a1852edc4e91849c5522e1eae853e5796cb7c581485e6dff2af36162ea13c965

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 984KB
Sample261023-tw54macw9s
SHA256 a1852edc4e91849c5522e1eae853e5796cb7c581485e6dff2af36162ea13c965
MD5 e0f93904a89dfd967c32d4b0f1d8a3d4
SHA1 16749243125d1da3a91e84b77e93409897887945
SHA512 e6c2311e47d3ef50162cca360a232f3c0fefd9131585b9fc722b7f36544bdd1d18730959e96023478633397b979996351f94623afb4eb951f84c80935b89b373
SSDEEP 24576:4S4riYlFAM0Bhvn/+h1ALVXXC8Ac2YV3swxhZPegenZPwC7:2PXEBh34eWh4sCdegmZz
TLSH
T19A25029467D90CF8F977823DCCA28616E6767C518B30CB5F0361265B5F33690AD3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1056	elevation_service.exe
3556	elevation_service.exe
2864	maintenanceservice.exe
6028	OSE.EXE
3164	PerceptionSimulationService.exe
6032	perfhost.exe
2068	ReFsDedupSvc.exe
1528	SensorDataService.exe
2672	ssh-agent.exe
5436	AgentService.exe
3128	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\98aad8f1b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bea5d8270b63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ae095680b63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000edb8c9280b63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d808f680b63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc5e62680b63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af6dfb270b63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe
3556	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4472	2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5436	AgentService.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: 33	3128	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3128	SearchIndexer.exe
Token: SeDebugPrivilege	1056	elevation_service.exe
Token: SeDebugPrivilege	3556	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3208	3128	SearchIndexer.exe	99
PID 3128 wrote to memory of 1248	3128	SearchIndexer.exe	100
PID 3128 wrote to memory of 2848	3128	SearchIndexer.exe	101
PID 3128 wrote to memory of 3476	3128	SearchIndexer.exe	102
PID 3128 wrote to memory of 2260	3128	SearchIndexer.exe	104
PID 3128 wrote to memory of 5200	3128	SearchIndexer.exe	105
PID 3128 wrote to memory of 1560	3128	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_e0f93904a89dfd967c32d4b0f1d8a3d4_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6028

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6032

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1528

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 792a8c4bc86e62aba6d238393c7e185f7b47102b642e0ffe33519c35b015f01a
MD5 35b492da881c187dc11b73f3fcf5580a
SHA1 484b48fe414a8940af5670fe9659b44d2ce22ac0
SHA512 2c8052a94fa02c3668301ab2f7ea8f413a05b8860c2e908ec20f683b4ec9123636c3a8fdd56a1da48dda2edc01f1471010264f22360f9a94da67e1e5cfd9f42d
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWWh4sCdegmZz:i3q6HjBLWIURZz
TLSH
T195D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7856453e384fb3bc2eb979e23bb80ff3cd9883f07bcfc24f0ff78aaa75ba5e0c
MD5 a3006540158d177bd56afc5c305c4712
SHA1 bef44ab8ce625b3dfe8b909b98f124a172f69066
SHA512 34741e05ea520048bee1af6516960f9f7ebb12fa4d84833911048c1423e67befd670b7c684b339f82fb93ce4ccbe53914c49cd09ed4db741ae774facb123f0c1
