7fc41d8b35a9da4b10c983a35f5a92b913af784f936f795675e924bc4b0595e8

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
Size 1.6MB
Sample260924-ecltbaydjg
SHA256 7fc41d8b35a9da4b10c983a35f5a92b913af784f936f795675e924bc4b0595e8
MD5 509f17f2d3a7014b538ac7bf205d46da
SHA1 dee709662a04de32a75a6e193a334ca2c5873a37
SHA512 c156c24d891310b2f53785933937769f03e0ef5166520c4dfd8619328590afeac5cdaa28ed4aeafd68dbc07ae9e69f2ec2e74bc7fe0e7e2bc4412a3e832f88f5
SSDEEP 12288:1Ez1SeEBF2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAb:SpABQvDyiLdeKD0GFxRLzXhUHb
TLSH
T103750215B2A418F9E66BC678CD814501EEB17C998790FA8F53644BA2DF337E09E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4320	elevation_service.exe
2856	elevation_service.exe
4712	maintenanceservice.exe
4068	OSE.EXE
6104	PerceptionSimulationService.exe
5528	perfhost.exe
4252	ReFsDedupSvc.exe
6120	SensorDataService.exe
4532	ssh-agent.exe
3148	AgentService.exe
5224	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bcfd4ba27465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044a73f81d74bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011e31c82d74bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e5089c4d74bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d14673c4d74bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e761b5c4d74bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3148	AgentService.exe
Token: 33	5224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5224	SearchIndexer.exe
Token: SeDebugPrivilege	1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
Token: SeDebugPrivilege	1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
Token: SeDebugPrivilege	1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
Token: SeDebugPrivilege	1904	2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
Token: SeDebugPrivilege	4320	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 1528	5224	SearchIndexer.exe	100
PID 5224 wrote to memory of 1088	5224	SearchIndexer.exe	101
PID 5224 wrote to memory of 2560	5224	SearchIndexer.exe	102
PID 5224 wrote to memory of 696	5224	SearchIndexer.exe	103
PID 5224 wrote to memory of 200	5224	SearchIndexer.exe	105
PID 5224 wrote to memory of 2656	5224	SearchIndexer.exe	106
PID 5224 wrote to memory of 4256	5224	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_509f17f2d3a7014b538ac7bf205d46da_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6120

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2280 2536 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1744 1520 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2280 2536 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1744 1520 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7bfe4c8b1a458ce40badb413f29188a84a43924a9b0520f55eaacfdb58bc5ba8
MD5 e1fbfe20afdf86d481bbfcf879ccac2f
SHA1 da91ea39aaf1f1eafb184a57ce0528b67cff6417
SHA512 b8f3db61c3c9700ffb2b0505a52d2d9789a8494173b07b74ea7c529416440cb60095537349c8ba384a70d1f7094f8dae3f4f90af84576c109000cc366e011c0e
SSDEEP 49152:Eb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnalcUrhhU:+3q60jBCShh
TLSH
T1D5D58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 6324bc437dc6e08115b9107a4d60ea88752183a54ef91f3c41ffa47493407706
MD5 a4f45d76265302ee3f20924f2b1f57fb
SHA1 8fad18728dbc75ae989a679fc1fa9a927a1a3d85
SHA512 ee7bba87da79491b8cc09e77075b54540eceaa1a65de5b33f79dfc51743212403cd25c6515b1d7a289ebfb8668e1cc8fbb5d36bd0673a280a6d00779e274277a
SSDEEP 12288:F1XLsswWkxy2lRq2czAQ2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAZ:LXYfDtczATvDyiLdeKD0GFxRLzXhUHZ
TLSH
T1A685F128B3D008F9DD67827CC9A28511EA727C944350F79B03A4DA665F737C86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 4c7a3cf69c7134282362d52af2225490357355e95118e7be8e0ed846e0b30f89
MD5 e41f6391a9ad749718edeb392919ffc6
SHA1 274b4c512937c77072ed543b80b5040b68dd7c19
SHA512 b7126d5eb88b5486d44a629fde518322a2c11637fe39f3989889835fd869b5826f2dcc9dcc86a8990eeb409370bc0ec0dfbbdc0fd2ff2f6f1f2fa2a9fcb9ad5c
SSDEEP 24576:P0Le5ji0hmxqrM0vDyiLdeKD0GFxRLzXhUH6:PPji0AcZlcUrhhU
TLSH
T1AD959E26F6B48331D073C0B9C5D2A69AED71308557308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8bb408599493cda578d4de4ef84943cce5774b4a2facf4b5f7bf72b285c687dd
MD5 af9a218613edf06b1b6cd54b37cf6483
SHA1 5acaf200b1f55dc8c39561552053ab082e237a8a
SHA512 4da0263cef78dc1f7a11956ad8ccdf844980685aeacb4746da36333caca28757f47be92ebd30dfbd151b09b267f1d1b25edd5c2c9f86504c18ded0fd29a93c1f
