6dbe63d4d601a84ef3a86efb48b49ee27015df32d813590f50434e04834b8c67

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
Size 1.8MB
Sample260723-ma3m2sbf98
SHA256 6dbe63d4d601a84ef3a86efb48b49ee27015df32d813590f50434e04834b8c67
MD5 10fd98f8e39d6314bc8571d828d2f993
SHA1 a8f2805bf06754fe84752099887de1bd4798f2fb
SHA512 29977e58412ee8df4ce6a37d857d2df752b57b9f6890a22e586d17dce8a24c93bb01b5c0513c3b0a3b4df34118323417b5fc2cf80027107f182c7ef10f586a93
SSDEEP 24576:2dy4mcrQDfLsqjnhMgeiCl7G0nehbGZpbD:xhLDmg27RnWGj
TLSH
T13585E05BB26850FAE86B913CC883D509E632B8124B21D7AF17A1466E3F337D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4980	elevation_service.exe
884	elevation_service.exe
4672	maintenanceservice.exe
908	OSE.EXE
3392	PerceptionSimulationService.exe
3864	perfhost.exe
3104	ReFsDedupSvc.exe
240	SensorDataService.exe
2820	ssh-agent.exe
3624	AgentService.exe
2684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b30ebc10d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084ecf2638c1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b3837a48c1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9743f638c1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b4366628c1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2504ea48c1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc989ba48c1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3624	AgentService.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: 33	2684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	6104	2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4980	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1440	2684	SearchIndexer.exe	100
PID 2684 wrote to memory of 3432	2684	SearchIndexer.exe	101
PID 2684 wrote to memory of 3088	2684	SearchIndexer.exe	102
PID 2684 wrote to memory of 3540	2684	SearchIndexer.exe	103
PID 2684 wrote to memory of 3116	2684	SearchIndexer.exe	105
PID 2684 wrote to memory of 3492	2684	SearchIndexer.exe	106
PID 2684 wrote to memory of 2568	2684	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_10fd98f8e39d6314bc8571d828d2f993_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:884

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4672

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3864

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d88ef7c13d573b593b5fc193f63f025d81397e0083b2678bb7bfe278cadc38a5
MD5 d6558e4e1c0716154cc372449d7a6d40
SHA1 942df892db322f964f3c11cde0f7ce795f176380
SHA512 40382faab749e2543c2ecb27b3fc3f8c136ff276cc7dac811fbd4ed38a1fe6bd0f417ee027ea8c587090d08695343702e9fee3144b73c4ae6b3a876bc0642761
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Dmg27RnWGj:I3q6HjBpD527BWG
TLSH
T1C8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 66019e1d054da92b181f9e8ee824cbf065d40d138645c1f4d21a637e4338435a
MD5 2b5b5ee77f638cb419073c1f391d5bf3
SHA1 ae03928c91ceb0d99df525dbb47c5ac5cdd06981
SHA512 1155d8989f3962bb7c824d2b627814dbab421e1ef11ee94ea4a695b96ed6db7d5e6905b26d209c6c26b05bef1c72365f1f1f85e379abcaaea35a9122f51c0c55
SSDEEP 24576:aXYfDtczAxsqjnhMgeiCl7G0nehbGZpbD:BtcIDmg27RnWGj
TLSH
T147850129B3E408F9EC67817CC9A2C515EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 553e454036cbe98c78ddbbaed3eefb653f14fcdb72829a02eb1e0f052252f94e
MD5 756ab7ee71d5b2f80d5f3b4de80f8f9e
SHA1 935ed25d7dadfe644a335faa10516a7a96dc885d
SHA512 49e05b71a7b59efae682f99d1609f0c9c19df0c49d097d858d00b245ad7be616c89e527f4d4fea038e9f48e97ec73d2d846bc1d6439f0206c0c5780501f946c0
SSDEEP 24576:Y0Le5ji0hmx3rM6sqjnhMgeiCl7G0nehbGZpbD:YPji0AZzDmg27RnWGj
TLSH
T116A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 09ac713017fe6f9a2b36b0b01bcb752f24dec98398a75dd310bf3b063e676f82
MD5 fdafc7a408fa688fa845fd2d72ba1c16
SHA1 fe07bd85fde7d521d5ab683a716b8308d1f7b17e
SHA512 5507febc6c67522511d27f82a53ebf30159708bd82b03c9ff5da5a9396fe74025ae0ac534f8c5f18d5deab2eb7de90f1d08015b95ee01ef91a72187cef4665f0
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuMsqjnhMgeiCl7G0nehbGZpbD:W/ezSC6vUzPvxHjyfDmg27RnWGj
