf+PN3ID527BWG:CQyiKayX+PNYVQBWG
TLSH
T1CF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9799d98102f9890515ce1401a546d4674596ae2e89dd07304afd9e3e96934d86
MD5 20520e936e7d68407491af8101bba22e
SHA1 0be27b794e98c70a468c19f17d2a8ad67999fcd6
SHA512 cbdd4cc3939a29dc7c704e086bf95d26b90d37239438f309877ef55bda61a7ac9cc9191a81e0673d84dff0d39234b9335f68d52b2d1c9fbc05cac328550e2ecd
SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN3ID527BWG:0QyiKayX+PNYVQBWG
TLSH
T10C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c9fcae61d18591ed218ec9c48695db9d98308b93514f76759ef1b256f7d0a822
MD5 68ce315087fe0173a5553c36287df53c
SHA1 39111d6a15a167ad4bc0c95b587f80ea3d400399
SHA512 08492e6b25c9e2be8f73f192b1f7e9fa8a39b7c8358357c2c841aaa3826c5811b3db89b90addc1f403f7e00f9a7dbcb92a9c9e375d3cfb5b7efadaab9a7f66cc
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL07sqjnhMgeiCl7Ge:G68Qg55nhheWu7PNU3/+Dmg27RnWGj
TLSH
T101B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0051f965db451b17b36109fd8fd81eb8f949d2bbbf8f2a4e2e69571105d84af1
MD5 4689d5b90553400322ad2d6e1a8faf1f
SHA1 14d647686af0b8880b281c75344f2d0531e5735b
SHA512 eae793de1677ff14ad28f6dd561aee91033a46f6e0147c6c7dbcc9a641e2b63e7c2652b0325df1e63ff943883ef1dd65613249f3a2cdc4eea7f52ed8f7cac5c2
SSDEEP 98304:By5112gYy5azzVvL69nLKnhZrD527BWG:cLIHmWhdVQBWG
TLSH
T17C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 506e63b1e9d97e07790e6f3c822830266dfecfabe6b02c6f4ccdd6cac1f40d7b
MD5 15a2e43828c6ad061050021a950dc393
SHA1 2b944a565e9ff6e5c9cc174cc65f6ff9059f2966
SHA512 21fc196cab5dc03c1f8d20019ed69035142f8bd65dcdad89a5d1e20bf694d54e492c6db4d5156493d818814ef0f7cc4e07668a2c7b717740196ab2469aac9ed2
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgDmg27RnWGj:gu6JmVxd2dgD527BWG
TLSH
T139D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 84d4c9e9cf0e7d7c5e11856f8c35c474afbbf6649ed305aa88ce41fe3d83b43a
MD5 b5913827af6ac9184da785dc5976a2fe
SHA1 71bf4761e06f985990cdac682b78f7789bb6126e
SHA512 9a5db2d20910863bfc82124694de172d7a29a04ee7dbf053f202d4f1bbbb2d6da82f0edfb3a4ba188067c1a59ebf4c78ebd626325954e374a8edc5ea40a3edf7
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4x8Dmg27RnWGj:xmifPbRVD527BWG
TLSH
T167B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0245736491628a18039500b4c1ed7dd9fa0c8140da7d8854e556c4023093ed25
MD5 0796622b9a041e01edf5c6b97f96b319
SHA1 8e91e644fe74a1271a55d522a3530b706af462a9
SHA512 1fc8eb3e8028c02a23aae7882ca2ecda9cc6b78d63fab7abf72a1769d45410e0829e85250aed302e38d3b5262952611ca2da2f100dadce37533839964c01ec6f
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqfDmg27RnWGj:X5dKTi61fD527BWG
TLSH
T18DC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3f7e4c2cf79853ec5cdca5eee15dc13181ae92a3773debbd384e0ad00688812e
MD5 d2470e005398d430f5e0054f6d393b49
SHA1 e3a06b897c4dd29ec8770c828561ef277a8f32df
SHA512 7f0c551c3eb38ac242c704639f88bd058a806f7cc07ee1ea92767509a47066f624d051aadc108c5cbb85bb9a3d3dd767540205c64b17e2b491ab2f2937890ce2
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wQDmg27RnWGj:ZX2iyphBD527BWG
TLSH
T1DA95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 fd9018ea6e0e1e746476895165a94243b6feccdc241b84419adb56a89af80e4d
MD5 897c61a91c902a5b0025f63daf427cb5
SHA1 b6246faba1d088fee08758d0bdac54d9a6721a06
