3cb682c19a8e57d705faa8c66bbe236cdf1597cd52f2e4cf1e0e871ac55ab352

Analysis

max time kernel
125s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 876KB
Sample260815-dn8lsaxfnf
SHA256 3cb682c19a8e57d705faa8c66bbe236cdf1597cd52f2e4cf1e0e871ac55ab352
MD5 dee514e6e70cf77ee32b8319515ce936
SHA1 8b953e79a34b3f338fb6cd52771fd1ae605350f4
SHA512 39bbc8f97fe520c1f4cee6701aa6ca0322181831cc4a0cfc9c7b53dbf8e7cd8fba98dbbde42c1ea71827dfbff871e4db534518557b356f4da29da0dd351a8ca5
SSDEEP 24576:Puqj3f0uerbtBiv8+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PnD0t/tUk+LNiXicJFFRGNzj3
TLSH
T15E15E04AB2A850F6E9BBA13C88528509F671BC154B61D7EF13A0066E3F337D09E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5324	elevation_service.exe
5552	elevation_service.exe
1248	maintenanceservice.exe
3136	OSE.EXE
4840	PerceptionSimulationService.exe
2760	perfhost.exe
2984	ReFsDedupSvc.exe
4860	SensorDataService.exe
1136	ssh-agent.exe
3036	AgentService.exe
5768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b7f52fb4b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000550de8a7632cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008736e6a8632cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1b2fba7632cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c2c37a8632cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050ea1fa6632cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000810ff5a7632cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
5324	elevation_service.exe
5324	elevation_service.exe
5324	elevation_service.exe
5324	elevation_service.exe
5324	elevation_service.exe
5324	elevation_service.exe
5324	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3036	AgentService.exe
Token: 33	5768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeDebugPrivilege	1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1892	2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5324	elevation_service.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 1876	5768	SearchIndexer.exe	100
PID 5768 wrote to memory of 5984	5768	SearchIndexer.exe	101
PID 5768 wrote to memory of 2960	5768	SearchIndexer.exe	102
PID 5768 wrote to memory of 4460	5768	SearchIndexer.exe	103
PID 5768 wrote to memory of 5040	5768	SearchIndexer.exe	105
PID 5768 wrote to memory of 5784	5768	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_dee514e6e70cf77ee32b8319515ce936_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 07f26fa4b369dc7d3a02a57635be6338957a7cf5fa4bfdaac32264f67fa67d0c
MD5 95f9a93f0cecfa9dd635f6771a847d21
SHA1 d813a17881467d180886ef7abbadd88b727b398e
SHA512 f91cb49cccab63ed406b74d08a7fc3cc5d52001f449cf7ee9a16e4b4c568a12b3119dc9d7a62edb16c2c5654379d5ca024a54caea1e4b9d5a7d84da7ba43ef52
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRLNiXicJFFRGNzj3:03q6sjBK7wRGpj3
TLSH
T162D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 31d6d378bbb39765dabbd12f71f6138c13185b3ef289d500dd94349eab92e027
MD5 0dc873c5a8e1c697ae00221219d21e6e
SHA1 df943868ea418e7716473deb499c7249a77e2e00
SHA512 412ce85e93c2f92115d31fb1774879b81e8b8f5bd77f16e17dce9b0af19740acfdf81e595f6731062f9d1cc734ed3e75b8efa635e2ff73e350588845e94efd53
SSDEEP 24576:eXYfDtczAW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9tcHLNiXicJFFRGNzj3
TLSH
T14805012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 78bbbb0bf904b0128b3a874d54f0cba94eb909c66d790c1cf11cbf5627d79d9b
MD5 cc171ee878e0d8197f1b4af94867d233
SHA1 c1d41932d6dbcc6ee4272a1b375bb98527ee1a9f
SHA512 4aea8f8b11d45c27180b2e9d70e50299c5db78dce656fa833b73c27873f088fc70cfeb2f19d8e2a9a97080f75e5116678e21939ae6b5618757fe6cb146089e3c
SSDEEP 24576:M0Le5ji0hmxxrMZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MPji0AjQLNiXicJFFRGNzj3
TLSH
T14C359E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1d8a7e57a8855ac12406e3a79aab8625183928c85e793a153a2513a2aedba330
MD5 3abee13bd6e04b8c6c2976172fbe1e55
SHA1 4e98a90136a96e1cf54c8bed6298baf66dfbb8e4
SHA512 bf983e95dcc8874b13acb9987200405e3c8660300576308b71ef4e4c8065126cefd41622f61002c5990f8d9a51e97d3503983ffa4b31e42d94413998b44bc13c