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWr6q8wyuevDyiLdeKD0GFxRLzXhUHg:F/ezSC6vUzPviHjyVlcUrhhU
TLSH
T1BB756C25F5788323D0B2D0BAC5D6BA99FE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 08c34f01ff43f977fb3dd79c55a35a336e60b8343e4d2a04c1c0dadb209fd5f5
MD5 2ce0874b85d46738d484c1b58e9c16f6
SHA1 149b5a4399c39e4a21f96433373376f1287853e1
SHA512 55ec3fcd9f7206e31a8b46743740979b54ac8d782c42def9c75d85b5368ba3abf8959a867d56ea85d6a70ac5ea593d60b9552c282af8a4c8833cfa1a3298e6fe
SSDEEP 24576:VVbqPb88hv/l+bfvDyiLdeKD0GFxRLzXhUH0:VVO88hXl+7lcUrhhU
TLSH
T1E855AE66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 441db8ca3050b3db71c7d68dfe9d65f77c6b5ae8cc8fe102bfe2d610d7cb896c
MD5 18fb1598b3c2b6faea403b83b920631a
SHA1 7a1614b97aa788823e174463d0f0072a37bfd98d
SHA512 59161299c6b97bbc03eff25409665430d0a12a1732a145fbf6ef67911fd2005f7e6806d131f5ef23dff242c56b86d7e6491c3efece5b66f0bc565addc7d040f8
SSDEEP 12288:8MV2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAi:8MgvDyiLdeKD0GFxRLzXhUHi
TLSH
T1406523A1D1C02042DB1A46B8C2DD54A18CB46DF8E141B922D734FB96D6F76C6F83A0FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d9d680920bf26887586172d4da187416293b2bd7b03622d52bcef298386491cb
MD5 1481ce0cc06fce2d9ce326ec24a4c2dd
SHA1 dd1ed37a57e45311bd3f83d43d06d621efc0dfc1
SHA512 76f57dd396faa8132e338484a65afd18131f6f435bb507f203068c68c159340f703f01ff5e4b4c3e1ebd272f28b4da863014fa1b01a848493fbcc9759e698fbd
SSDEEP 12288:reBNUbTVO86UU2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAw:rJIU3vDyiLdeKD0GFxRLzXhUHw
TLSH
T17985CF7BEE28FCD2C27A8DB856918600D7B278704B52A3CBD165C30EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 97415accf414771b16d893c825bef744959c261e4418f5e1b5ba998bfe11cab3
MD5 9e5c4efaa61e0a8baca5ba9a220ee61f
SHA1 8aa2c2a6c3a0baf5771352a33d6ab6944d13f596
SHA512 44263ab12934935e5e62ee9714cd80034dcc761c70d7506375b496daf7eb3721b67b5bee6b7085f2956d64292a34d3e6f4b7b1c2ed8cfbe9e16873f80bf6f844
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THm:+QvGAdlCEL8c/RRNw5CdShh
TLSH
T1BC267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 16b0ed6ad268e268f7cf7bc423c8823b0395e08d9a51ec6fa8509d57c887c9ee
MD5 2d61aa0e1469afe0c45cb24434400b80
SHA1 5c920b5ad9819ebb862d8aad940212b8fa43a0cb
SHA512 d9a393c1e7be25d3b25dd47ce17c4690fda2d47b0a51471d48763e64deee0be3b3e83bd11efd47d8240ef52e9011c8c8acb2027a5f4447a4e8b1d91cb3a0d7a7
SSDEEP 12288:VAwSfxL/2Dc3+DLLmt0LDQewsAja2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27J:2rewsAjZvDyiLdeKD0GFxRLzXhUHj
TLSH
T1CA85E031FA74E032C77F0DB61B66C716587C79604B5129C3E3B88E9E99702C22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 98d1cb130f2a18637f0d0f8c8490d5e2d9892ce52bf72d11835c178906fd1c0a
MD5 94e784da104ee3adf957425d402c3eec
SHA1 246567146a24de3ca7f8d6d47127836793ad8ceb
SHA512 42889f89e0a562b253b183d6a29d9bfb72fcb3e40bb38354d308ed4cf029b833cb94e01afe5bde9b129e5acb79e2e066d900e3f998058f5d6fa30bbcffbc1947
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHX:pUEtQevvqc2W1cpV2RI32
TLSH
T183474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0d80ff5329049517607e409e4c79259ffc6933f476dc9e182a6737da9113e65d
MD5 7b9f0f7fdb8c29952910dd4385baecab
SHA1 8373057aad5acd40ea266d5bdf0602c7fbbf866e
SHA512 4fa8a3b5c6aa9655b8f96abc1d05ac98e5d2e4fc7d089ebcb6ab97d7d7fb01f9b7a54992c79870db53b65acc11ee0b97d7df0d5796a2d3a229bd40011679c5db
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zplcUrhhU:woquVjnmRShh
TLSH
T193D58D1976B8C2E4D1F6C37886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c40ad864db7823de21db8983b07591ba7a90a012c12dc69b89b3a40a3d1c7896
MD5 a7be9dab966258ef19a876d0866fbfe7
SHA1 af03654a30260cec1947b66818f8b14d5885c0ee
SHA512 0a789b855ccfc207598b8810378640c9b6bffd12012e22b90d93fc335fc5ecafdee7079f8eb009366ce257b6c1f46b50e6776e1b796c3d03bfbc01322b2b7d96
SSDEEP 24576:bAhGL2IFoiwtA5l7S53CvDyiLdeKD0GFxRLzXhUHI:bAM1Foiq54lcUrhhU
TLSH
T16335AE80E7F955D4F5B3AAB899B68171E976BCA95E31D20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 2fd6dc61a1eeaddf1472b300e9e0cace3dc66618e75def62ea8d1ddf2666770b
MD5 8f49e0d95acea70d63f8cec6599e4c52
SHA1 55607b4a5225f9c870c488b852c354a2aa3cd57a
SHA512 f4425b00a85ca70257258d86045222a57507a1a16073a60a70eaa0e3918ce3401191c12d0ad2007d7f3079d42ba9a23a94cda2f89245b156c0ce0a36bb913289
SSDEEP 12288:Bmw5HEjsChNDBFgl0WDm+Cf2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUo0:cwu2OWdvDyiLdeKD0GFxRLzXhUHH