SHA512 d981c426d7bba6a1ecec339cf5554bab60cbbefb08afed46a40a981c02e1ac4301443bd18edb0b81f20ce35f35eebad8893b7c9d838d5475499b5a0ec3ff5805
SSDEEP 12288:DfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB6523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A677CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 1bf862cea59b0044fec65848f3783791e1ec2241d253114ac106c705de8e6637
MD5 d6467be90de38195be152f5b4a3ef606
SHA1 8ba81373842e0ab0e69e4388bb06f82aebc97187
SHA512 9ca059dc2e6de98622d297a1b39a6954ca262601b9222e0b96c0367626558ba555aa635af1a31c58b48a5df052c0839f701ee694a6a15b075d4564e400a7dc75
SSDEEP 12288:6uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6usqjnhMgeiCl7G0nehbGZpbD
TLSH
T1686523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 369b0b43dd535dfb26b08971ce04cd714e13eb8eea220482f38a24689ddf8aa1
MD5 9774300762d9a55623ea3422714634e8
SHA1 b8687da2e8493e825a520e0c28bb97f5faa1da3b
SHA512 fbecf86d693fcbdb9175a5b2ae4eb3e4ba2816ab33d651ed90f575109aa248a38a59eb789637b330bb75ff4d20634ff5851d71ac31529e19d71a1f0a2e341619
SSDEEP 12288:/oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1606523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e2a47e58e2ecc93f71b90a5396bf5b75c54b58bcc61284279ef8ad94ebc1729c
MD5 e4b705e2f9ea199e0a3c757efa9bb999
SHA1 a2eb7879f0e328619e4cc1dbac7fbfa7f3e0e595
SHA512 20811986ec8db87245f46ddb181820e61356cc33a9e11c12912d5b5aae9c6bb74dff57cf287099037873d4d846ce92caa0db43250bff071a1e75ea22841c21f7
SSDEEP 12288:SVBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F75236F635C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8caaf4612e9877c7ca82b1f0d525a9ae7c82347ba40dae4bce4712638a32a95a
MD5 0b24c7b0d6e5c9a7bcfb6ae7ad03eaaf
SHA1 344fc58affa18580939985268954e35852eaba3c
SHA512 d982ce70199f028581e295c549b8eb1c4c45f1357df2e3573d4d0858a8a2c1f393907ff642f75477050d53efcbf05fa299a876329d9570ffe876d827afec9c1a
SSDEEP 12288:F5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E06523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 52bf8e3a2d6e3c8b53afaf3acbff07cc98d0167733251b6d7ced3a6589d141ad
MD5 be08717e76b5387483e7d186475264ef
SHA1 fcc7b3267758552db60bf625e0836dba5529cb89
SHA512 6a87576493289cc629f3be1f204511333c870d773421cd22bffd2e8616dd41ac55621fea7340b4f21f797030c808cffb7539317f6f445b91d53457aed25b391a
SSDEEP 12288:siXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1846523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 d2817e3570512ebb9e40e5fd50806ae27958fce5894f163dea720f6b28f98497
MD5 70de70a9e1b2b3e66974504612a93bcf
SHA1 ab5aa1cf6f1ea83f67f114d12fab1107433a8aec
SHA512 bc9be55027cdc9f9880d0b6f83d7a4022b427d7d31675e8aebf27804cceb97a89baae5d00d299954cd7cdf4f9dcba9bda5fe5deca693f75eb761825163125249
SSDEEP 12288:MGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1456523BE965C41CBE52644B5C3E5F11DAC073E5BE9200483BA6B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 301a16678962ca67f700eba1bf246cdd48d85dad3a6577ef9b4eb424da0246d6
MD5 7c75c523709389b46ae655021c74207e
SHA1 a6d93ad403f44a380044e007eff69768a0e288f6
SHA512 d60db4bea94a5d4244597b23b5dea2e8356f0373187eca75b5fc1396a3b50d90a40c27b5f4f06755078c40f453576c7d441fd3a727c1db63a6f4f52b95759fd5
SSDEEP 24576:RZMjzFVSOOsqjnhMgeiCl7G0nehbGZpbD:RZMjzfWDmg27RnWGj
TLSH
T1288501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 71ced0821a71b48689f6e4a2705b4d8e26cb140a5de702435dbbe15beef5578e