TLSH
T126755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5d3cc14488f618156f4e0ee65929e9b5ca45b27d655c7acc9c2cc01c3f4827bf
MD5 e68ee29426543da34c20710317cc8023
SHA1 cb249cb8f212c361a5fab0d7c64ae64c83e9e4c9
SHA512 ec037d9044c1a54ecd72b151eb38c0d9000aa066f385f0b4279ec531c528addfa254a8f1b992960bd21eb8f1c1b90be7f13543c056a31f35009dfdf13616e3f8
SSDEEP 24576:zVbqPb88hv/l+6lsqjnhMgeiCl7G0nehbGZpbD:zVO88hXl+aDmg27RnWGj
TLSH
T10B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 8a5ca9a93a78e0346f539ed46b1d8146e346cd2af3d7920a10a72fe41e12a964
MD5 b6c8a15f94d5123db2e6ef3988f99941
SHA1 077d2d4407ddb9c89a650936d910753255adc564
SHA512 b4cb08bc0a43cd1119bcd504c0fad397a57823e8746d8ee13d0b347236a7414f65ec7840ca52d5472fc031e6c3f1f6ba63188584671012390f95aae44368cfea
SSDEEP 12288:1XOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1XOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1926523BF865C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6dc1c214a9f0584ff051c92b4cbea7d83f4a373b490143044dd72945bdcb51cd
MD5 f897649d3b2162185814cf859aa6d051
SHA1 5b01f1ee960afc156d69cb52eaddf824b7729fc5
SHA512 c5c2a02544b5e6825ad50e40cae7022d9c08337763300f9332921b37b09802a378d37c9bbc3071704756e7d9777696a25a3defc8057f9497b1b8603e2c5dd2bc
SSDEEP 12288:SeBNUbTVO86UtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:SJIUtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 035ab5d458375c86c00d6f1325e67a746d3e273f02a016cd17b0079ea1ad2df6
MD5 fee02140add736483b981848d41ec909
SHA1 782973a840fb842c09e090bce164d2a409b7a463
SHA512 7438c48e725ac7f936678f73c27c05364764d11c36309c2bc835d4ea457733ae027345dcd55830ef98aa77daa02ace3357bfdea6b7813a47a26e7a6140712719
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:RQvGAdlCEL8c/yRNw5CoD527BWG
TLSH
T1BB266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2322eb964822d0b687a57251c6e81745cc2d8541a8ba7879e5993eddb6d3e39f
MD5 401ca831d02d1a3f85270d545ad620d5
SHA1 be3d70c1af4a024995aea5fb5bea6cc280fbafbb
SHA512 a9257e5f7f85935fb2b398c82e3f973f3ee81917460fde9607a3538cb72ca9b9314e8b1bef7f1cf9a93d9c8a22b9e9729d2f501380717fc219ee90a78a9ba289
SSDEEP 12288:wAwSfxL/2Dc3RDLLmt0LDQewsAj/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:FUewsAj/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E95E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c886a7890f4a288abf88c23bdf9d1a036fbd5463181b395f39235dbdfb5036b9
MD5 96b8e841bcfc3ac0871c90184aa73b33
SHA1 dce68d96a0d52ae91f3896ae219a442bade173c8
SHA512 690d33d197ff31ef46ff8198f36b1769bcbdac1c9892d193ca32602eba2a6cbbdbc2bd20eac3480e2114ab9436c85b722fb6be662ed55a5ae3f7daaf46285160
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHrVQBWG:hUEtQevvqc2W1cpV2EI32CB
TLSH
T1EF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 93b28ccda2dbf0e51415d6251b055e7ee24c4f849ba347aa23938a099907abd6
MD5 a1c923b746b0d2847a05e4cc2148523c
SHA1 f0f6837881690a56033cbaabb7fcc7e09ad82e5f
SHA512 9ebee80b6d164f356f340baa1a4256eda43013d105a20d683921104a7f209305b48efc49285b1fcab76791e29d83ed52653d286ed717db80e531cf324d041747
SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/zDDmg27RnWGj:NoqtVjnmED527BWG
TLSH
T128D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a6dc8e4259df29d76931e6e676a18e7d0c34444337a86158a5515125dcb75788
MD5 a55324f5f0115ed9cfb52161242d2ba9
SHA1 90c9cd448d96668c748a1536ccc7ac55206cd499
SHA512 2a1fbe48a374e5af8ae7a51826f6f7dcd61602da8e9f5573c4c590594196df5f2b6de3b2d4cb4677a2ae3263f16a0e87b7d3e91ab1aa037c66c11af8ccd0ff98
SSDEEP 24576:pAhGLJIFoiwtA5l7S534sqjnhMgeiCl7G0nehbGZpbD:pAMyFoiq50Dmg27RnWGj
TLSH
T1CF359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c2b5017f6cded4200c930c5f7044685637fc5fe70cb4d99ac78ce9d3de7d39d8
MD5 21941ba89532b685d5fd7b7d46308fde
SHA1 31bccef1f388038b39a28570cdb0db6512eca4c4
SHA512 e6fcd09f4ee6004f93d77ff3cf3121afbccb8ddbb99e87c67bf7f00386c8ece617467caea91e557edd87f89f27281289ab792eac217e59a5bb2f0c509e777fb4