TLSH
T1DC75F14572E41CF9EA678238C697C132EBF2BC512621DB1B4360C75B6F73251AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 478c46c9ca88e707889cf5ecf21e48bda30bb769235301ad9456ab6f985f72ea
MD5 6de39eddc68e8a82db2c7dbe874b12ad
SHA1 d512735f9aaae1697f6b70db5313406c663699c9
SHA512 3278c2ff03c90400920144fd937446c5720c0ba303adfb10f9677c0924798918a7c593fc17c45d119edcaf2dddcc7652fb8f7b137d7f3ff3fbf28f9804ab6aab
SSDEEP 12288:/MZ1IyK2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA+:UZuMvDyiLdeKD0GFxRLzXhUH+
TLSH
T1006512A932D430F5D257827CC9E94541CBB178E5632253CF522487A6AFB3AC26D3E372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3db59cf56d1954b488507f3771794b689498fcccc3390f4e40aeebb3f0539e01
MD5 9b05a02abd1c954d428b8d508c7f706f
SHA1 29863848870cd9782d93f9d1b182e6fe225b73ab
SHA512 8d8a1775517a144e74c0c18286c22b67ccdfb09a258f7c5a120b54b2db1704207e30e57ac8ba4567aac74fe42a5497aa2b0838771d342ac6430283075bdebb98
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UC:vQRQyi36YOcPhLvw2gAf+PN3uShh
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8ea40128393300fdd68b1ae86bceccc58f6384dec07fd05e851b5d0fded0155f
MD5 e488fdc609778f166e2cfd9755decb86
SHA1 5a38a0761a1630340e884185fc0cc3c93b85befe
SHA512 00dffe00c42bfec67c3bf4a295f80d2aa4b0b4e2f7bead7cea748bc2aa41a8eb58e6856b8938b0b6709072c671089654ca3b0d358201c7b85e593777f73c0739
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UC:EQRQyi36YOcPhLvw2gAf+PN3uShh
TLSH
T1C2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3ace875d407fdb5a22a2138c6f2df74d90e363b7e42710642be66ec028ce162e
MD5 d8ae6e64c5259f225e716ddbf598331f
SHA1 1d247bf22b42cded47488e5f037b76e4e8ccca8b
SHA512 67a3de36d972f5bff057f4db9b4a0a62e4856d36780734bbeae0d69c086d53d90ca3d67e8c63d094cae6f9444449ba8fe382caa8402cbb25453813833cfa1c05
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0cvDyiLdeKD0GFx8:G68Qg55nhceWu7PNU3/ZlcUrhhU
TLSH
T1ECB54933B2F200A9C44DE1769F4A873196E17C758FE1E7DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2371f8dde6f3f8c351a461f8a44a46e1dbeac41ed89edd9669f0a9b7e4fa8aae
MD5 e7a47979da5f134987cceac8b5db49f5
SHA1 2747c1e8cb625ec4ae674a07ca71cf60de842fdf
SHA512 c34661756920036b227096a107eae798053815eb5ed32d780a4a4668db21305a5f37d76246ad9c0663b020e416c0feb48cd5d8f81738297271ad17ac39b89d70
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99M:Yy5112gYy5azzVva69nLKnhZ7Shh
TLSH
T145167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 721581e049a39b921ea0c638b1fa8b43118008e137ecaecbd52619e3a3d0e736
MD5 fbf296b5b45ee99a29b58c50ddadd3b0
SHA1 ea28159f3ddfd7f7575891ed1758789daa6d0da2
SHA512 4b00ad0c5f85900fdae704a8c274fa1ddccd42c4455ef97225c83f1026ac255eaf6c24f348ddd7b2fb0d2297ddd5c9ebb6896410ff76de4c7f99e89e99b76050
SSDEEP 49152:KB+taZ3usBWOBr4tEG20bqx0z+n217aau1glDlcUrhhU:Yu6JmUxd2d2Shh
TLSH
T1FED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2cb7d4e8c4351710c2529fe9470c9e17c6873c399a2163977f480da5d27d3edc
MD5 021a52a8659bb6ab757230cfc0c29355
SHA1 a1f9b1471f380d72e829ea09c319b473f0535463
SHA512 48b005582b7685ab70518a8a024f99503f9e43c1419673ed60070a0f692f2b0649e3f58baea695845041d168493ce7307a5672e0b36693e1227c97aaeb202cde
SSDEEP 49152:x1hpsNoJpF1A6BU44CwH7R4xflcUrhhU:xmifPkRRShh
TLSH
T158B5AE13F2D901E8D05ED178875A9232EA72BC450B24B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a797d9209e38784317bb8fe006923803d2f0d27f0824ad8a040e102a36a8d2d1
MD5 127caecd809ecce5a75fd88c4b29bb52
SHA1 5af442f7e4ba29b42c7d5e9d4993e0b3d27c2706
SHA512 420ebcbe1a583ce06655348be6a70e4710f3809268d851e42ed15fa592c99c01ddb228021dd7f36ee9837a29708e0193d35f6cd561f8fda579dbdfebd09bb737
SSDEEP 49152:FSuZQIY0Be2KNRVtOnks6NMHqKlcUrhhU:L5dKvi613Shh
TLSH
T13FC5BE13F2E940E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f59379ebb835f263cfa5f7f8675a9656036ec98d00a68b295dc0a20ed4118bf5
MD5 b98604964fa2e804680a2ff7b0a28a7a
SHA1 fe89caef8a67ec153c2cafd4cc1086de01b0f7ee
SHA512 5024050c94df4654195cac20509fb48ecfb8bc0c838d65c4dba2d61b1c7d68e66e74bab0fd27d6d1f00c6b58e304cfe8ffc567e6366b35f1adb5feb5767585e4
SSDEEP 49152:BhtSn8EApI0figXgiDn0AP5wzlcUrhhU:QX2iyph1Shh
TLSH
T15895BE13F2D900E8D05ED178C7468632E962BC550B25BAEF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 fbb403b0ba93baf71349f0df31dc89afebda9104e3017d057fdf69dfc146def7
MD5 345d7c5616947fdc341b70b0bd3c0480
SHA1 83f4b0bed74c55830cced8fbf6bd62d81ca63c6a