SSDEEP 24576:BXYfDtczA1VXXC8Ac2YV3swxhZPegenZPwC7:EtcUWh4sCdegmZz
TLSH
T1BC050128A79508F9ED7B827CCCA1C515E633BC544360EB9B03E09A261F376D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6d3c31f551155cc67f2a8a07acb449762cef8864b591da5c98564db236e905f4
MD5 b2f3034bec12816d3d30cf529f5111ce
SHA1 5bf5a09f41eea93ae5d063e1ebec34d62934e5ac
SHA512 19914532d5457663b32322d7d1f7161f6e54864c2a88a8502888ee17c51f8ad63c8f297776a214bbe564cb4806ebe151522179666125d0ff4e9caaf30136f1ae
SSDEEP 24576:x0Le5ji0hmxirMQVXXC8Ac2YV3swxhZPegenZPwC7:xPji0AcZWh4sCdegmZz
TLSH
T18735AE26F6748335D073C0B9C5D2A68EED71348257308ACB4286D77C7E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f2654d22ba707305e76992ffca20851c0e13154659f4f152f65186278e344319
MD5 a119a61f01e69e24fc379d2a248cc5c2
SHA1 0f8283e1277f318a7038ded6d05664d403f0ae7b
SHA512 74dd6674de7fc9870ec66f6b529533b0a0625b81f2016fdcce259f23ca564b8196f859d1e34b0da8c28228ef91da7261f9b3436db14f99dc290e857a42f10162
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuyVXXC8Ac2YV3swxhZPegenZPwC7:a/ezSC6vUzPvxHjyNWh4sCdegmZz
TLSH
T1FD756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b8b29ce62702ce7044a8da5bc2d155dcc5ff703a747b9e08ba3120e8a4832ed8
MD5 722dd3cc9a245e30841153adc3fcb91b
SHA1 e613c40a8716916bb55bb96eee0a9b830a9003a3
SHA512 58d1de5bf029c5f0cd4c11714ee051631a6c0bd8c3f686ec6b6a62530b7136ed3a5dc44059da39393c6b0eef62b41ea0271f96c83f5a204a1cbf920e51daff88
SSDEEP 24576:uVbqPb88hv/l+6BVXXC8Ac2YV3swxhZPegenZPwC7:uVO88hXl+iWh4sCdegmZz
TLSH
T108559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 34f1ef2e668dea18745ecb993a3a41a7900529a11f145dd2cd5381eb03be4c53
MD5 9e527edb6cc0a31b7479ff9b8b1011a1
SHA1 e0f7d0b2cba4af03c8f45716ddbc9a7290a58e44
SHA512 5fa30696ca87ee1b4a3747ad2a2cb65a28ba9527679c9fd41024bf2f38beb4fbdaf3fac8a0822906a2c4a8f2fceeaadd2434b0405dedb6c54644ccb47d622683
SSDEEP 12288:TR8VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:TR8VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T18AC423A2CE069467F7BF0674DDE4E7D9E6289F449084CD2992817F1E7C3C899A432533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 de2194d2ea1e479e9ed0b2b0efbb1e7938a5f261bba21183d3a49d0b5895ca4c
MD5 0b6b6d326cf22a329a8d877ad97ee42f
SHA1 a4f3c433f7a6304f5f26a0eaf196055b7d4c5d23
SHA512 ba32519ac5e3e149a140da5da1b575173cf9718433ead7a04ae17cd71ec276951f1063bcf73f3ed5984d618a3027bda12e8d560bb11418047f742a870825ea38
SSDEEP 12288:WeBNUbTVO86UZVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:WJIUZVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T12805CF3BEE28FCE2C27E4DB85A918340E77278304B61A3CBD165830E9E275E55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1d24dfbf22b2fb923d28c1c3f3b683f6d2917437f852ed4e0a255f4fd248662
MD5 06eaf6a6c20c48c891b7c6db7ea32f31
SHA1 2db0871901d8cd9f62d531d329ec626f84060ac4
SHA512 e2cd1610891db1183f3a2f007616f274cd9a0c37bff27cfacd8e6dc8123ccd2be27f7e62d011f9c9d8ccca802694f941e5881f738e1651b510c9cbb6b617e35b
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:uQvGAdlCEL8c/yRNw5C0WIURZz
TLSH
T14B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a663a939500058a69811b13ed0b2d58ea2fddbe679784703a36cafc508b75e99
MD5 22e39582353b15c1f3e1d2e19610bcd8
SHA1 49ef0e2fc30e9ba3c378750a5ac32529bc429244