SSDEEP 12288:imw5HEjsChNzBFgl0WDm+CsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:7wuSOWLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A685F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9ec5ae5288170954a65f6995b3f25216983ac197fa98cb633d3e4a85afc81593
MD5 bc7306da9efd6437bd92b54151fd296f
SHA1 4c01fa845147f6b729721cdae7b1e13220ede998
SHA512 22db7816455abefe8abb37fb76ec9711805e849512c898a533a037ad0e257590a2e5e9b2714b1370e1a313be060a3ca320dd605ffc15a5748ed0ca42bb79e9f4
SSDEEP 12288:lzZ1IyvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hZuisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B77512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 43193a6fbbe767bd768ad2a28d65cff5f5edfdbb4f812751bf7cc9a7de1cb0f1
MD5 aad2f2f2fd438d456b62b9bc0821e920
SHA1 6b23a0babfef8f302048abe6153270a58e832ea1
SHA512 930c961487063c5176f9a19bb746be7b8614c79fe142dae20779e12f764b499e15bdd5f21d16098b77a49df2dbe86b1a75e6246c883ef0406951fc7e29e668eb
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN39D527BWG:rQyiKayX+PNNVQBWG
TLSH
T124667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 716191341f2e322f838ab6bd86c98f9d2b16c17651c6b4db3c6217594ff5f1c2
MD5 a2436cef7743a04c296860e3f90a2687
SHA1 64e083d91377396f8e52e704f7beec083ee71cd6
SHA512 6bfdfaccb0bf4d9a452b57529c7bd30e8f2585cdcdd852116c941ea430264ee299855e1623afee791610b61e1fc26225ec112c2d279cf28c838f76ef95ceab35
SSDEEP 98304:TQRQyi36YOcPQLvw2gAf+PN39D527BWG:CQyiKayX+PNNVQBWG
TLSH
T156667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3513bb49d7ca86e3b8db329fd903d8fe380df54a52f8c85c6f5091a0de8c92ef
MD5 8614e92c938a001a7870f12750660017
SHA1 3b4fea2a7374c61a33ae76196649509c2572f5be
SHA512 121d6145e16e1904b667ad621fcb5c23be61de592c1d9eca4d9a1fd247be6ba7dae908c055a02e4278be6118ffd517801e5819a6a902be372988e5eec2390b17
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ysqjnhMgeiCl7Ge:W68Qg55nhheWu7PNU3/zDmg27RnWGj
TLSH
T1A2B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4b6053b06da5647ddf0844c9c6081e58e60a5237887ac61b6cef817ee63b647c
MD5 6d87a70c792b6ded4b8b6ea6d82eda16
SHA1 756a6ae959dad27ad119ab9e6d2cf9de28bdf727
SHA512 195b81463d29b098266d28c100aa8cb71237857cd75535d994bef70be9197da5d7f3feed84f2a7954e2a60a9874643138984398825d6f1a9bd118096f1da141a
SSDEEP 98304:By5112gYy5azzVvL69nLKnhZiD527BWG:cLIHmWhMVQBWG
TLSH
T12F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 767db7dd5dabbe348625cc2ae4f38356edda06d29fa7052aa203a39dadf0e0f7
MD5 48f25e860687f06ab55429fa3a00844a
SHA1 70b9424c22cb40a473b274d4288b7d229f9cc817
SHA512 47cf0beb76a11bdf77c6ed40152724152bfebf42aef2e51bc5b34f42b64b4453df4cc67790a6b71ab55778f646d4baec38cbcbe8ba5affea8cdae51af562047c
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVDmg27RnWGj:wu6JmVxd2dVD527BWG
TLSH
T1C1D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dfce4ac8156acb612be8ae2d60e9a49fedddb69f59b30c0cb4c7caadf35a16e2
MD5 3cf97cb4f2a898ebf9948aaa5ebe3058
SHA1 4b2252828246eedb2750b4b33c3c93a6df870a93
SHA512 3ab972737981fb6a4a7223e608ddda943e9926afc16936314d6648ef9c2a43c98face7aaa7d8a1e3597668950010a38535d15a15fce9330ee0d74b4a81cb827b
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xxDmg27RnWGj:XmifPbRED527BWG
TLSH
T19CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 952e279b88a0d0cd91da6e4202debfd42dc4c7616c9941a8347ffeba6a9b27f0
MD5 91f8d8fc551e414dd4f848ec9c8dd192
SHA1 64ccfc54d73313ce3576da1d77e4168d017ea405
SHA512 618b15d6f2645f652e2f2fd97a4312a7560c050fbda640c77ec72559ea878bd365777a74ab158fa93d065574cbb45da1c27bcbce3d499edbc54769c36840db1f
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqmDmg27RnWGj:/5dKTi61mD527BWG
TLSH
T154C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c6d75cca149c22ed187bb3fb384dc5490e62cb7cbbecb41c4788e0a502449a70
MD5 5d173e48ea426c2f9088202aecfc5900
SHA1 49489690b02cc595be9fb3e5df11c0096172be7b
SHA512 17413cbe1b1fe8861d008a8409f57fcdb0582f77dacef39212fde67daf48ca595f97f57c597bf5ef969ffdc3f4bcdeb3227af3790711cf2fc9c1ac6e34dc1be7
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wFDmg27RnWGj:8X2iyphwD527BWG
TLSH