SHA512 c343ebff3cad5be13b3e93508c7a737c40d3f903b1d358a9a4a5e92c8accfb3033bce9b3208a8b6f38f209d59ec9ae9a47255609d9d677efd4b992fbae92fb56
SSDEEP 12288:cd2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAI:c4vDyiLdeKD0GFxRLzXhUHI
TLSH
T14E6523A4E4C12542D70A82F9C2DD51A1CCB42DF8F2417423E728E752E6F7AC6793A4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c3d94bcb4ae90a6e7469e25fb0c1c54d285484f29caf6db4d17faf58a3daf483
MD5 5d874e869e1ab00b0edf68aca6a7ae97
SHA1 2fce01d2ec78cb16d6e724bafe0ecb063dc200d1
SHA512 4d7573867dc6e2ba5c3fa5976a550956744f6b06bcd7779966ebc0b390b5bd6ae855d5131d339344c3f87b189bf77eb9285ec62a5f90e76f44a5c39df85d29f3
SSDEEP 12288:JW2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAI:JFvDyiLdeKD0GFxRLzXhUHI
TLSH
T1616523A4A4C11542D70A82F9C2DD50A1CCB42DF8F2417923E728E652E6F7AC6793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7f7b8cef1d5c0e0b30172da41e9e0bf117f10b0d42f66a83f7355ba183932cfb
MD5 61d357b22c5d252bc0cf5a73bfa78f59
SHA1 03e31b4fd68e80a67c7398ac4fcb5d3faea31027
SHA512 e20c732be27fbc8d27f3772338e46625425f7ec9205c677643868eb498f63bdae0753f356c17f39582d8dc3aaf70f3e7d3191324d27cde91d82e5739cb882c0f
SSDEEP 12288:oc2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAx:ovvDyiLdeKD0GFxRLzXhUHx
TLSH
T10D6523A4E4C12542C70A82F9C2DD51A1CCB42DF8F2417823E728E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 cf2c518d24c6b3f643bf5eff84675484be8a4ef06ca89eaf6aa42791e0d78e22
MD5 544d42d400064e98a306853f079c88b2
SHA1 c09a545781107b29741c41e0cf58f63ba9a578ec
SHA512 8546a6450a25bc1ce09fed5f7a497c78bd9209b8f6f86db9e8f796096556f61951d62943eb7e0b62f9f6ed48dd82feaca41835b6dd50f67870d40036f27ee3bd
SSDEEP 12288:xVz2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAU:evDyiLdeKD0GFxRLzXhUHU
TLSH
T1496523A1A1D510C2CA1AC2B8C6E94061C8F47DF8F311B627D720D6569EF37C5783AAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 52c78688bcd07e338b93eba78ee691f240efe1b6f6a405866d34b0e3dbf9a356
MD5 dd06db090f84b75dd1292e3dde8d70d5
SHA1 372edf82819373b49e8c5dc07d4406ab4a60b718
SHA512 5feaa9deed6adf88468092514e14a0a0b2598084b5221a7f4ebd5ace18b44ef6b99d7dc5b6ce2b93d2e64eb95b4686cb7dd69659ba1782e3af9f090b3948e886
SSDEEP 12288:Hr2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAR:HKvDyiLdeKD0GFxRLzXhUHR
TLSH
T18A6523A4E4C12542D70A82F8C2DD51A1CCB42DF8F2417923E728E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 7b2e4ef7af4ce720d4dadde16e1ebc87de76d0566acbc0c649e40f4961bc280c
MD5 aa7539868c01ecda98e461701afefeb4
SHA1 a3b31eb2a7f52d7fd907a318976aeb64250da174
SHA512 0f62d48080fdfa6232524dd3ea2fc5ceb08320cc53d6f4b3f8cb1c5b01eb5e127ea0e2689028927e0500cfdcb5cad97eee7e724e93e516ba3b926c8417c49302
SSDEEP 12288:Yi2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAg:YRvDyiLdeKD0GFxRLzXhUHg
TLSH
T1E56523A4E4C12542D70A82F8C6DD50A1CCB42DF8F2417523E728E652E6F7AC6793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 840027d525ceade9f7abccf9865c55ad401515033c47b95545b33357545bc46c
MD5 caddbf06107114d15d2ba63594e783c2
SHA1 57f0bc7da59b363d42812ed7c373d167f86e08b3
SHA512 545bd325614698d591c3547b8d1c854f36c9415a4704a3380e02af6857c4136fd99c3444d01bab0d42d1669318343eb0ec9c3c735918a5eb7078477d44fe5bae
SSDEEP 12288:YO2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAo:YtvDyiLdeKD0GFxRLzXhUHo
TLSH
T1546523B4E4C12542D70A82F8C2DD54A1CCB42DF8F2417923E728E652E6F7A85793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 18c33ea61d81d68254c13ec1d84e4de49c746d1b11f58e9bc590fce3f185545b
MD5 74d8b27100805af16975e666a560a9b4
SHA1 d94b7f7a0d4a241508d1d409072b0c7c8c6e013e
SHA512 ce3ee1652c718215e9ea7dbb2ae7adbd73abaf08a7b66df08270fd0fb8ac557dabc3802f0dab0e99b890e2870f5f8de39e6e722924f00f513dc70a570e806b3d
SSDEEP 12288:DiZwbrzzFEoS2cPvy22v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAQ:uZM/zFVSOlvDyiLdeKD0GFxRLzXhUHQ
TLSH
T16B8501A4B39018F4ED67823EC9558912D6F27CA94760CA1F03B436675F733911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b12fb98c6021cef9715b891156c0b4d7dd923e741b8ef4b32e859d013bbc57fd
MD5 ec87c2e62ca6d1e9162c8b204ee6ea98
SHA1 6cd2174327da84923d90b98729848f503e7ac572
SHA512 0302cf0cb2036355a4fc772bc8bb8f88c32edfd773d6b06e61ec522de78e5b907b9e582261772d555eb9d056c41488f5440758ea027405e46d3d9a1659a908ee
SSDEEP 12288:QR2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA6:Q8vDyiLdeKD0GFxRLzXhUH6
TLSH
T1386523A4E4C12542D70A42F8C2DD51A1CCB42DF8F2417923E728E652E6F7AC6793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 b24d98aa4b73c81af96d2dc780aaee5a7d6278e9e9bcd29224e2677a42b9f342