SHA512 af7808e4a421b82c9bf95650e1c588dbb7118be75e99672257f32a98ba05c27e380282b35d8dab7af2fb570c1badb4a99ca39aac70652b16ec8ae118312ae1b4
SSDEEP 24576:idewsAjTVXXC8Ac2YV3swxhZPegenZPwC7:CljpWh4sCdegmZz
TLSH
T11015E031FE75E036D3BF0DB61B65C716542CAE204B911AC3E3E89E9E59341D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 081c832af27a367e2e43a32c8eaa3f291ad66637ef86341b4c4317a779072db2
MD5 c9bb7ca6ac7f5ddc83943e1a60cce12b
SHA1 bb2938d73204e547afee82c1f781c53beba2a554
SHA512 f0112740b277531f4caa5986ff5fb402eaa091ccb96c332f261b337c1c1b9c99b8272f684f8c155eaf27d875d1330546c31c3dfddecd80be51814f8763f62280
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4p:lUEtQevvqc2W1cpV2EI328
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ef5c7b6c92796e24b0e87c8e0073fb2f60e2e224eef2a10e39aa09526fd83046
MD5 bc9106acf2327714f4214413f1400cc1
SHA1 9b344cea5c4d6234be8f9bed73dcde80e736b11f
SHA512 66f957573b5ee7f3257ec8f256b01cdd42d0ddcf86fc3f7df98f9dfde691b55753d711a1665f430f96c84795f221000854337557d824a6c208ab831cc5901865
SSDEEP 49152:yCbRquA/m2yL5zLfFiV+XenmE3/zJWh4sCdegmZz:Xoq2VjnmoWIURZz
TLSH
T185D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2848d52ad087a5f8b17311eaa82c973fcc82984b3abbba6cd3dd7416acbd28ff
MD5 04c8cfb6b854d7ed44cdc62a2b800039
SHA1 f82e1ea814356808b47f20e3d03828a9ea93a783
SHA512 f766b40e60bc2f2df75353c8e68cf2e35f6363d4091e4b3dbac7ab9cbba5bb871a544fdd9bc0cdbf851759674793b8d4961412e6023a604a0644ee86e60a388f
SSDEEP 24576:6AhGLJIFoiwtA5l7S53mVXXC8Ac2YV3swxhZPegenZPwC7:6AMyFoiq54Wh4sCdegmZz
TLSH
T18B35AD81EBF955D4F5B3AAB899B69170EA76BCA55E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6d53ad240751c447894f10bda041117cdf0d59c55c45d08b67c1a64f3211dbcc
MD5 3c0de4aa483e5cbd956c32a08a97f09b
SHA1 3cdb87bdfb966eca49e233595e5f3f9a189c3807
SHA512 67e08f40f1152a85d54287cd21afbd26dcf731e4207edce7630c5c0e6f533d29a3dbe298cff599af785b7773372604c5d3c668570111d235c8afe5bdaa581fd5
SSDEEP 24576:XwuoOWnVXXC8Ac2YV3swxhZPegenZPwC7:XwDOMWh4sCdegmZz
TLSH
T15A05F14666A50CF9E9774238C997C236F7B2BC012624DB1F5360C75B6F37261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 076599a7c5b0cbe59d949b862dbf053962f1a7356b1bfa4533b6e81ddf868abb
MD5 ed4eb2b9f13d27a75c374fc360cf3e1c
SHA1 6c3b599e95784c90ef9ecc46fb5a7ed305e0b32d
SHA512 e8d1cf1b928442e52f29b7cb0ecd84230dca219ae91362a663bb6e7d103cf62b19d43d445efb191326278eb8d48a4f8861c76a9fd108cdf2894b019309da9392
SSDEEP 12288:LBZ1IyDVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:lZuIVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T161E41296279460FAF2BB4278CDE09789E371BC51637487CF12515B6A2E3A8C52C36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d2e8279a92075b198a6c2c49e83d3acd716703621086fb2cdf7d9a8d822350e6
MD5 7ddb763f18e4f0bee83c2712887f1d41
SHA1 f34ceedeebcee772a5cf73439e65a9f3fd8307be
SHA512 a4ab8ed1321fdaef02160a8cff179a87948d888b34fc24469991225ed943a5712a74380811499c137281ed313ea52234ebf5ad20ff1a00c3e93bf5c5a7ca98f0
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:eQRQyi36YOcPQLvw2gAf+PN33WIURZz
TLSH
T1F6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 593f24c1ac0e41610655a704da8069b2534c14773096e045025043d554b4de4b
MD5 1d81fdfc4e0d4ba4e0ca398451300dfb
SHA1 b429794f8c70ff8019bf5060f4e143694e8cca3a