T1C595BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 f2da031959d59d59690379e43022bedde8d07ef9242423f87fa92eec875cd0fd
MD5 3d6b99214662e2d4ec262527ab93fc64
SHA1 e70eae3876cb5c6b5640105835ad1572a4a0b81c
SHA512 85b8f7c1a6c361050ee01fde582369dfae198dacbb36b53b2f06bf641337fd6c04c67b9b54e7269a1153734e4d311d728985d3fcc7db2498225e6998b6b463d3
SSDEEP 12288:BWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D36523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 9cbc00e7f817a0b0ad4221dc295cace91183a6a6a55db2f382aa99aee5a6129c
MD5 77774fb7bed9584a8feb72b80bcc11bc
SHA1 e1d685f74abc38a36fb7a72c4382acad511f2f63
SHA512 7b60e72536519068414085d3bfb40c09357177b7269f8f7dee66a3d8115630457d928a05a27dcea01ea48c0687d410558ebfe252f2fc9b28d3c4840d65fa6ecf
SSDEEP 12288:hDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1266523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 842447d5ca0ac06f2d5985856cac2a9061fb7aa335bad894f4f433a7eeb14916
MD5 49ec44dac41706aeba25cf41ff0ae7f3
SHA1 3ee03dc45bcb08d3ae53a13bd9280bb602ad5e2e
SHA512 27e9174ad6b287b34e9e11be67f228454bb862b329b7ddd2944c1b67a719ca5ce19b6eac14da8cd85056067508610ee41998863d0e8853b6db7ad2984ceab521
SSDEEP 12288:g1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F6523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 00a19b74cfe40a6694a187beb2248690da64d723d47d38ffff651b4a26597cf4
MD5 cd8f926ad22891e20858935b8e9ae6c2
SHA1 f64e7c59bfe86e0887c53c839cfa24a1e9f85de7
SHA512 6df8db9001865ddd00cbc194b7c1094fb6bb074c582116a0420f8cb06594d01a400d8fc8fa3c26dd84bf15a57513fde2e9a448026b843fc1e0578b65d3b57424
SSDEEP 12288:dVYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16675237B675C01C6D83285B4C2F5E11DE8237D56EB30059B6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 f71983afb796a193064ff507a840a95a9ae2fda0d323f17439ae0f690af2827d
MD5 916b47fd85c3ada36b96143583fdc8fc
SHA1 303c7052b9116956f645a3b8581130683b338fe3
SHA512 89cc621af0e27bf9c8d7a26e75a3604f97c20d96c8f3c578bff9ff27ab08cc5f8f28079fb856b5e6887bfa01c2fe81006abbf1fd7838adaf334a02cbc353d127
SSDEEP 12288:hwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D36523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 28641a69ac004aa37f6c5490d39d7728fd345abd8154bd2ae83632de341f9025
MD5 0b5322a8d46466abd43e2b57ce8d5d4a
SHA1 6a9e2a70cf3e10a09887103bdc2f0c30c9dc66ad
SHA512 1f764674fde65c8e735e40dac3b55ab0d9d07424cba9bbdf7603636900e4cbff59665541cbf36d0572cd1f16df3c6d06d1fb0fe6afb075776dde6596767098ab
SSDEEP 12288:GHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B6523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 309531e0eee90ce74cc19de9ec7efc0bab967d911484b92862fa1b55eadee949
MD5 a174aaf952ccd57be898f5074213fdb0
SHA1 2d364d7570cc32d316cf5e1133f474148d48d311
SHA512 880c7cfeeec9cc2de97e774ae814cb3a4b0017ad9ba632fb247d843a1b1c6ef7979aba1b619f415cfde30fda096b2441eff3ca1e608a8f5c92abe05821c100db
SSDEEP 12288:9bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE6523BF965C41CAE62604B5C3E5F15DAC073E5BE92004837A6B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b4282a97d963d63e460f924b36d8b39b718e0016b77da8d56af534bacbd0c9bb
MD5 6e5fa06dabea331d28f53b29a051fa36
SHA1 c68f6aba971cf9a0d7a8704f9919bbf44862433e
SHA512 f926318050a8e2d69e7526cc9645b6deabb030fa2ad9d80335233801d4bb62be155db70dc5ea69cecf93d186dac9af3c0899aced96722aab19b18fa38829c8ea
SSDEEP 24576:fZMjzFVSOjsqjnhMgeiCl7G0nehbGZpbD:fZMjzfLDmg27RnWGj
TLSH
T1248501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 930a947bfd303b994bd2cac853650e6313347608a72dfd9c5c82b3d9d3143148
MD5 d5b4cbc161888d77bf21b2e7ba25d9a6
SHA1 41fa66121883eed916c9e8e6242e6438fe481fe1
SHA512 14ae43d524cefc8f9df38cb613fb9e0451bb90162b75e0322d5e3dbfb02ece4cf5274ace6f16cd298e2fedcfc4f2e1f453c5cd8630af6363552ef69fa63f8f21
SSDEEP 12288:HSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1836523BF955C41CAE62608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 c03efd728152dd8b7b55e27aea00d4e9c6cd810adbe2331c0ae29979437fb7fd
MD5 0570eb9f15e7c5a7834abf1874cb3e01
SHA1 1130607a3142770569316d28c92a4418f60d53d2