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyuX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz://ezSC6vUzPveHjysLNiXicJFFRGNzj3
TLSH
T167756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a1ef31613a2764878ed64e0e73ad82ff64e9b183045b6d2dce4efa2a16bb4f62
MD5 cdf81666c41a254208ca6844addc4399
SHA1 a33424d4a7e8a532ea2caa00d6a0739f6fb3a01a
SHA512 175e72cc22fe388c7aad8670144ccaa1cb1e42080b04efbec884921578e2a7a0dc91407892001d83c58b7edc5404dc8ec6102c3fb88e93471404ef062f51e919
SSDEEP 24576:wVbqPb88hv/l+Ya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wVO88hXl+vLNiXicJFFRGNzj3
TLSH
T1D8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 56e28df5eed462a5412ee1a09f91092bcaa62bab66d1708a98783b9551bc7f73
MD5 a06bab1c5109d9cbf08a14db28f7fff2
SHA1 6faa2ec6381ec510734e5eadfbcdaeaa3db9bcaf
SHA512 981b802ec200be0c29af1ac62f884cd3c8f5850c3d1be9fbf91d0fc57fdffba3db3d3dc1fd96d0fe37e85b7cc7f07999482515d65070f3ec168235ce762f3bf0
SSDEEP 12288:ALhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ALN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T108C423D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a4752bad910b8c1d6b4ccac2633503f3024945431f9ac5fcf685fa709b21694a
MD5 cf91c9bad736cd9547c1f5fbbacfa1ec
SHA1 dcd3b65fa2fd95d3182430e98b13b3938acae8d2
SHA512 1c4a4e72efde52e8ff251985e7d0809541f06b577afeaf4a14142d68c839dcec3dd93dce6d60caa32e5ab0e283fc2219bdc815dbea17f60e8eac876be9f21d65
SSDEEP 24576:fJIUi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fJIUiLNiXicJFFRGNzj3
TLSH
T1B405CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b6a29ddeb1ef2444d84ec1b98cb7100b849bbda448a226a102e4a0cef4515d0
MD5 8b6a8ac4496b06845d923ba508486e03
SHA1 1481641d632c9457f212bf327137fbc931b85337
SHA512 8691fb0a47c40bbcfe38116f7ddec0096e135b0e4e6fbbdbfa175503469d74dc99c60d20eef30414f27129ac95d43b966d5a915606bc9d0a6f5b5efeb96f0ba9
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THs:EQvGAdlCEL8c/DRNw5Cn7wRGpj3
TLSH
T13A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a8f0cd64a3d40937804909cd990bea1c0feb0f94fd9a274ef2ed433c1bc3963d
MD5 09fbc852e1a396a09130acf6960054d6
SHA1 2ad63759a3ea4cf0f8ef9fc7ddfecdcef55917ac
SHA512 b84c79a1158204a6e08aa6ab6475f328e797e56c4cb04a9f924dd7950524b8dd9cd33fa6bf63f20b1d1e32ad9140833a765151684110c3429ba3f433651d6761
SSDEEP 24576:Y0ewsAjg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tljgLNiXicJFFRGNzj3
TLSH
T18315E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 78ebb5a1c9edf0aa0e60829610ccba207b0b993ca87c86f5c5b32fe96ebef04a
MD5 f705f1b6a5b0675bc9a9091245c574d7
SHA1 2f391fbebb48f9bc8d08adc1262701c91286deee
SHA512 8aed4cbef7dc279a414108ad0eb697449f5aeec9477e8bbfe46316dcfe9c38722e0af48de0c5c08f835463b34d93af0b406b7fe2b4099860173f2520c1a53a6e
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHEF9:3UEtQevvqc2W1cpV2tI32Y9
TLSH
T1D8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aa918b720087d623ac02b6c0a1b80c78aee5f5b52b45942f4326221d1d26b397
MD5 252c0712ef0fee8565f76305e4ef2036
SHA1 013df5991a5f540426dee6d42d20717b074fe945
SHA512 611fa17129db0102eec52ba33ec48186cd9076b8f51580f8722f0618ff12a5fdfa80957c98cb662bb0f11860256a3073477448b4da108234da1f40a1a71672f5
SSDEEP 49152:sCbRquA/m2yL5zifFiV+XenmE3/zALNiXicJFFRGNzj3:FoqHVjnmT7wRGpj3
TLSH
T186D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a83005b2b9a2fd5f53cb7548c54a5de362c9ef3b8eb8c47c1e88d9320f494220
MD5 c2b147659519c0d50e64e065cc761637
SHA1 b5760d719b1354c9e64e34f9254e21b77f142b8f
SHA512 ddcdbf5602ff9199988ea5bf69eadc7017f85147b01213a037e00036b25fbb40fc42d45e208674043a6bdae57b72850079ebda3991d5dc4d679342e70750ddd1
SSDEEP 24576:GAhGL3IFoiwtA5l7S53z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GAMUFoiq5jLNiXicJFFRGNzj3
TLSH
T17C359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fa50776bb9a5efd9323f788c739d28527bcd05a581cf2abb85de1fab6c016140
MD5 1f7fbef099e2bf892806a51acbebca3e
SHA1 ecce84f74aa790ea8d8c5bc74f34a9721024a4bd
SHA512 e7ff9833013c061a9d2fd683f7bd8e89204071393aeff3f8aa8e57f408c9c97cfee79a0bc65b3487e5f5dbbfaf890bcae346cb8603fd35c09254ba67da0b026f
SSDEEP 24576:Lwu4OWM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LwvOfLNiXicJFFRGNzj3