MD5 6df9b7d1073b9df09bc1452f1517b360
SHA1 567565e8f8bbf314311f984adc122bc83cb7f300
SHA512 42931fa0edb38b00a13aab34145fd7c975801e0e7b6cdc3402538cba26b4ee055ac34f3d76c2e60f97968719d17c4d736067a01341dd28a53b7538cd15a140fd
SSDEEP 12288:nbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1106523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 890ad381f02d57a5b63aaab433bb6d6730b2a0620a8376153b9ed41ced815f37
MD5 dd3ec1917b2b6f6f67da29dae5975a87
SHA1 3a984df6a500b68ac9a3bdfae981a37e5a0091fa
SHA512 aa4c406f97f908c9e3eadf701a8f05ce89d63c87a153de32b97d1f456876bfdacd78824353dae0e161eb80eb5aef63497585831c35516857099215a992cac411
SSDEEP 12288:5HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C16523BF965C41CAE52604B5C3E5F14DAC173E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 e6d9c62eb2790cadc9ef8ade183f0952be8f6914abdb253cfb853dddb59185c3
MD5 85b73dcfdcdab60c00ccb1eef38bade9
SHA1 0bb401b5a650ca876d24ed51da4b54e2ec41f6bb
SHA512 6ff95f5760457f8cc4bee857fbe1d54069f7ab5563ff285b89b4407e09d7de8e56f6ff883a4c7c4268ee7946ca24777350425ce0576c7ab4c94cda7f6248db18
SSDEEP 12288:tyPz5L8KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EzyKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16675125B73A530F9D1378138C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 f4d22ffa60bdb11ae4ec0dbdbed71f9d333716b1b7e9607fc687bbf79744bf96
MD5 f89a7bd810a3cdcf759900f7164591ef
SHA1 3f93b2e36b7b33f86d36e2700c6d283148eddcb9
SHA512 b6cea22feb04d5a6dcc779406a8fa0e1df9a6ed139b458a58afd4c83715c7fc498b91493ffffbdbe1daadb1a5652e192c45d785f878b19067362f372470735c5
SSDEEP 12288:1bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB6523BF925C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 5759d1de3a2ae783d0afa4f5a1e63c02dc10eccb0b3638b373989db91251bc44
MD5 6fe913685a8d6425520a59885a4591ac
SHA1 3439ab869642fc6dd3187fe2fcf6d92e48fc369b
SHA512 890da88e2fd34ae95ed80c0e6c9e7e1c7600941f55d0f19ae835187f0a472cb9ccc8cca28a64753be682a7107a8ce3b7e6b4508b34b284405a1ca3f1950d7ffa
SSDEEP 12288:mbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1566523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 af6d0db853b2a60c3261a67b82d27211e173f3a9976cb87576be6863a3d7e607
MD5 a4a4c4e87e9db4cc5a21ceed147b5207
SHA1 20869cccfc7da4b89a9c11a4844514f7e913b928
SHA512 0c98a0a8956472e128e1341ec60d88958bf37c1ba902c6c891553d36a8d3846e52597c9187113267038f39b534e912cef4366d41d32a8dc2653b37f44738aac6
SSDEEP 12288:7yPz5L8KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zyKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E575125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 64228fe3ec238a1e2cdf82ccaf7555ce300deec49279390ed5fa8fc27358f4d8
MD5 e4ba11aa6fbd4b85b2675cf15441925d
SHA1 9a2fd213e83830dca84c0efbc2960f5a3bea4f8b
SHA512 6f2ef0f49d5cc9a021e5493bc0085d2ffa857f4da6dd87d878506fbabc3fd6ef1407032b1e06bef80e7b7e97f67c2ac4b52a0399eb4ead7d0a4cceb26f953ac5
SSDEEP 24576:aTYaLl3z0zD4sqjnhMgeiCl7G0nehbGZpbD:aTvLljpDmg27RnWGj
TLSH
T1618501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 2e6cbbb1360f93a56851d230eb4256a898a4bf13977ef0507d379a9d65f9c8c5
MD5 237820ac3249017927ed2229621c828a
SHA1 833df86a18025a57c5d868b156a78464d066bbc7
SHA512 41e202fa3d26acc5142a664a9afb9c04fec41883abde0a8eee27e444afc682c3f709294298afa4d946e79231034646f98270c022b12dbbdcb968a74e8d195485