SHA512 3f35b4d26b34c5adc715132b93e8a4292b5be1e756c75f3a33f476fe00779e8854596535341ee488c7b631201130e1c0bc32f770f0cf62b0c98607158f7b3b5e
SSDEEP 12288:a+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A96523BF965C41CAE62608B5C3E5F14DAC173E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 db00fc58d3731a42c814c2642fd6ebbb9b9cf39650a3ef4c46084606bceb9d3b
MD5 998e7a422bff9a1926acbcbdf9aede72
SHA1 54064747febe164f3495249b4d5362a6f0ec0e4b
SHA512 8706009f25acb36a6284baaefd4d5963a6f3146be23d45d82eca3946c0f076365ed0e2b6b48917dea6e19bae9fa696d4a6f6248dadd69af625122916645c6d1a
SSDEEP 12288:jyPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18975125B73A530F9D1378138C5A29A06F7327C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 92dd29134d390ff25bff16a60cda8162118904deeb4c14050ed5a80cc37213bd
MD5 18fbf5bf675a6e52ba6d0b3953622d6c
SHA1 e4635e33c1a685c972a8d5f6c13146d6c8faddac
SHA512 3757b6bc9f6b7746c3a5dcc0a955931d57deee2eee859b79bd8c6e884dcd7aea0bf0c8780938fe6975c0f01732aadf17451230fde73225c89990114e2ed4194c
SSDEEP 12288:9SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B6523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 d88b2baa038c82836fa4538602bd0c22f5a732131b91ab43538cf1ec7e3b8a99
MD5 5e9c11af0f4b34b4c0bbb67e08c1295d
SHA1 caaf7b1ccc40c1c991a0756e40dfbe743bd509d1
SHA512 df76a5bc0db5b7dc2c076f58ec07cb18528262836c6029bd060775b630f873c2e5c0f220ca5973f56738028094bdb6aa5cdf6c5e5367a43f7f2e16f6038648fd
SSDEEP 12288:FSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA6523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 3b4811c19b5594115de8c682b33a6983059cd05533ea10279b67928b40213670
MD5 83bcca69a37d2a50b85636900e50017d
SHA1 66c44d3b60eab2167674742baf9b1a9337065ceb
SHA512 94da2d7d165c7ff9312aa33a6bbbb7ba4f54e203718f59811e8ba060963ac3884c28709f93d7c0baea7b6d41135c42d57af09dd4e42ab7b67c4479ce5edff6f3
SSDEEP 12288:lyPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:szyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B75125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 67ba5203fdb16e12c8bfc2eb6dd5c881c21be1cc0c86d78e127936e67ecdcb9d
MD5 34bb40b950a0908afb6810871a59ba13
SHA1 99c9c881fd3993734868a3d5fb0b7e71948f2ca2
SHA512 f27243034a434958b4e64238661a7d3da5ebcb4442c99b475c7e709671c5affb6fedb03baee5a0389b79ccd1e9b429725ffc56d3c3a7b5281615a3ce6d6b65fa
SSDEEP 24576:FTYaLl3z0zDFsqjnhMgeiCl7G0nehbGZpbD:FTvLlj4Dmg27RnWGj
TLSH
T1028501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 bc974ad352ce719b8c9e421ae5c13e5653e8ed2c7ba078f92153d0b8a608ca1c
MD5 facb02260385a4ae6d9bd9bdaef1745f
SHA1 17bcef0474ee4bd65cfc2e39a14d72a9eb33af6a
SHA512 9141b0ed045fb4955c612bedd6d39cfb7608748176153633132c9f692a3548324cd9a8f377c303a0e8be328e37b17fa10648441ee722217a23a935fbf420faf4
SSDEEP 24576:N35d9CHKy7GZZsqjnhMgeiCl7G0nehbGZpbD:t5d9CHKyaLDmg27RnWGj
TLSH
T1C695CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 da04872c48c762ee77436bc8fcb4f3f27a2f4c19c623d99102523a46e0ae52ce
MD5 f55f134cd3104b0ef349b4fef967dfd3
SHA1 4717919142846434ec496a261bfca2a93ad1f24a
SHA512 30f6a809c275a142e19644d7e1e8463b0d2fda0e0c00df37799cb94c053c621a535ff37346b832f416ea0adca11819153ce179789aac4b3f0defc9061daac9a0
SSDEEP 12288:QVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1186523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 1c98146b333e365ed7926c6f0e88defaf156d2ee697e6a7346de16f90cb74ad7
MD5 cbb0251320aa30b234e3f0618588b4d7
SHA1 b17c13db1ba9346dd74e26e3d28418c04d36bb96
SHA512 06843dd2e41064a882c771ed9ba06e63313b01bba2adc9fd0d7d63510ea2dc89c19c34c72a5b184566260c182158f19a895f5a4f12309dd8fd27cb201978fa2d
SSDEEP 12288:RPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C96523BE965C41DBE52644B5C3E9E10DAC073E5BE92004837B977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 31c46437bcae55720db264da4baaddb3fbe3a8a3fa72a6a9b9f00b374290f244
MD5 590c4f200c874d6f25863cf06d343eb8
SHA1 ca5889be7882a6cd06dd4c32dcbecfc2d7f5f1e3
SHA512 43f662a2cb87aba8ecad8189ca56e0b55996eea9037fda6c433f7c2c0897a70219516aa5f3a2dcfdef1778b4a3c75dd0817507219944b9b7c5ece2f4536b0fd4