TLSH
T1F205F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ce93e3a7b23593bb8cca4301a0436234e313047b51ba6cdbad5413ce32a2279f
MD5 5519440312361879b833e872419eabc9
SHA1 b6fd16f9e8beeb9782fd55a09437559a681e863c
SHA512 2eb9004584ba885cfc5b51ff4dcebafd4dcf48eb69b41819b1ec2e1d45a0d0a6563b48dd6cfca76daaae65e37e5eec3fd176c38ff941c4f3a7c223bbe0ad3c8b
SSDEEP 12288:keZ1IyGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dZuh/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1EFE4129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6712c1dae38464cc39f90c9a9eb711e584108eebfbf453ce5893184260d31f14
MD5 abe8f26e6ebf620cf6156ab3650f173b
SHA1 c1494185b028ec811dd9f8499c0d4209f522642f
SHA512 158923a48ddb7999074ac574e89774809010e83a7cc81cb2e34f7d9c5a27fb34b0b8f288f8e54caa123fa3bfb90eb2e84ff49351401fc39a09883ee200e4e55f
SSDEEP 98304:PQRQyi36YOcPbLvw2gAf+PN3+7wRGpj3:+QyiKa/X+PNCF9
TLSH
T14D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 16ab493de187d5bfdda0a856b7fdb72004844b8aec70f4259e71c6a0d313f6ee
MD5 7b3239f0e2c4680b045bd0436468941f
SHA1 c47af977e0f64c275f4275b0dc0bfeb8b8bf95b3
SHA512 93248d3c39d07bd7e0e9c5fa17ce057d599ac682676b0d6f83c0f22ed601626d00c29dd50efef693f9c6950bc0c93d37d8aa9df25b15a52918b24be456423afb
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN3+7wRGpj3:nQyiKa/X+PNCF9
TLSH
T1F1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3146e4c15ee1b3f2c71e6825e80f87279067f614ba39d967b100d5a4fb6ae70a
MD5 31f282e87fd674d44c8c48f6dead7da8
SHA1 c562950b7916e6cb7aeae66690d6f8054baaab5d
SHA512 28f69835fc23f1fc40d3c33aa614f224a49fce6f6669454b74ff9e9f2ba60c2bfd4aa8e1e6781a46268b381412ab43e32cadcc3db531c020346ebba705f56ab4
SSDEEP 49152:x68Qg55nhceWu7PNU3/QLNiXicJFFRGNzj3:vthLRc/Q7wRGpj3
TLSH
T1E0B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ecb0b93de591516022ece008009a37cd66b943d3f03012b688e6c21a3acaaeb7
MD5 340cc2fd0c5e0fc8593310431abd238e
SHA1 3667ffc4e580f605d07bfbe607935ce6d5cbe12a
SHA512 0cf632f6fdf4a0a75a71b7f4aeb41e974edc5740865471c8d7f27e715828bbe81ac90f411908930644ac4e13dc6ac69e4e8ee84d71416472fa4d5b150addfb94
SSDEEP 98304:Sy5112gYy5azzVvt69nLKnhZN7wRGpj3:bLIHEWhPF9
TLSH
T13D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 088b58ae9eba82693a28be8fafe269594cc1dea41ac3697c691266de8548cb1e
MD5 d180657fa4cc9cafd52cbf497fae8184
SHA1 452ba67063e1a7433c3a78dd55235dd1e532bfda
SHA512 629984392aadc46c0b81e9199ba86815bc114ab5039362a4647dc5d0c2fb8c92a58be5a832248b374086995dd56fd5578423e1779682193d67f0dca99e76504b
SSDEEP 49152:4B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGLNiXicJFFRGNzj3:Su6Jmdxd2dG7wRGpj3
TLSH
T131D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0a2b803620e1a99c8268a90284599bc6d2bfbb02d169ac426a49f76842ee4435
MD5 a1e724889ddd9f92b3a4291b0e77d842
SHA1 d062e9e6766c8e6a98e0e3ba810b3b360ebd619b
SHA512 7e6a1174fb818f23e85b6e97d31baff46980f7214264012bcae71bb0f64956b92a3d2a0f85ef34b8a8af791ea2498ee7fca9ba9ec44ba7ed34d96130255ce5d7
SSDEEP 49152:N1hpsNoJpF1A63U44CwH7R4xCLNiXicJFFRGNzj3:NmifPWRT7wRGpj3
TLSH
T16CB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 54ca589c2ca7511ed04ecc7f67d0c531ca4e28fbca674914f94bc34b23e73011
MD5 52a0eecd08f3cd4ed1658390447c5742
SHA1 0b1a6c8839de6bce45c27a53cbc923d50fc4d18b
SHA512 d9e3f2fa33c5700c6ef7cba7e3ca1c374ad7a5b98905557481842e0bffac74d37641cb9f23ec414eb9ba89719358c10f5ca73ecdb805fd9575d86235f83fc72f
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqhLNiXicJFFRGNzj3:K5dKii61h7wRGpj3
TLSH
T1E0C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 83451483085576452baf2ea7feca827258b1a91fdfa56e6f0b7d33167f90f691
MD5 aabbb9e9391887f43f90d20ce1e64745
SHA1 44cdfa4830c73c46fcdeda840fa5fb275a95cb7e
SHA512 ea3490f001c83fb7541024abb8a9ece041e1f6478647ace7075a79f85d3927268ec5829183d89f0d2de72615519720c361ff2fc00690d8a92646e0124cb10940
SSDEEP 49152:HhtSn8EApI0fig3giDn0AP5wWLNiXicJFFRGNzj3:WX2imph/7wRGpj3
TLSH
T10B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c1b243b60fa1be3c15d2365a3b4938af11bd307fba29c1cd7e0c3b323939a7f2
MD5 8ca2170b4f0ac81edbb29880951b098f
SHA1 87d69ab83faf3c84517e17f9e3af380183da0f7d