SSDEEP 24576:q35d9CHKy7GZ8sqjnhMgeiCl7G0nehbGZpbD:M5d9CHKyaWDmg27RnWGj
TLSH
T17B95CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 8ae45e5ecf9cd8c6aa64bcc764b49b53e215ba2f9f5bd3faa96a352e72cdd1d6
MD5 bee29a207c137271eb268c2c290e6e8a
SHA1 cc70f35cfcb1b102f722389e3f6f2c4ef8bab85c
SHA512 c5a3821a51ba6f29f99cae3ac935644fc69ceac9cbfec4392f57c893f3babe4b88167e3df58e98d02b3a2b5c8257963ab265c52e770ec66bcfcb9c26d598148a
SSDEEP 12288:6IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E06523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 1e63824c3ad9141d61af01b5ffdbf7bfa86a6c1d3b792c72f11dc6d1352125d9
MD5 25528663925a487bacd705533694f9d7
SHA1 ee1e2262e88d3b1a10e614341d35f3241f4b8793
SHA512 cddc3ac10e07192bf60ba78933b6e525b3e00adbf35e0ef02f034aa261b33fa43ec445572e57f949aea27c1c3602270c3185b5f13074d2b0a8a7b163d9f72277
SSDEEP 12288:2qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E6523BE965C41CBE52644F5C3E9E10DAC073E5BE92004837BA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 8a8297909a4a08108a097dbb293bce5c727622261a31aaa7e07d34d206bdeb13
MD5 52af91045677212032f06f7013a115c1
SHA1 3e7d903b62d90cd2ba03d6b9b3428fd6888ed3b5
SHA512 5debc5acc1f79211e48f9d37da3fc3ede9b7416bb94414f3bb68a3706008e63c13925c43113d871c0c633298d3d5132b7385d431ba6d9cffa9c888094c8b5c71
SSDEEP 12288:0NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B6523BE965C41CAE52608B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 626c492f0f9d722ee9769d50c1fa64ee65611babfc9c4556e29fc42bbfd80246
MD5 d0fab795751ddfb1d7d4f778f022c6de
SHA1 2a2355a69a32165ef114ef0a0c760bebc550bf10
SHA512 d1bd5463431547dc0c38fd105ade6f068baac0addf33c45eb5697ffaf4c4c48d9f5aca910c390e6fb818037b6d950c7d5c1cf6ef68fd031cc5e0736acbccde59
SSDEEP 12288:QbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1616523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 2f2436c5e3154aec06d5366475a13a4e91623e9f31f76fdbd24a774f946e2168
MD5 80af003bdc0b9d383cf0542b75e4fc39
SHA1 10c7f4e60ddbbd7f46980d1e01cd91a20f77cb81
SHA512 1f62911eac92be3aac37cfbdcb07d74a5dda7bf02162428f05e2c7ab407e0eb06136842d50a40b6c788c223ae81860a49eca033dcf2cd9f5d7a4ac0913edc606
SSDEEP 12288:FIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1216523BE965C41CBE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 06f69bb7e3b9cc0ad6647124f90d9985e0e878cb0da8e6d19ae6ef2babe9b145
MD5 75871507560db3531605d2be46fc3f09
SHA1 029d66a71b316a581059dc1f2ce4a677cf0e96bd
SHA512 bf808aeb2f404f5ecdf77a5b04e92d9adbc62427af3e9c4366fbbe1ff773f9249a1f3f24540c79420a85261c6d767b1e33c16ab416f8ed40ba5058452b4c9565
SSDEEP 12288:KzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B6523BE965C41CAE52648F5C3E5E11DAC073E5BE9200483BA677CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 b1d46130b8a024839fc87d0ca5e62df112e2c4db58d45421974be1900f221aeb
MD5 d527f3725f915602610ec3e4463856f6
SHA1 a80e38822e654a768802a9291bb230afb87a600a
SHA512 13592820f473f26e4c623ad87e2ab9048391ae5b0e6d0d2c2d96428d1744cc0c8e82b424f4d728a5dfafa3662b4149e7d6df9e2958854e91d9d6e6a3719a6654
SSDEEP 12288:J5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C46523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e8f87bcd2d4fda6717ffde258e64460ffc4bc28bd7912d1008e4833b08c6f093
MD5 38c5cb5e5c14691d0f2f289a69052cf6
SHA1 8fcf473b3c7cdb3b92219c1b3c95fbc6ea9f0e8f