SHA512 5e97835b872714dae5ffdae9f69c55e16f9841e098c61f6b1e2baf4c303ab3f8c357552f42067a90fa49083f09b36fc3255891894bdb6c343d1a2b9e3ad306f7
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:SQRQyi36YOcPQLvw2gAf+PN33WIURZz
TLSH
T13F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63464ec2593be8c5ea3ea0ba72b7a6f408c915ba0f11a5ecedfc2f605c31c385
MD5 0a20cf92ba468ac4ae5c8aab1dc0058c
SHA1 977fe87cd63d826cbea9a76e404a2238e127012d
SHA512 891b61ec2305cc0bca3582a95507e47ed3d4f5036d75d3dd082930987c4e6a6745588844df01a195fe2182c77a4548146433662c4bb681e95c97ba8714472fd7
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YVXXC8Ac2YV3swM:v68Qg55nhheWu7PNU3/ZWh4sCdegmZz
TLSH
T1EBB54933B2F600A9C45DE1769F4A872196D17C758FE0E7DB8501720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cfcf08ebcdf2c14e75eb2756e62446e3fea0adfc0963304b33dbad1731d39862
MD5 f0f1604c39c290ca6d4afa3956747c06
SHA1 39f23794255b66e2634b0ec5ed1e6ed0fa18ee33
SHA512 cf9eeaafd2f99d1afd904206da0762fa0ca0223150e51a9cf2275c68f1549367c552223dba15306a1a63779ac0293cfc3a90a033ee090270b5a39e98efd79788
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:hy5112gYy5azzVvL69nLKnhZ6WIURZz
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8dc06c4125046308b216e005f6ba4d41c80e22b04c4bbb68a03315fad124b8fd
MD5 430ec80a9395c6ede55d8f3a8f9385a3
SHA1 df8d7c16abe6fe8ca62a410f08633a75f92b0ecb
SHA512 949de1669cecde10ad91fa91c842ccba4108ed1c1319f1e22fe301bfa7c097d69312ce73a91655a6e39c6e57b1e6943bb15a2b94e6be55c0c88120d8eef67ef0
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/Wh4sCdegmZz:Ju6JmVxd2d/WIURZz
TLSH
T15AD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 76e9139e3c4a4746d06335b611bb476ffac1c03b5288b6df6cf603013329052f
MD5 b328b3fd47d0dea42aa113c5b6cbcdf3
SHA1 b149babbaea0296aff2ce9d9bf89be53cbd00c87
SHA512 d47e45553bd121581dfbd0394c0e7292dca4c47f4cf18cd96fe34724450c3f39dcec12aaf832c4725f1e5dc2d7307d9622bd9dcc949201b5d074dd97f7c2ff34
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xDWh4sCdegmZz:QmifPbRoWIURZz
TLSH
T1BBB5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0b850379a211ce6f1bc6b9709c1a411129c1abbae088e1ec6379afe11b1465b9
MD5 c94da8e380abd5ba90432dafc08237f0
SHA1 2be2549e313b3c411f539b64ec8f10a1f550b72b
SHA512 9d329d53c141d9241df935e162aac18852d0d99bd0c145d887693aec11e18f41d4882d669bf987df38f9c94535e005c3c6234063d4b1d08a4dfc2de9c0593d98
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqmWh4sCdegmZz:q5dKTi61mWIURZz
TLSH
T160C5BE13F2E940E8E0BED674CB659232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8e65570c40e4a1bff039991381438a66f4cb8fedb7dbaba64a6b8a8b86ba555e
MD5 8e6ccce1aa7423495ce6e1378982b830
SHA1 dbe4e2344380091a40093023e25894aca37a8aa6
SHA512 cf5b06b9a5ec2538bf8c0d47578728acf7cada29de513532ee5d6a33859d33642298d611d4a766bc002982323fb488461bb8e8dd40778acf2ac5f2de80daee4c
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5wPWh4sCdegmZz:jX2iyphsWIURZz
TLSH
T19F95BF13F2D900E8D06ED174C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d6e555d72a9673197487814d9fd5a6419ed7be9c2c8be6ec54a4de581feee15a
MD5 cc345d72340e2f5a59cc3fed987d0a13
SHA1 7e2d79de1e37ba3268ea5231b07138efba586b72
SHA512 4288db27b3e3239351c2082ee59ea856097324c7aa52e7bc50a6b90acc2ab89a9e325ac8fe4dea01dccd6644c257b5a080957f3e0ab58265f93038f68676249c