SHA512 c9df2f832750ba9df0db00146a2b1fc797e171b66004f7d1957065c63b263f07450d86878db186e66d62d08a6d61f3f1c359b963dd216fea784c3fb3825985d7
SSDEEP 12288:fpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T110C423D2558955B1EAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 054a7c69ac8d4f5a7e88e96bdd76b6ade36f74ec4e5d6afa9d4a5a5bc50ffc1c
MD5 410e27903593605c8565f83fa3321ff3
SHA1 95afabef8fe1dd438a80f3c3b99d997557a32930
SHA512 1f0fb95a87b69a64c1ee608a4d7f6e8351fc6b72d95298518c6656e3ae78f4f6c7939e2c057684a23231d56ce32a4d241e84517c9cba166828990c0737ab3a8c
SSDEEP 12288:niiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T109C423D2548955B1EBBC003AC6754428F5881E2DEB5618E3E3483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 cbdc7e9b0485e97fdbb7cb10cb4ec818fed2bb45f4edb77d437e28e2ce20d9b4
MD5 877a7e118c86186a2f0a858d2597a4fe
SHA1 f5baa38473457604665863232139d39822eb6e34
SHA512 51c9d55874175d993afacceebffc34c47480df27745221a4ae62af7aa2f98e89df1ac41c74da967e9473ce763c326299eb9bdc5a3873c9a9f506ca3d4e8b776e
SSDEEP 12288:Y4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T150C423D2558955B1E7FC003AC6764428F5881E2DEB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2cf7ee8aa9c17fd6d99e8248fd1e1157735dd9d5a7e1263e211ad325e85a76bc
MD5 056ae2ca6f707a453995d217cc47b840
SHA1 4469e9961a3d96a4712d0c2335b765504a431af9
SHA512 d8d8f84f7c4a06f928d135ee90f0d65638473d5722c638812af57de2151d33b3abd0220d316cb3aaa7e752dcfe5e221b63f48cd6bb697ec5757f23a37c487cf9
SSDEEP 12288:wVniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T105D42392168901E1EAFD803DC6764424F2A47D6CD7325AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 72e49107f4491181a5c91f266d5949555762edda06f8c143bc89200cccd16e18
MD5 80253a6b9b8d63b469e642e64b7d90a0
SHA1 8a1718edb4cc29440125c83584439df8adb21ed5
SHA512 b610ccea48f708d6a8cf871384f210c4833f754e5b66ac85697048e967a87b46596311ccd2ea84f5f9dfbb7d7974fea2eecce57ea635e39e16b6c2f1ec9d2888
SSDEEP 12288:G/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T149C423D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 de169d6f61fdc796842da145d73093102d94d9ac54b9d81122209e874bfb14f6
MD5 ff87778b9b3d0390317615c4fb1a93a0
SHA1 3b47b71610a8f522172156ad165711539479e4dd
SHA512 cb66f03664a065308dfb2234583e0dacec93c9da0bec282b49993b689f168fde391a60be764b7c1e699be5cc49433d36ad6839f55a560327b421ccb2924a20c3
SSDEEP 12288:2eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B6C423D3558955B1E7BC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 aac94a2881f3e9fc2050bd5a194f44ed347d424cc7b01735aa0805ac549124bc
MD5 41fb4755c466721ee31618d14f04d836
SHA1 7e7a651d6f753e04befce242415ad04da8c75696
SHA512 f1de31f6c0b27f1232673802b30d1cd0583c1f13449c65e7041f82f03a66abccb34262911027180cde1905e14beb23bc270c216ac69d302ac3c6b55caefa263e
SSDEEP 12288:iaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T184C423D2558955B1E7BC0039C6354428F5882E2DEB6658E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1f03bc7f9101b4c599ece25396825bd4dd3e388d80321796211a78d69101af72
MD5 1426e63b9c0ffffe639954eed353b1e2
SHA1 accba055d9d1d943bd06d64f481d5da402f1e35a
SHA512 1723a59a847eab92e2dc24f27b8e4259cb2d15ccef7d0635901fd2606d8665bba7df905831b8338acd445e8f1221e35ebd58554af6a8705bf67d6fd5ea1cb725
SSDEEP 24576:kZMRzFVSOE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kZMRzf4LNiXicJFFRGNzj3
TLSH
T1E2050295B39018F4ECB7813EC9258815E6B27C194B70C65F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 02366d3a784a208e4df77b404a43cae8d79cb2cf372b4bc1ace70113dc30c94b
MD5 e5c039a67da48818083ac8c0c54fa068
SHA1 64fa155082d41a5110d21283c104e85c034dcab2
SHA512 b06e0ece43f4894a380412692b00b0aef2b0ba3b13e875af0d0e5bd335af5316082f6b237ba5632dfbbd00643d6401b5a44a9fef5b8deccb7af4bf95cdf9a5d3
SSDEEP 12288:ctiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ECC423D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f6ffa05795370417fd4930602011cd5c0ad6f5d707be189ff26a573649b8acd4
MD5 3d582b70c11b5039edcf393c2651d23b
SHA1 03b31aedb20d0fcfba33e72bca41f6479e5dad45
SHA512 215ec480f94b00c450ad0427f85f5cc58a068a35fc6c8b4642a31734d99771e36e597eca8965c7c7c2e236900fa9d852746bb1df4d5b87a08ff4e73fd8dac02d