SSDEEP 12288:SEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1626523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 a78081353e32882a651adfe58ea9c4abd7917f80f77540b57a5fcc8baf8274eb
MD5 48d6f5f7b1eb7d6d099859775f1e5f9b
SHA1 7de6426d750f1da9d88e5a0226aedd204de5229e
SHA512 1765727ee37fbc52f4265d0a6b217aa501a40c269bd1a67d0c7a297e6b776a6de781366254ed6ce79a4aef92e543a1dbdddd7e9dff9db83657187c68fd8a62bb
SSDEEP 12288:9SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbES:9SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D6523BF955C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 3e8405bc33e9723b04ba5b602de5cf493b683f47a8aca77076c53f2a5e3ff848
MD5 59589626ed643f48a1abdce356c27cb7
SHA1 b52bedbe7ea67bee6f7c23ab060c97d1ad8efcbc
SHA512 45afd36167379c9e6413c79b7af21cc28f0990c2ad0e333ad47e2bbd11a0e1154a2e49cb183e6637fc4d6ef22a6e324565cbc3db24f5d8aac4a21d2800fa1c4b
SSDEEP 12288:6VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1816523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 8262bcf6493c1e238f7f7901c54c5d5c90a5362ee10c0c855c23e309ae35f2ea
MD5 4f0905e2b4fcfbcc548b03a4e57e891a
SHA1 78e31c765adc9eda6b089fc6ced9b33817a43d65
SHA512 38a8607592361b6051524298b0ff1a469324025ec3da1169f069fb11d5cc965ef9800a72fe2ddc275d983bc26ec5580e52f232abf03b58ee212666086d958201
SSDEEP 12288:ZKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B6523BF965C41CAE62648B5C3E5E11DAC073E5BE92004837A977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 aad9c8821eedd31c3b832b5c5a7e3e3528defd7d6b4430c945192508886a330c
MD5 848cb5788978b771ec6101298a6c2524
SHA1 fda696b470bc782ab2e52c4519b24c7bb994b597
SHA512 d4d79592a288212d0baa76985e2f6ccec78585e38c50e901f1aa8a7aba38efc010717ca65a30a04226e4f21f2addcf379938785e33a6844e32deb5c5e392ddff
SSDEEP 12288:OwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1186523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f581008c8c6a839ce34e4b39f84a38aca1e9b8d014e7a21e9fd63427c285d28c
MD5 b3e0d68f6735a015ab3c676774ea93ea
SHA1 e920c40633274c1d23f5d26b065b1014ee391516
SHA512 7d8996b84ec2f6efc7865680db62725f283cd64a4dadd271d5f318fc920074c0e79e62779c3aed658d75a34a719edb1c951a487b4d078347219da52913f47709
SSDEEP 24576:lfwvTk9RX6wkyAIusqjnhMgeiCl7G0nehbGZpbD:4MnYICDmg27RnWGj
TLSH
T1BD95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 59709f6cf0e8aa687378fff226ecd045ebdef0b1cc91c77ed46226b45bed2b38
MD5 67f0d361f178ee31318336531fff7c32
SHA1 ce57803427df3246b99df615f5667a6e8ff2323d
SHA512 f2819a36d4d3481bed6852e94f80fd2857c63a0e5de1abdd10f0c94acad9c73192c1aac8309b38421f3026d09d411e8b584af52875bbc7c5a0807d78bd9056b4
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lDmg27RnWGj:UySzPdD527BWG
TLSH
T1F6066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 617843ad8092c22ac8cca9f3641cfb188da4708c8e2b12844711a388d40fdc5f
MD5 772be2979269cab65674b761311b710d
SHA1 6a41f0f08c91e2d872f33a78b982b5a428df4e84
SHA512 fa9ac4ccff30bbdac5def33c42eaffc2757d384cecf4d443905d217f51369f93f4bb68f4cc9b9969d5d5ba18840b0292920ce9d1b23db231f33e1d6defd61b2d
SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYTsqjnhMgeiCl7G0nehbGZpbD:L47JUQj1irIhCnDHUPfF/VDmg27RnWGj
TLSH
T13B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 de9bed07a666b7b88d87e732b4e8712c04d1f748b862265e5e7207fda3d1b101
MD5 2f0208175df9a0d95dceb67d69387457
SHA1 f2d206f0a92cc26c6ff5066fe2e3ef2d4c51c7d7
SHA512 1dcbf84b63d3067ddd76023ccf90fb97dd8e8dec1c905bf413f1f626687c1e5b2dda5ec91e3edbac78c24bd88a0921ef9f60f00bbb27f9a637726b827fa0d697
SSDEEP 12288:VjsfiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D875011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ffee1076298391a159d95d1e94992591619c32ccc1d0abb24b25dcaa90979a13
MD5 357f777f5177aca35db3e5d0471b5cce
SHA1 4c0b2f74e7b55fbfd59f12aa016335ffcfb0af54
SHA512 c5295450ac218057a0b99cf59473b502262174e8b882a5ba60c59922646cfb0e5a36f3c9fd848affb3e75915ae99ac6ddac15c17770752293c8dc7b0d40a8535