MD5 b58ef1d12313310b3cbb5a6a1453f1b1
SHA1 f8b4e35dfef454d925c03e393700b199fd7a1cab
SHA512 5a62a64b887a67ec8dc47fc9f0596de3f57d34a9352a83468bf590d933e5970c0a27076c3c8c163b64c242fe802e1d4069a909247f96206f35d11fba7330a67a
SSDEEP 12288:WF2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAY:WQvDyiLdeKD0GFxRLzXhUHY
TLSH
T11E6523A4E4C11542D70A82F8C2DD54A1CCB42EF8F2417523E728E752E6F7A86793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 aa39af6de4d973121b4e75cb308f1eacafc873140b7f13fb8f48b25a1a5989fe
MD5 19f884dc55b85619fd76abd64cc6ca81
SHA1 dacdce127272689f3c2f1ffa0e975b1e7e72be1c
SHA512 cf986dc5a40715c71da4206ef429d9e818ea438f3415241e65119122817034f98d0acd0333cdb955c562e1829feb608abec1cabc9e04ee6d3e65db34eb8dcae8
SSDEEP 12288:MyPz5L8K2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAW:VzyJvDyiLdeKD0GFxRLzXhUHW
TLSH
T103751257B2E130F5C22B8278C9A60912E7B17CB553109A6F536087766F736D0AD3EBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 358d66ca0d2785c1d9b7e801cdb59c9067767d71da01c66e29be83d68d5f26eb
MD5 13c1701f53a75c008c1d88a3f5557ad0
SHA1 ddb0d0c313fb8cf0e0396619ac39f7c460c05336
SHA512 09b7997a5b45873bd9e1b27cc25a690374a636f88c01c6055bc032317b1bc30d58ac4f47919c82bd2929dbc37f24b01c406a720bdbe668ddc738d35d08480dd8
SSDEEP 12288:uR2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAk:u8vDyiLdeKD0GFxRLzXhUHk
TLSH
T1AF6523A4E0C12542D70A42F8C2DD51A1CCB42DF8F2417923E728E652E6F7AC6793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ae0cf7979eafdb29742eda71564604c1710e4ea3f1e761f2c6770aba296f8869
MD5 1399778d2bf8ac82d990ff93c0ce39e2
SHA1 4cc6e00577d1a76bc286efa9dd6857826ed29ed3
SHA512 1fcf2ebe689ef615eb9493684410f8340e7090d0069ec1f82c0d9afe0a46edb5f6866c37d33230119f8f44742c4372a4b001baf8fdf6eb4ba0ccba33c85b1317
SSDEEP 12288:/R2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAk:/8vDyiLdeKD0GFxRLzXhUHk
TLSH
T1F56523A4E0C12542D70A42F8C2DD55A1CCB42DF8F2417923E728E652E6F7AC6793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 66fb69bac26d57e40cb62bea6ca61ef555242bc17df6c4271b5ff4ef24579593
MD5 df08b0ab9b7659c951b02fe6d0b440a5
SHA1 2e5c5aefd3e7a7fd10db24bc32c5532cb566180d
SHA512 71191ddf75f2deef4370d825adfa6fb96b47fefe121990e860d65e842682bc654a01a7cfb8b6a390642789bc90f685ca76c2719f83df86807044dd1347acca73
SSDEEP 12288:iyPz5L8K2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAG:/zyJvDyiLdeKD0GFxRLzXhUHG
TLSH
T181751257B2E130F5C22B8278C9A60912E7B17CB553109A6F536087766F736D0AD3EBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 755f88173648a877d0c14d1af0d7d6cf748a80fe9e710611c3adea7c72f37bb4
MD5 83278c25f9ec84cafca078b5f8246f4d
SHA1 a76b4ff136931b03f6ffa2a028359c47293e2e6d
SHA512 0e619196e6d983da2f40082e5b506b3780bc3b795f15e46e42ab527ce829b2ed0e4dafa0e300adfe24fd804c8b775dbb968e7f390252ac77b145acc63346f656
SSDEEP 24576:tT0aLl3z0zD/vDyiLdeKD0GFxRLzXhUH9:tTDLljclcUrhhU
TLSH
T1948501A4B39018F4DD67827EC9558912C5F27CA94760CA1F03B836679F733911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 87499bb61152a384aa9e931f1402d7627d0b9f1724771f06f3d4a969c98bc2e6
MD5 19b8669f6e8fa86dd74347c6ac162be8
SHA1 bb953baa71dc675dca94c40285f798dee92e703d
SHA512 2f964f0a6d84788b4c403d8916bfd3566a12d254a04953029e076472c388835378be0264a4aaf1ba133fc358f62814a710a9529cdfe67cc110878d5e9bdfd6c0
SSDEEP 24576:43Id9CHKy7GZLvDyiLdeKD0GFxRLzXhUHP:CId9CHKyaRlcUrhhU
TLSH
T16F95CF90F3E410E4F1B78A35C9764511CAB67CA95B21DE8F03A8661A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e45e8d235f620e3973ae6a18230b6fc637c828c1b48686a463c7acfbc3287081
MD5 ebcce7409cb3f4fb1b60103f9ba2fc09
SHA1 28d36775e005da7e4c447b2a25cf1a924f8cb75f
SHA512 a2b5013e7a82a58b2d0203bcef1f1efd4196c179d25a2cc44127b177c13c550553180c435007733bb92d8f683e76c189a4fa0c6598b079b83df07e4b5ea5c5aa
SSDEEP 12288:W82v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAO:WPvDyiLdeKD0GFxRLzXhUHO
TLSH
T1A06523A4E4C12542D70A82F8C2DD51A1CCB42DF8F2417923E728E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 1d311978f92705500d9cd6e5fef114b53a1ebecd3537512d64af0326861f32d5
MD5 8d85994092bf1fcf4a1239c3ea0b7563
SHA1 5a692ae371030500f6f4f720a965ac5d8470ef56
SHA512 da6271cc1b64dbddb274e138af701da54e873ba44270562fd92b301d811d30f143cc82653d6ee5e8d635a6be8c7f803a2ea5768821963b0f59bb2558a9c1e811
SSDEEP 12288:Wq2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA8:WpvDyiLdeKD0GFxRLzXhUH8
TLSH