SSDEEP 12288:gRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T112C423D3558955B1EBBC0039C6754428F5886E2DEB5619E3E2083D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ebc115b4b366c68557788d92930d364cad3214b2417750a133822d21a0d55d7e
MD5 51e061b4fadd44add1e78aae062d307f
SHA1 12401cfdb8aa846d9e9ce708164a2aa325fcfba8
SHA512 99a7195327e2c8596e18e95553120fa72502d68e79500e056acde14dcf7fed15293553f5795d4133535e9b27e1d03f78b118a457f2fcf6d9ca164f4b817fcf7e
SSDEEP 12288:yyPz5L8GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vzyw/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1D0F40257629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 87fd9649017b6a6a855df4ab04d36a6dbd5f69233980e392ca02d1ac2856e52c
MD5 04250cf08ed9edaafdc1e9fed705cac2
SHA1 7df73381c0b7f5c339228b185b91ed660b39faa8
SHA512 933daa1a76311f1176c729dad3320c4dd132ebec3fee89e68c3072cee9cc1764f49a072e8db0a5dd00a0f321f2cd737503a62b0cef09e8879f9bd3b45c8295d1
SSDEEP 12288:itiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ix/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T128C423D3558955B1EBFC0039C6764428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 76f27eab4a6742b7ba32b4cb785345b765f944f404058155515806229708715f
MD5 40d7a94f9fce8203e16f6e7639cd6c96
SHA1 09f16ba4e889cddff6c0b582301c968b276ad3fa
SHA512 b8b734147d375916e2a20225a8d2832cc4b74a7364e51f2c50678ca2a87e6509997706e48443bbe688ee1af5d658ac169c4ea67ae705b1fdd7af4fe107acd7ae
SSDEEP 12288:ltiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FBC423D3558955B1EBFC0039C6764428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 31635757528397a91e12c24bc71986a542d1f46a1e34f21763f7e70aa55b1699
MD5 1e82b7370a29156b45fe3aee6df98c73
SHA1 c522ca600820c53b9e6936c5523bf43d7463c54f
SHA512 24096d79d7499ee46f775c1385fe5e7ebe4488e15984a5be5ddb287e64b45661808fbf231c87c1b90150c0a83aa1fbfcf042d9b6efcb0601ec57d6e49f273268
SSDEEP 12288:4yPz5L8GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zzyw/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1F3F40257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 decbfa79df5c0c2305041e1a0e0fddb6206463fde7d9c87b9559e4af0d6389e5
MD5 4052796203624f207f1aa093bb160c8f
SHA1 15db017a8935d73526d53aae519d9aabcbf9a9db
SHA512 73f31d56991203d7ced11583675cc88dd7631b6884ea866e4043ecd972ad4b884b2818e0f5834d5bec1e236c00c8be60e60b7e9af7e56ab5bb86775bae8399a5
SSDEEP 24576:fTDaLl3z0zD6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fTuLljXLNiXicJFFRGNzj3
TLSH
T1850502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4675dbed40a56b313e51d51c5b750b6a8355ba04d774bc5d2c7b0f9d690434a3
MD5 752b4766b5ecab17fc3d5105a88b8320
SHA1 eeb08cac9392ff89b92b22086dc589e700c86dd7
SHA512 e99d8f926ffcaa4d39f0545ffa667dd6fc52b5f0e7aa3b7e8a0bab6aa51094c86c58979ac793e521919d6e25cfe6be26d771bfe2ead7963e8047ed6feefbfff8
SSDEEP 24576:i3vd9CHKy7GZe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Evd9CHKya4LNiXicJFFRGNzj3
TLSH
T1A425CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 db8ee1be1863a9e41e41177b59be4a38c590defc63d7815d077f156639e0bb7d
MD5 6f03de9e766d426941131cf66d0a734b
SHA1 d479ce7ccd93df28e87c685ab99e745da0d0c581
SHA512 933fc7c8db149effbd2c1a28919a7206538c18beab71924f47d450e88512d57af9e5db2454a6d85e117b43fca04cbc876e00ffc0e138ac5f96cddf96cf530579
SSDEEP 12288:5YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FDC423D2558955B1FBFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f8f21319c48590e236c6725818f7b4c95292084e3f26242e735e3dd7098403cc
MD5 eb0497f1d0c6b622a471586d538ae841
SHA1 64d635de66f84ad1a3bae7df00022ccf2c2e2f18
SHA512 31593e41df4416ef38643cac6381076deea5f2cefc48d79bdcac9113acabbd5c79f2ad71065b4d9861a0fdd46b8bc8f970f80215c02e10a616c53e722de30b90
SSDEEP 12288:NmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EFC423D2558955B1F6BC0039867A4428F5881E2DDB6619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 80063f46d7fa4a6b6d98cc8c979cc9a273541f61846039db1165b8ad92f4d3be
MD5 59cb2dd16d884bcf244f2bc494f48be3
SHA1 036f45532c6b1e69746b38e4fd0ca1e19b4258c7