SHA512 e94886f5db76447fda82271d8674578524abcfb1a92ca4519a12bca009abae5dd31d7875ca06685bdb5f9b9280e26a74b3eaf50326d180bebc77145d3489b245
SSDEEP 24576:ofwvTk9RX6wkyAI3sqjnhMgeiCl7G0nehbGZpbD:7MnYILDmg27RnWGj
TLSH
T18F95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8bce2ecaa800e4481977ce72e2d106f75f2dfb82ee5e18e1d94d623ee91b3a71
MD5 ebe593bd36a0461a005d25b92dd56b17
SHA1 ce7f203d96ac9b1f5dde3fb473dda7be96d0f4a4
SHA512 c6af6654e142f3aa002d366a399ef736ffb5cb0b9725cabdc0141dc3eb20cfcefa8390f833d6e1e9cf6efe73056736b187d331ee6b6f0ad48163a829ea22c279
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wDmg27RnWGj:BySzPoD527BWG
TLSH
T159066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9b1b95045857713814305662f09f01a3063c4e7d1de3b80965c2990b303fd56f
MD5 0904b42032da9151a62b6b337c3d78dc
SHA1 57f7d742f2d79bded99c5b3fc9f1eeb82ce11633
SHA512 f31b750284ac652a6a774f20ed8911d0e2f5833a9089bf0c1404327e80d75f7f5f77609b88820c4e87d9ec656e97a772a066b44a9407f0baee99007d20fb7368
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+sqjnhMgeiCl7G0nehbGZpbD:t47JUQj1irIhCnDHUPfF/gDmg27RnWGj
TLSH
T10865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 8394f4ac3cc5b8de58fd45ea9fa7daa054990219226b6ba9fb9d3b02da54be74
MD5 fa1b28f833d4a9f9d003fe296ef4bd1b
SHA1 cc26afc10fd3935b669cdfdd2827e82c362d2818
SHA512 f591adc4297a2e2cab7b0874491d9b929ac05881772fa0cf3dc5684ab5cc5038a1a60fd1acc5fdf693673f177fc2f2236340086d2c69043127f0911183201b73
SSDEEP 12288:LjsfrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E375015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2799def6c7dc4050b7a3a43ad6e142fe1026b5ce6853c8e2389bd38cbad225a4
MD5 b36c7e7ecd5fdf12280a64f62ecb6776
SHA1 c6d82c9eeeff57e96a6e6d6629c8e3ef180979f9
SHA512 2ce8cf2109424c60d4158b2af1971977444b6491098b44424b5103755aac68432ebb012fe563c02a28e8f1c803a442da881306b5b6fbd4e39ac92c17e82b69f9
SSDEEP 12288:FlSkZU3f1PlxUa6eJ4jq64z57LuXPaRJvX+QBrHgcP6:rS4UP1rcjq64z1wPaRJ/+QBr
TLSH
T1EC352841762AC75FC6AD40325E36D6CCA7707D01EE056F0373C88B3F8576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e5b256860b3322f8be36521ec214cceb81147a6d47c80d0813d752ea21484774
MD5 eb12c2946d58093cd5a48be9c22f309d
SHA1 ce3c728cd828592c3f45efa6d446fdab0f51a55d
SHA512 5369fc4bc38797ec2a9b3f97145b713e3c878f40b1a50b243c7fbbca3e9cda5dcb8b0ded7ba3a2285b1e67fc38fba964f4be9504f6cbe2a25306eff51558fa02
SSDEEP 12288:9DdlP+Zk1zev6ohyxebO7j7xivLQbqVdrUkt45enFycohxT9gJq7SuBCIY4KtldO:FP+oz30tlhId
TLSH
T10065EA81A037A38FD1FB6031072A5F4CA764DC17B6496F267388453AD86AB25B0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 530bec49f2ed7d44c9fee7e758b68ccf42208ccfbe69ca6a2f9d80c989860089
MD5 92a6f281a9e4c396e4e17a1a095c88c3
SHA1 7cb274bc08c1ac93193aa310643d1ad17567c3a1
SHA512 1d7d65997f44f7d1fdb8e117b11912657c1d4087ae590026263518ca211de903be4fbe08d47afc3ee5ca72ad748e9fba732130a042bdbae47542d7bd986a4df2
SSDEEP 12288:cO7DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E65237AD35C518AF93609B482EAE12D681B7E669F1004C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f1ccf3db4ed9ffdd5223f207a8963051e1279e67a09560fd1d3b4de2a5e8c209
MD5 2a0a34d6993c61c5747710ea029a1531
SHA1 5e361f14d1c832a9af844bc7d412445404d318dd
SHA512 4c2fc6ac04a8b3666163921f24eabfb857257422226bda55c27545fcc869e307a24cc09f4a971cd7ee68dfaf84734712bacbd954620ebe9f7441d7e07ef16546
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bY1sqjnhMgeiCl7G0nehbGZpbD:vgb4mBIBhGFSDmg27RnWGj