T10E6523B4E4C12552D70A82F8C2DD55A1CCB42DF8F2417923E724E652D6F7AC6783A0F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c3e0fb36ec1799f815c046c9b00f08f4303978d2565fa268545d098cb14fb83c
MD5 43eb33cc36a03288f2501e6f57584f64
SHA1 42771981963e9673c3e26532635067c020d1e60f
SHA512 da146b95dba9a1d4ba4b74e19b4af6daef5432f6882370be5950337a772d45d654b9c637a198541b655cea8c56486687f0f32d2eefa64bc81de1bcea382da5f2
SSDEEP 12288:O32v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAg:OGvDyiLdeKD0GFxRLzXhUHg
TLSH
T1946523A4A4C12542C70A42F8C2DD51A1CCB42DF8F2427923E729E752E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ec2634cd76e3139c788d51bf453d8d41d25092d97862a67ff48723cbb3833817
MD5 0aeebdc613a94d97e5411b64e3df5f69
SHA1 614ee6931ec9dcb5ec66628c556d2551accafd8b
SHA512 a8e47b6531947c611c7936e804570311383faac70bb6e653e2c3a4632b6d7902741684c909f2133e6306470310b1fec24f1780d0223918ab4dd356594961f72d
SSDEEP 12288:oR2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAq:o8vDyiLdeKD0GFxRLzXhUHq
TLSH
T1A06523A4E0C12542D70A42F8C2DD55A1CCB42DF8F2417923E728E652E6F7AC6793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 d0c08553b509904c3d6ef0a37d20cba6ff3ed2a97d69f71f36b5c14ab1b1f3aa
MD5 a1e734362d3fa318affc81d6843d5992
SHA1 7770df30e0bebe9980ba5f68c0a43bcd90a97c20
SHA512 84ffdfb20bfe0fe0fd54507c9a3a0f0a5c679db03533b27d1e5aaca7b2121e3c10421d2b71a5d99e20e1ad6516db0f11f2635fc62e3cba9bdb7ba8c86b1be3f4
SSDEEP 12288:X82v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAu:XPvDyiLdeKD0GFxRLzXhUHu
TLSH
T1196523A4E4C12542D70A82F9C2DD51A1CCB42DF8F2417823E728E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 7e18163aa5e9831c9df223f4e4c40ce4e6aa5b2a53fe7153b9129f8497eb5343
MD5 4ce8eba0aed6340e5bf1eb38b3b5b79b
SHA1 18bb9ca13c12aa7238faa2425f4f2b9e1ff29fce
SHA512 363e9b7472993d3ac5352e727faec105d5f5bbd308e09f8010cb46ba1c96ee8dceae748c0873a2495a86b30d27d83311c3789f2578dff9eb9522e52f4bc790c1
SSDEEP 12288:xp2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA6:xEvDyiLdeKD0GFxRLzXhUH6
TLSH
T1386523A4E4C11542C70A82F9C2DD55A1CCB42DF8F2427923E724E752E6F7A86783E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e42708bd9b281ea4ba7bcb6f61881023d7ecab0341af8d9751d42c9d395bd6a5
MD5 e8fee40e81e4d1346723509b29ae4346
SHA1 770910dae67cb89afa85d29efaec357472abc10e
SHA512 864ffc7d4660e3ca2a7a8391da6bd10eeb08e365e91d0d5b295fbb5049c3c05bdf5c06f6354a3ba4b2e7ff554ebddd59368558cebfcef1d7c0d2247dc4201af6
SSDEEP 12288:yr2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAm:yKvDyiLdeKD0GFxRLzXhUHm
TLSH
T1E16523A4E4C12542D70A82F8C2DD51A1CCB42DF8F2417823E728E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 8f7b3b0cb6b84e55f2bdaf7681404afb5279f2c7d2437b830f3aed1fb655a051
MD5 643b2ffce9573a2be2cf8a37349fe250
SHA1 ca426ced3875dc132d51f3ca62fbf5c9909b0ac8
SHA512 dbad9026132f05c91fa01747fcaa7c615dd07ae2ae5c4acaeb10f6f54aecee106a7203da2f55439be5a80094d6a718dcf65ff69befaec53450429e65c101c171
SSDEEP 24576:xfwvik9RX6wkyAIAvDyiLdeKD0GFxRLzXhUHl:tMnYIWlcUrhhU
TLSH
T15F95D029EBD804E1E177927C89F7460AF6B178681B31C6CF125A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6faf8ef8e75db4465ddeb5949d0933173f1efe1c799f0a31179989af2f396629
MD5 97590c0ab4582c92aa8a28839880966e
SHA1 d8276811b64cbddf583d7e21660919c360b01b4d
SHA512 2306d7d7f81b62b818346f18a5345d3c5743b5748110308c5b13bff471450d29e91389796d8329ee75002183dc8b2a2ea7193f02fbef7143c475d72ed9817dc5
SSDEEP 49152:/YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TlcUrhhU:5ySzPOShh
TLSH
T15C067D96A1A801D5C1B9C1B98F0BCC17FAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d7f9025324fafeadb1adc04d04e2ca7675d2cea2e0268cafe4e4af04682d8dd6
MD5 26684c1f0cf9e4fd6d6859686d22e23d
SHA1 e1fb284da04c58ba17aecbce15141f7a3d182c77
SHA512 0a3a75e886bb5be474319766d8601be80db386c13220f9d8c44e0c61c3bf57cb9d23b399f99db0a8695c0e91e0761974f12f7b353c6106ff6008cac789ff3932
SSDEEP 24576:d47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYVvDyiLdeKD0GFxRLzXhUH7:d47JUQj4irIhCnDHUPfF/DlcUrhhU
TLSH
T10065AE1DA3EC01E5E1BAC27885154A5AEA71782D1B31CACF2270837D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 9db537d56015478b866f4944511a461f6820350c65f405267146827bab90f875
MD5 8e6ce3c0a921e20cca81a05b1d198d55
SHA1 994ad17387b0c1fa869650b5b625fa58ae3daadb
SHA512 5e2ec5f4627f73b532bcccc46d57e4a607a03937a91d9662e998d03ab9daa5ae83c02ae2bab52e80630e9c777970d209ef7fc48c474218fd372f7cb8fcca1d49
SSDEEP 12288:A1sfh2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAD:xMvDyiLdeKD0GFxRLzXhUHD