SSDEEP 12288:0a56AcAU3fE+Gyu4Dfaq2+IOMnVm8JaXjtvJW:0a4ANUPfrnMn88JaXJvJ
TLSH
T1C8353941762BC75FC5A940325E32C2CCAB707D01FE456B03B3C9973FD576668BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0426b079ff487360baaa9ae9680e7fbe1f353dd464aac327d7664e28a637b7c3
MD5 a3a6d587f1f2ea1cf309cc4eaa8dbb9c
SHA1 8f14a2eba775e380229c42f36827963ec08d0e88
SHA512 c09c1538865538ac31385f90850a0de006c925c6e8fe32ad69efb40214445cefcc01b8783dc3839e771d2db93b2fbd3ac845b889427a8047c0fe9dd6656f3154
SSDEEP 6144:KYi9ow8S2QFm+gOxePetMxYlj5t8bgqsmdhbaQHc6RuntUPetMxyZ7KBUs6PG65+:KYi9ord/KtmCNU
TLSH
T19155E8819137A3CFD0FA6072072A5F4DAB64DC06B7445F22B3C8453AD86AB65B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 380084add0141b65a223890e10c3de50e1e31b5e7c83c5008e055cf96e69a173
MD5 76b7d42aed8c3a598849ba8a28af47ba
SHA1 864eb6244b6ea89b4dee7bf1d11001144cdf091b
SHA512 19b8d7b82ad8af0fcd0987d3370536de58c89f7df8e6cc30bbf9f44a84bed4e079f168ebe63b54695d9fb2245ce18da3b10497fc501852586356bf5d89d9474a
SSDEEP 12288:AO7aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB65237B935C518AF93605B482EAE12D681B7E669F1044C3B90778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 64d4f988dbdcef7f40251f9f3c735100ff17f192eeefb606e7a0e335623d2976
MD5 ad94ea669315748cd431218374eea9a0
SHA1 7f27a01db2d2a22467e660cf74ffba844102d252
SHA512 2df4442d5be135d6b3d05fb6e62acc80773d277eeac41aca756409767c969894e31c173b47c4e0a61c852acc9dcba2772e6c6967d5064f4e6640aed52b375030
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYMsqjnhMgeiCl7G0nehbGZpbD:lgb4mBIBhGFXDmg27RnWGj
TLSH
T13E659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 27eaddf7965270852c39cd03fab7a299e840462d23e8e6a54bf2b3612114e3e5
MD5 68c0d20eca6eb74629d81dc7b4b58c46
SHA1 b44f32e8382c7817324bc40510c992a049b62746
SHA512 72c7d484d388973b426faa81618bcc88cd651a0501f6ba19cc1bd4d1a8608ef7a42c89612b0e242eaf569faaa69fb486bd38bbf568942b255b96c0016038be86
SSDEEP 24576:NG88u8FpJqH1kzria7/mjsqjnhMgeiCl7G0nehbGZpbD:A7ZFPqVza7/ADmg27RnWGj
TLSH
T14AA5016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e0ff95f5a5417c9011c96330c6f016084ff89088a368b85af4e2f68dd526cbc1
MD5 cced1505cbdcf45739ac105241c097fb
SHA1 9a10b96d1641d00a5c7c1a26c90fc92fbf42edc1
SHA512 a6cbf17165a0c999704bd8f21653d5fc22dcfd2618e57f02918d73b08dacfcac30cc97cf89dae58c90c18e0831694d302d128e4156030d597a1eca863f0ff07f
SSDEEP 12288:aHvUrBFrEjwaQ3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:aPUr+NQ3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A485F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6289d54d43c483ae3427a6775bf4d87738308da13696b20b1e25db08888421c0
MD5 37af499b69a710071e89375e6cb8faf5
SHA1 387338466a3a34bacd1502bced28040d7971d221
SHA512 4f78dd9f1464ddd39aac16d87b95b0b8eaee1499656bf4c47eaa8c7396072803200d26315cd33dfd9219c3b1e7486a618fbf401e03f8e8d1e1e8de7de175c4e5
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbDmg27RnWGj:vG05lO43bKD527BWG
TLSH
T164D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d22965b6a8baf675b91a4f96ac5e324026ae39fea922f5ae168eba240aaba19
MD5 5a6ecbb85c4d21f2984f91da804dd2bb
SHA1 12f71a0a2762bcc582cba5c63fdd0adcc7688d46
SHA512 c85e898ebe716e26dbc3c8fac9d58f29ea1a156fb49da9b36bd76d363fef0a81dcb1546479987c9ae27f1f6055f5841ef1af8e39603dd03604da79254e2b3b5d
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnRsqjnhMgeiCl7G0nehbGZpbD:8a5POZ3+Jt2pasx2+mzDmg27RnWGj
TLSH
T19E65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 38b1fd65a183923aec40982be5c36b1086c2e63ccb12e1df52dd40bbaa7bd92a
MD5 214b50df3bd1b830b1135c12c5aeaa1d
SHA1 d221612af64a9f20ba9e4a694b3fb0853e59923b
SHA512 dde6ff5a82b8b2a9a85b73939c82f531eef9acce4a84c63e4e3668fc615428220ebceafb027d240a8fa343f2a7e1b0c4a442f74e951cfaf1a528abb5e9b0940b
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkrsqjnhMgeiCl7G0nehbGZpbD:JNc/zEOVHFgDmg27RnWGj
TLSH
T1AB857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6a1b69f5663f2335a70c804adb71d8a7996404e40af6a2ce9c85e5ad4591e793
MD5 0d962007d51cec391c0a7428e87dfcdc
SHA1 dc627bba7e9e01942fec72afb678567f7f82c767