TLSH
T15E659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 6b81f20113dee9d25f79a12e9c35330e64103c52c58159afacc1d83df3ecdb75
MD5 bf11aedcda470456adee8ee91cf4810a
SHA1 bb2cc3ffd53d86060073da0b4101938bcb600cc3
SHA512 ee05afeb2073d8a89e8cc541147ae8bdd007719a6f7865d9d04efc50f7cc535640b966c2abcd751b44e9f540a57e4eb67c52ed36a11ffcc2258406e95c7b5be6
SSDEEP 24576:UG88u8FpJqH1kzria7/mOsqjnhMgeiCl7G0nehbGZpbD:n7ZFPqVza7/RDmg27RnWGj
TLSH
T11BA5016577E401F1D47BD138CA868667F5B2B8250360EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 839209058c744d02e849182b82b54e009b12d63a6eb61c08010b581efe3aa4b3
MD5 cd608c41050ce5f57a9d9330091e436b
SHA1 20015d0d501145a6ac536f61f40c6dc41dc6dfdf
SHA512 53d56bb4c8c55c31ce028b3f7fa031531dc5f4b2096d33e1393b1a57a683a4836cb065193edc913baaf960ab565ed0c3d1a64c31755ff6c8adc61f0615c3f251
SSDEEP 12288:bHvUrBFrEjwaQSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:bPUr+NQSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B285F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cf15b57eb92acd40dc531829193c03e3f2630724665b12e5a8edbc50cdece075
MD5 192760bf3067ee815f8539af90803213
SHA1 81ec99bedd7b3e4db11f24e1bd6bc50323aab346
SHA512 8addac198e3911e8e1adbc2ad63a9451abba53e50c9ee3691f0d540e3f7b98abae32c82b7e185bed0843f0d5007f4cd03daaa6e1544d75fb9415f4da86b481fa
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmDmg27RnWGj:uG05lO43bzD527BWG
TLSH
T1D8D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ae2ba98afe52cead9d07119d601b276abeb970b1f67e4fecd0625116312472ec
MD5 d6530f36d04a97b0efdad21771245433
SHA1 121428895824bfde75c909ae9a26d382ef2c5a5f
SHA512 c9afda3ffbca7fd12dcf8402d9603705f14bf8f1a24de568bb992c9558de568022bd3d934ef5dc40e6c94fe0b2de8bc2ece55ff00dffbb523a5cc4a299822bbc
SSDEEP 24576:Xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnUsqjnhMgeiCl7G0nehbGZpbD:va5POZ3+Jt2pasx2+m+Dmg27RnWGj
TLSH
T1A665BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2c79346823573038beb4052c0258da576baa615d03fdd6005d3dacc3f02b0cac
MD5 47406b13ba5a99ecb62823a60c4e03fa
SHA1 d27eace499784abfa5a64e79cf98ff7cd1c02bb7
SHA512 8ac5600ae45cc2dae47734c8990ec7057f7a49705d0a9c8ae5e3e7af182bc968be0aca700d4be5fd99b868dfa8930346b4e5ca148ec5379d533b0818906fc63d
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkWsqjnhMgeiCl7G0nehbGZpbD:vNc/zEOVHFxDmg27RnWGj
TLSH
T12A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5007ee4f1a8ca2412c561318c153e087632406661e53465c6bad9aea90d64b19
MD5 a59839f653172cf30470554cc46a86d5
SHA1 30069afd43247823629ef3d8b6e6ad0ccd3a2661
SHA512 c9e007b74c90e927cfb0ecfbfd7289a944d6a36a12ef755828efbe11df40f712236afd64fda13e3b5228c68588d3e5531339fb601fec4643ed14947c0341fcbd
SSDEEP 24576:T8kNvNnaFeYhJNtmZBmQsqjnhMgeiCl7G0nehbGZpbD:T8MwBtOmMDmg27RnWGj
TLSH
T15555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 428a0e7fb714c68e70ff530f40f67a4ae0186b79185c2d0460f45c1b587b015c
MD5 b9190400b8f1c5bb0cebf7467ac1475e
SHA1 3e03a7091b4bb61bdedbe3652bed9f0f7dd3d6a3
SHA512 f0230eecd3cdb8875ef5b41045bb428edc4c801106f01d57cabfa548b486c4787195e0d2730b8b99abc1de37cfdeec3562c9bb251a9585a2a23f5d0922801261
SSDEEP 24576:bD3FHshBIYQgA/sqjnhMgeiCl7G0nehbGZpbD:bDVHeBIAAjDmg27RnWGj
TLSH
T1D795E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-78-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/936-83-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/936-77-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/936-308-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2416-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2416-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2416-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2416-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3424-113-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3424-114-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3424-120-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3424-311-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3532-38-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3532-48-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3532-50-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3532-45-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3532-44-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3600-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-23-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/3600-15-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/3600-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3808-293-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3808-64-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3808-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3808-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3864-100-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3864-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3864-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3864-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3864-312-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3864-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3952-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3952-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3952-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3952-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3952-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3952-327-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4460-5-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4460-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4460-76-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4460-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5616-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5616-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5616-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5616-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5708-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5708-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5708-53-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5708-277-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5816-132-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5816-126-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5816-134-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5816-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5816-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5828-326-0x0000020B27BD0000-0x0000020B28250000-memory.dmp

Download

memory/5828-395-0x0000020B27BD0000-0x0000020B28250000-memory.dmp

Download