SSDEEP 12288:zUVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:zUVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T177C423A5CD07846BF37F46B4CDE093DCE6289F84A094CD6A92827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 19b3fcbe7e8ff6e041e6f7273f364ace138ec6539222e2c30411901757c08ec0
MD5 84c79e046a7e79cf51d6bbf2a06c4785
SHA1 cdf897ccb8de0e33081ce0709420d42b70213b16
SHA512 203f14d0b7698a83c98a8f2d51d669311a025224d16ed796a8cd97df11f57611461b6b59dd9c4654e889ab69142eb526e060620cc43aca4ec8c9b4e0db0767b8
SSDEEP 12288:svVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:svVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1DFC423A5CD07846BF27E46B4CDE0D3DCE6289F44A094CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 39da78f46660e4a6876b61d6c2ed09e81a9019bd10156df4e9a7b21dfec64f6a
MD5 0672a059fae8b4ffc8b9c3ebe78ad96e
SHA1 6be7069aabd73a4bfd5a0d4913f1f100b250c103
SHA512 77b8c2576b140ad3a8241db8fc71d2f427050da2335de51aad9d48c8b5791a4533c1f5a7f71df4874f04f9789cfd34db4a6997285f26bd25697e6877867d5aab
SSDEEP 12288:QRVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:QRVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T182C423A5CD17846BF27F46B4CDE093DCE6289F84A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 eb7651e00c4bac86be84f20e5b95ed98bf4d46a5d9ec33dab1a2b52073ef03a0
MD5 6e6610fd21f7fc739e63005080a7cf16
SHA1 dbe884609ad0829ae4e07f8db21771498e25e94e
SHA512 7336f51648bab1377cade23370c67e5d78402043cad2fb6031add8c151bc1d97f8f573fb307576bdc217a3fb490f91d54465da2cf677b07204c9f64714070acb
SSDEEP 12288:DVGVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:wVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1A6D423619E1A40E6F57B8774CDE0D3D8E378BF94A264CA6F93412E1A2C784987431B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 44ef43d68f4fd8fa9a5fe7e369d9b0ca17a724e8171ca18268f8c71b0f4d1333
MD5 9c845dcafa893dee00e5cff734af7a92
SHA1 d3d4fa469be23dd4d9a8ad444c60eaeb6e93bdb0
SHA512 f6e637d9c9009e353d8254f8756d8ce5fbeddd3392200e95ac1720e7dc9238d7cfc865d6f73f7d141a2cc337c673d6a4a578ddeed2be12d19d45cd04b0939b1a
SSDEEP 12288:ruVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:ruVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T15EC423A5CD07846BF27F46B4CDE093DCE6289F84A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ed55027a60c5fbddd3543572a431e88119defca154e9896e8c711e410f9f6be0
MD5 6d86284ddfc182fac91c6601fe15fe55
SHA1 c87bc9f865301bef4a886560efae9369e60821b6
SHA512 47c7307e7be223d89c3338554eaa1e73dcc43965041da76da19355af0c67da5639597ff58866fd2ed0fc61de4470fd6472f14f385415b8ed7b22c64f798604aa
SSDEEP 12288:OLVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:OLVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T160C423A5CD07846BF27F46B4CDE093DCE6289F44A084CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3514e38501fcf082e8b7d21efc421b2e8b3732b39ae72ad5bb15cb6c9b245e6d
MD5 11906445837e0190e2701efde496e138
SHA1 be4d2b4a8cae0652415e0830b87972d771a46596
SHA512 7d244bb87d9dbe2961bb76c907a41b74315d7b95152a0f1d88b2c286faa1fefa7b04e6497ebd6eeb01bddc649e358425b7e88fd26da891ce63c5e1d0a496ef60