SHA512 cb1c2c759e9606a743857ec1d8edb30083ecbf841171e21ac116e9c9d4869164421b15201109e377669d78bc5287c7c46eacb32c07c34c19801ea7814dfcbd51
SSDEEP 12288:xbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CAC423D2548955B1EAFC0039C6754428F5882E2DEB5618E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d98a36507c6dab7eee81f58ff91e2bc4bd555589f8d614cce82a6150fa4a4104
MD5 882d793880d1c22edffa4600f3c477bf
SHA1 ac4b5dc82f56697d471b4a300c3adc01ffef3f79
SHA512 faf57500de1bf2151abdcf43cc3fc7c251d932fef880a49d4391dfc0d3bd9c6e8d722b87bd3ccde26f049a0b6937688d500ba3551075aeee69739188f8090914
SSDEEP 12288:9tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T138C423D3558955B1EBFC003AC6754428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 6e70fa5fb32b485a9ac6a34cec39343e689631728898e73a3e19fa555d40a32f
MD5 e3b9c41444dac88198f37f03a7217cd1
SHA1 3edf74578c421f4c83938f7700e212b27b3cdb66
SHA512 09dd8473b499a4f60f449b4ae0b05b909d4da10a1d902b5eb1afb5ede2b7d570fab74c4728b4f60e6487bf25c4b53c25c0d5b5d7ae1f4ae0ed8cca0d2db04ed7
SSDEEP 12288:TYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T149C423D3558955B1E7FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a6ebade33e73df5b9a442bf890973b08274d55f9f47ba7237a9fb329594a6362
MD5 17ec8c998986895831915f46f22d78b0
SHA1 3e542797673cf75b70b12b39999448d008826a3a
SHA512 1a491901714eb0dd4e191a759335182fe14b0be43c5b69f6f9db5a16924a7c184bc6fd6d904a8c6ce60c1e243d808b84f7a4318837417d010a7f03eb613bbd07
SSDEEP 12288:7FiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D6C423D2558955B1E7BC003AC6754428F5881E2DEB5619E3E2483D1EA338FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 370a0ec4633b004099d799b4c05be1b1d73e7b770469bc989e6e9da57b30be9a
MD5 445ab6d6b673cc7d13b983862988b8d6
SHA1 7ba12fbcbf836141dfc14bb5caab2d665d6f711d
SHA512 d79ec0dee41353ba16eb7b796147259bbb10893858698591d47340ed1fa66d078fb3e0a8d21c501d9ddcc67a4dcf4c5bcef244293f760cf1d7b0a5d465772717
SSDEEP 12288:v/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T122C423D2558955B1FBFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6500e32a33a791188d955c89b9d205bc03e50e23bc8c2fd55fa999a7f351dcaf
MD5 776d684933d8a161e0cd0ec0980ceb88
SHA1 a09aa37fed24f19f353bc3d82e7ef1d333eba9c9
SHA512 526efee141c84849cb3f73602ed95a8368ba2f73bcf6f69817bba4f5d3e1cc313ca3812f6c2cce118076a4a41dd2868be0521b1c1b942a7522e1dfad543b96c6
SSDEEP 24576:kfwvUk9RX6wkyAIt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gMnYItLNiXicJFFRGNzj3
TLSH
T15D35D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 be60cbcfdac9371d0302e47a513ad8813d422213c57f24585fbdd2ba6d264d27
MD5 2b3815c448c3380e8c78ad4b8363fa61
SHA1 9d0232c17511245e6a653d43d0de06b6d186d035
SHA512 bd9dd75eaf1061b7d5b848be8271f2937e1a4dac92cd424e611c689ae9f89bf1432c7e2579f357183795f8d47077389c1c2936b5792eb53efafe894c68c6ab73
SSDEEP 49152:/YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02LNiXicJFFRGN:qySzPe7wRGpj3
TLSH
T102066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f7f03829c0fd41876d303a2258df5473e3bc6f62b247c08563e2f4023021649d
MD5 1a00b74d08ee542f1a8403d273d46b34
SHA1 4b185b8ac83e6397e0e0ac81b2994f6a740f2f2e
SHA512 d3ffd2fd50fc3bc8b9af58f14c05031f1df6cc4a17b3820dd2f546e7cf3f80803c646f02a6cac90dc593c97d9e13b48d50b6bae7d8972ccbbd9ebf08ce92006c
SSDEEP 24576:Q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q47JUQjTirIhCnDHUPfF/GLNiXicJFFS
TLSH
T1F165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 00f75eb78237bb07a793b45a4724f31116451d10f160215b44386a0bea5ef011
MD5 2c43f8cfcacb594cbdf5f4f3aee62928
SHA1 624e261405f954b64b7189f2518d676d600e3d46
SHA512 079c45b094957091e3b89871040911e6eda7a554749fc930b16dc3659413e1ff1c2b52f53141281b56ed229cc2add79786e705c2e9f4f40568ebcbe4fd25ce9d
SSDEEP 12288:bbsf9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Oh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T118E4F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b5d2375f3dbf689e781a19779b1d0230af9b1c99223b3f4ab1de3cea89da3ccd
MD5 c79e37a013da47da2cf9df2a500edf85
SHA1 c640080e316514325e08e3d5a77050ce8ea91bd5
SHA512 c86ab766dce60137500b48db752b83d6205adfdfed8e647217cf2a094b80c6f7540b5e48577d196c7eb5a5a1c90a8d7cbfbf8de1f8d5cc126e1a79bd206fa8f2