TLSH
T19175F059D28402D4C12E52B9C79A4641F7733CA493E1E3CB93D0F63E1FB6680ADEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 209df5030a8ff0e19f2a4795f3ca5ccb0d9b4cc11e531f3cab30029df5f2cb99
MD5 a88fcbe04f38920b66e2f52d68e73084
SHA1 de7602d06e10f3f126a668a851671a30aea0d9db
SHA512 0a091d014d69110eed7eb74dcd7aba2bcf393392b3c15cb0adcf32c21cc1f0dea368263004f467bc9a916ab7a56d2b79ea3560cada357c7564943fe1bb0b9996
SSDEEP 12288:xXRMKXOU3fgOzF0mOZNp/NBuYgnI2ukylGzmYntJ/o9br8wo:xXRd+UPgTeXpyAzmYnLo9b9o
TLSH
T1343528017666CB5FC6A940325E73C2CCAB707D01EE056B0373C98B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d575e49311717458e598e69347f7c42eca97bf07f2ad7ceddc0ef4bbed2c32a2
MD5 825a2d543d30bb84b8b81aed546039d1
SHA1 c9f63303382be79617584886ce3c4ec42e8eacc6
SHA512 82b90233bbde4833e029ef1ebee5f450da171bb54fb31c93becf9fdae5723ca4c6765f775e5b3c61df6f773156b3bc64ddd3f5b32c95d3eb242d61d311f48ca3
SSDEEP 6144:BQ2sEV3kA/Tib8M3zhNJxyIcFId1IvFzUSQytMx/YFWUbvr7bcuFQytMxR2xoIAg:BQ2J3kACJFxYyMHbcuCPwcH2IkNy05su
TLSH
T1C175F8815536E78FC1BB6032072A9B4C6BB4EC06B7096F2773C9453AD86A751B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 bb19ba1cd85bc33722bc2deca8c9b8c1bc3e65aaab1437cb600fe32c0cfedb4c
MD5 b2bea3d36b93f725c79e64314ad91400
SHA1 a1cd42d261df2ecf868dada7700599bfd25c1505
SHA512 0fcb246cdbfbf995cc0d1370822c333a453d2628e15ad77852118810a215ca6c89bf4105275e45a61355a78f23bc628472cd23a67d54cd97703367cb3947b387
SSDEEP 12288:LL752v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAK:TUvDyiLdeKD0GFxRLzXhUHK
TLSH
T1BC652371D1C42442DA2E42F4C2DD80319C797DF8E700A463E624E796E6F7AC1BD3A5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 79b5467c0b35bd8e55397fc0169ec0f31cd028cfabe0dc6c00930aeb43f5149c
MD5 bda9798b16e0adce197fa9b6e4a187d9
SHA1 c7feac7d25f0b051bdce357e10ee2171f5e2a782
SHA512 2157aee0d5d6592f7b48d795c5a34174a5222e871391c11af621749efdbf8a6d44f9a804fce8ccd3d1dc1c899c6620ec92370ff0985046d97e0b89c452ac2ada
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYevDyiLdeKD0GFxRLzXhUH/:wgb4mBIBhGFNlcUrhhU
TLSH
T15B65AF1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 13673a6eb75d4e767544ae8e90e66cc8059376427bf0f01e47b0422afc67f927
MD5 d352993ff18533f575c34dae8cd5b486
SHA1 22b2a198cad1ca6137a0343380f9712fdbd085ee
SHA512 fa968b8030737a27c2d1694c21d925d3e43338b606268fb8ad654f4ccfcf853d5427862f272f84bb40a7d45cbb6d11e234eebe4c0a014ef93a74343c2fed234c
SSDEEP 24576:OG88u8FpJqH1jzria7/mlvDyiLdeKD0GFxRLzXhUHO:F7ZFPqV2a7/klcUrhhU
TLSH
T1F795F165B6E101F1D47BD1388A864663F6B1B8251360FFDF07A88B521F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 8cb1de481ec6eebc2760851f1fd263f7326e7d73b86b2bb0e6bf5b6a215964f5
MD5 2cecb59d1bd5ded07ab763bcd4198e0b
SHA1 4b86997fbad0e700c3e99e91f7fc22cfce46c520
SHA512 74ba98ed6dc6ffdf443d23dc64682db31e1a389581b0b5f4e055d0937b146379ffc71ee81c7bd18f85c95493cf90b088851b23ceb3d84185d17cbee0a816a797
SSDEEP 12288:0HvUrBFrEjwaQS2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAq:0PUr+NQBvDyiLdeKD0GFxRLzXhUHq
TLSH
T18675E12F62D818E5E67AE17CC5864619E67178A11301E2DF02A0C17E5F77ED8BC3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 40e3c7807c7a875b262447e1b78acb881b49c39d7c6233dc32fcc9de65c25e7b
MD5 0223b8e3a95af12d9ba3db5f49e62f19
SHA1 bc6a4dd5f1ef77df47d0642319d4d110cf74102e
SHA512 f1b01d6f2c40d4b53bb373e94372fd37448ceab995404afa18455bba692f2e816a4320fc7f32388e7daf46af254c64c82dcd2cf3abddacf5dda2001eb3bacff0
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhlcUrhhU:CG05lO43bTShh
TLSH
T18FD5C06E62EC11F5D1BBD17CCAC6460BEBB23825032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 27781042c902a01d2022186b869a7a7a9dbbaae3383eb647dfe46ba1a031f21b
MD5 3936b19c38df61b8b1a07ed828a6dd46
SHA1 94a63aed2965233ad695b8b555f7653d1993a174
SHA512 50e1216c5313c0217ad6c67eedb16c144c7a386bee8fcd7c16b52e1370b393ab82fa1547a56c13dea90ff0abaa3d685f6a56fb14bd8a27c38644d8dce36829c4
SSDEEP 24576:Ofa5POZ3dpqWVM50JicR2hG0lasx2+47eidnzvDyiLdeKD0GFxRLzXhUHOX:Wa5POZ39Jt2pasx2+mZlcUrhhUu
TLSH
T10B65BF5EA2FC01D5D579D17CC683861AF5B1346553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 938ceddb11705fdeac3a4c41dc299c34f6f7cfb7e6f1a8226a11943a2bd4ade2
MD5 0be55d183a17ce04d4a47f180acab2a1
SHA1 b2511fbaf1c5fbe906ca54204a5622e2c2619f64
SHA512 9ffbed48517db2ea089fb979a4cdd586682c88d84ccfda91602fc987fa45b3ce6fcae08fdfdbdde3f17fcfe667ce9bee474c4f1b377d3a31dbf6a7d709bb94be