SHA512 d55327ca34b9548f6396d5b08fd1d98581d2ac4875b72bcbd045f1adec36c0127f702d6b7f3ba1013d44f3b0fbcd441efbb6d246e36b54554734c2c4295013d8
SSDEEP 24576:x8kNvNnaFeYhJNtmZBmdsqjnhMgeiCl7G0nehbGZpbD:x8MwBtOmBDmg27RnWGj
TLSH
T1CD55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 186c284ad49b63f396f486323d5a6c4823b8fa4c224e83ca143a106447365c38
MD5 4ff29c3b2028d4108913f313a0b17b61
SHA1 4079e82b8ff1bdbfa90d37fac46ab19f9a99b275
SHA512 3125c1b284b62adf6edb0b869b93d225feeb62fde9354458f3663c0a58e08aba719f8f5087793baaeb7e936eb8f8dff243bd0dfbdc211419222b36b4e6d17433
SSDEEP 24576:1D3FHshBIYQgA2sqjnhMgeiCl7G0nehbGZpbD:1DVHeBIAA6Dmg27RnWGj
TLSH
T1E795E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/240-109-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/240-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/240-314-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/240-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/884-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/884-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/884-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/884-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/908-255-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/908-55-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/908-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/908-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2684-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2684-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2684-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2684-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2820-122-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2820-116-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2820-114-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2820-313-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3104-90-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3104-330-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3104-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3104-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3104-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3104-96-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3392-68-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3392-74-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3392-281-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3392-66-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3540-328-0x0000020111980000-0x0000020111BC8000-memory.dmp

Download

memory/3624-136-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3624-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3624-134-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3624-128-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3624-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3864-302-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/3864-85-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/3864-80-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/3864-79-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4672-47-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4672-46-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4672-40-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4672-53-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4672-51-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4672-39-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4980-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4980-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4980-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4980-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6104-78-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/6104-0-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/6104-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/6104-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download