SSDEEP 12288:pfLIPKcU3fUzz/2qw2JIHk5aA5nTYEkT//PRbXM3B7:pfcPvUPUseIE5aA5TYEy/3RDM
TLSH
T1C4351841766BD75FC6A940321E32D5CCA7707C41EE05AF0773C88B3F957666CBAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 9b148d2f73fffc2d4902d3035ce3bcc7d8b3834d7717e2ef1b903ec9616d483a
MD5 f1b6b65f8ef0e4a2ff680e90d085bf84
SHA1 cc2ff5cc92cf426db47f50c1bbdabb10fb5831df
SHA512 76c39b123f61a945c907f159549bce392ae022554f4ab6e52079b5a4fcfa97cf73580b69e6507f77c168471178585a448748d2e212a1d3fc53d80423bc8bf2cb
SSDEEP 6144:UKR6fTaSdauflqw7J1HAJLVJJi61zLsH1382nJC3tMxcC3tMxyGmPakfCmRB6X3G:UKR6fuYnJ1gJLVJJRl87KZYQpJk
TLSH
T1F0750A81513BE3CFD1F6603203265B8DAB64EC1777496F267389443AD86AB25E0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 152e221ca93dc014187eb186595f58d070cdc10a2b59e31ab11708f113d70f3c
MD5 0bc6e2b4ed42dbd864a18becaeeec6a2
SHA1 8d42b55a828472f2eedeafd6b7b0937abced9df9
SHA512 8c08b6226c805dbc57ecae0fc02bae0da5165ee234cf330051528dd9fda56d4e923d363fdf0995148d9197aca17ace4663136deb6fb374daee31b2fef2216b4e
SSDEEP 12288:Jz7ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E7D423A3568C59B1FAFD0039857A8434B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 78322988d7e0b62faeea3b1c6d69288237cc3fe4f2fa11938d2aa819c87566fb
MD5 6600c950c6d3f9c6513119b7fb214fc0
SHA1 649109dd82fa5d04b404cafe7f6da6493d6f6085
SHA512 7826f2333e1f69b8ac6bca85754ac1477ed28f375924b989ebb728fb3461c573ae4bca6b5698315f3b2136a37def5250ca450d7ae1f0bf9dbc12827795acd0ac
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lgb4mBIBhGFULNiXicJFFRGNzj3
TLSH
T11165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6c26cf62a8695d8d00511332e0beb21ad3386406c5fe9a84ce74b7d152e6ded8
MD5 f1dea0bf03cbd712bd44a6bc9118923d
SHA1 3a1919c50349eb6c7a835203d37e8755506e51b2
SHA512 0af4f166caed5e52fa58fe012b9adb3689b27bd1f2915df27d40482e30102b4a4a220c347444ae45f9ed73dc902454a3b458ea270f2e6f5ab66cdf6d7201d330
SSDEEP 24576:TG88u8FpJqH1bzria7/mE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:i7ZFPqVea7/vLNiXicJFFRGNzj3
TLSH
T18335F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ab864543ac613e402671726813a03e4d4fc56bd6bf887e154f1c1a0f3e2d3a5b
MD5 5f4be2ae5b77a2aa1e04540e5ac439dc
SHA1 f6ba8a7d291a23b2c4003d8463fe6134fe674d06
SHA512 6bcacb072eec69f4e914dad9ee5ce98294ea2310ce62a1c601e21c7783913794fb12a9667e978a43bdaa0545f9b17f8e5898cb74ad378dcc0a311a082a6e27f6
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoLNiXicJFFRGNzj3:EG05lO43bF7wRGpj3
TLSH
T16CD5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 25eab6cb9c805d160c709d0fa1e50a3734fb263c985a2d0e686a2262ed5a709b
MD5 de540491150a420c81df8bef9a230f2d
SHA1 890671c0c6cfe49540e2ceb7588e45f49d58e003
SHA512 d05001b08481a58a5f5e9917c6c6766ce99701a1074d822ace23d08f7b1b9ff5d37ab848e762ac48cecc463796b4aec7785372fa20c3955b8f80dcb739921077
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2/TwSfVcYG3K/cJHlnFR+IGNe8jg:aa5POZ3BJt2pasx2+mQLNiXicJFFRGNf
TLSH
T12065BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 de759fff9dc3eec84b9e1b363fc93a46ea7bd1f731845245c58d71e734165ebd
MD5 31b5be3bcacceb237db3a31b147c4659
SHA1 f9bd3c33505382240d5542d4de64af462019f61f
SHA512 eaec9c8ec674ae9e5d1ba8e1109d543833563845d395ef5ce073099c8394264485789e4fe8dc50ace0ec4924880dddbb6cffe84f6c6cddc20729ac4bb6d957f7
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7Fks/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KNc/zEOVHFPLNiXicJFFRGNzj3
TLSH
T19E858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7e66ad7c437d9c5a63b3a0f16b07dc65e57b2d924f6af447e3d586895c984f40
MD5 94ceaaff1a36cc451a65b0eb8bf3997c
SHA1 bdbf938e0b934da3cce54019b174334f84796d61
SHA512 7a9c32127812c00a398cd7b3d1b632b648db9a627890756cbcf31926bd2114148da6cce1d5ba81605b1d745d6ea86af8f3e9eadc524c3aa91c8efb5a2625c2d0
SSDEEP 24576:OTkNvNnaFeYhJNtmZBmy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OTMwBtOmyLNiXicJFFRGNzj3
TLSH
T15155AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 56e442a8bef3ac0be4e801af8639b9d8787050f824e04558271f9da58a89cf9d
MD5 54a4046849ecc58db98340b93742d9b9
SHA1 a6c4930d3aa10b73f2e19dfab3513b81ad55ccae