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7Fk9vDyiLdeKD0GFxRLzXhUHq:5Nc/zEOVHFElcUrhhU
TLSH
T1E0858C2623E901E4F5BBE1BE89779546FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 95dfe1ee287db6cc73a77b131fbe046c06bca69d9a7a1201ab1e7310b59dacd2
MD5 1ca4f5831fc9c0d98adb7a10ecbe6c86
SHA1 8c3bbcf19e395b744bffafbdd9640ab99045b387
SHA512 d15733a1c96b8e015c7f291c88255bdcd3f3c8f2b8a08a8b678175e504bb9060495f771c804f7ed0a0c415bdb5737ec246bbeee398c31b2344c606c3caa690e3
SSDEEP 24576:MtkNvNnaFeYhJNtmZBmnvDyiLdeKD0GFxRLzXhUH4:MtMwBtOmvlcUrhhU
TLSH
T18455AF6EB6F805E4D1BEC6B4CD238512EA727461173292CB9390C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 f75211dda7a3ebbd5149250a39f26af8e49151b5f2b913d1111840a3469c937c
MD5 08c5243d0e767a4a8cd517edfc6f4273
SHA1 04f49f4b7f2ab07800763dc3d627d1de4cd8bf5c
SHA512 ee098dc43aceee4e6a3883962e1b9b2e4853379f06db4f085f28c4f79d6363a0091e9dcf2fb9c63785fd8da9988953cc6967dd6e43c5ac9202725a96b75de3c7
SSDEEP 24576:gD3FHshBIYQgAYvDyiLdeKD0GFxRLzXhUHP:gDVHeBIAAulcUrhhU
TLSH
T14385E17DE69804E4D57BC1BCC6A38906E6B138E8032265DB0294C1B65F6BEE47D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1904-1-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1904-9-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1904-0-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1904-78-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2856-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2856-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2856-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2856-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3148-128-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3148-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3148-130-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3148-122-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3148-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4068-56-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4068-272-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4068-55-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4068-62-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4252-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4252-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4252-83-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4252-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4252-321-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4252-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4320-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4320-15-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4320-21-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4320-22-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4320-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4532-116-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4532-309-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4532-109-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4532-110-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4712-53-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4712-46-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4712-47-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4712-45-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4712-39-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4712-51-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/5224-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5224-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5224-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5224-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5528-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5528-303-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/6104-294-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/6104-68-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/6104-74-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/6104-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/6120-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6120-102-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6120-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6120-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6120-306-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6120-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download