SHA512 f3ca3e6aabc2e165265beec88f00d6e1af204ce7cf42fbdb0cd6551d4fcc208e0c06a2fe03e7f6ca2ecf65e05098aa0ff4e4291a0e95dc3a40bbd19dcd4214cc
SSDEEP 24576:KPUr+NQ4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KJQ4LNiXicJFFRGNzj3
TLSH
T11905F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 5860d39a6a91c20c1ceba27682d6646e02d58eab12688ea4c59fcbfd3d2206cf
MD5 31943531be3128450f0e2e01ce65e6c8
SHA1 4d67a7545a7e308c29fa284a059c1c4c2b6d295b
SHA512 1646bb2e5139abe5c0b48eb0249c9ef4ef5207fcfb9da10d79b5c5c8a44988b6ac6caf2c804728aff82e5ebe2ab8c29813aae4b21cf730762910efe240de68e6
SSDEEP 24576:aD3FHshBIYQgAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aDVHeBIAAVLNiXicJFFRGNzj3
TLSH
T11925E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-123-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1136-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1136-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1136-116-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1248-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1248-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1248-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1248-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1248-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1892-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1892-0-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1892-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1892-77-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2760-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2760-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2760-79-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/2760-84-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/2984-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2984-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2984-329-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2984-96-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2984-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2984-90-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3036-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3036-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3036-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3036-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3036-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3136-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3136-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3136-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3136-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4460-397-0x0000026F58650000-0x0000026F587D3000-memory.dmp

Download

memory/4460-327-0x0000026F58650000-0x0000026F587D3000-memory.dmp

Download

memory/4840-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4840-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4840-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4840-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4860-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4860-313-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4860-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4860-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4860-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4860-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5324-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5324-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5324-13-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5324-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5552-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5552-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5552-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5552-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5768-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5768-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5768-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5768-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download