SSDEEP 12288:n3VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:n3VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1FBC423A5CD07846BF37F06B4CDE0D3DCE6289F94A094CD6AE2826A1A787C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f2cde8eea6338004ccffe4d7abcc757a48158ca0538b1a50b33f7a35a89992d4
MD5 ae2742979c7ed75ba19edff7c5b443f1
SHA1 0b03e853819e217a01f3c5747313165cff7d49cd
SHA512 f00e31a898e093e583c2fac5c7d40a19bdcfd626da228f2ff7aa7c9f18dfbbf57c7c795f039d84ba89599dc361c4ef7324a1ff8807e3d31363e1922f6b0cd39d
SSDEEP 24576:dZMSzFVSOPVXXC8Ac2YV3swxhZPegenZPwC7:dZMSzfhWh4sCdegmZz
TLSH
T1730502A5B35018F9ED77823DCD658A45D2B2BC590760CA1F03E4362B5F372A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a2e878ee5945f095ac4156051c31b1ed63db92d9174f32800c49805a720dcafa
MD5 4e3e2df92a85707e5ed42aa923326729
SHA1 f4d9f7f69a73034cf1dcc1746e1f76bae0419add
SHA512 7d99a686d3db78d314b0325dd58df68139c9b798f47f788d02a4321c205b68768346f84fd3440a144aa9cd667731d5d6ffa7569d588cbba519efcffe7cf4f763
SSDEEP 12288:74VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:74VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1A5C423A5CD17846BF37E06B4CDE093DCE6289F94A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 56357117877243d7384f2f195724742b5e67442249435555217a675c6a6a6f24
MD5 636ca26e6268a10b80f4c4a10dcb529a
SHA1 2bf5bc2044ad027336ef459bd105a9bcd54c133e
SHA512 d39903ba602967a2d9017ca49794901f210d11cb16b909f7e5b0a163ffd6c1596c2c96054339a72088b5b7dd6c1712760570abfdb38ba619feca531bd534fa33
SSDEEP 12288:tsVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:tsVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B2C423A5CD07846BF27F06B4CEE093DCE6289F94A094C96AD2826B1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 84cd5147cbe130120a85f768b9858530b8246d5e3b02b77b31af63f3e0bd2d53
MD5 f9baba884a0afa1e99b555371b0a1fd8
SHA1 604a6aaf99ae0ef9b7d9ca98a8c5201a526fc047
SHA512 63d086a4fab10085d4e3b60e4cfdb5e1a1f5f7b928aef241e557ebc74ae8a49aa9c1dbab737018df6c2c9784f0d43bdc721fe80a120242feb12772205dcb1043
SSDEEP 12288:5yPz5L8DVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:4zyDVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1EBF40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 347133de98e7f15458eb1110bab9556651557513615f4fe3533b78f07798bff7
MD5 3b6e03fc46d0479340b77a416c9ea461
SHA1 eff886f3c12e82e9d43886440fd18e4cb5354761
SHA512 822e00666ee2a6b4c2fc4803c0948d5011f191f96a5b61809d37ec23a093570f235106cefa60bdeb8e46059798941d2898db6cd56736e1d224de9bb83c2df665
SSDEEP 12288:l4VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:l4VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T163C423A5CD07846BF37E06B4CDE093DCE6289F94A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6482891cd1c991f62c07eb884f43186b05eb10a759ba6e578d2f509d31f2a313
MD5 8b2577ced58392da9a887b6cfe2680ac
SHA1 baf29e4a5f284bb4a9ef8072fbb792bf616b630f
SHA512 5cbdb1862038b8ff175704af604894d3efa356783b074c1ba7efbb83c949300f7a8071483ac8a8c326ee27608e0d5b044f42770686abf09bd2f285f2708ab656
SSDEEP 12288:e4VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:e4VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1CEC423A5CD17846BF37E06B4CDE093DCE6289F94A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2322955c73cd18960534b2161ba4d6c730073ae0fb7c1ab4a7a47cc46009118e
MD5 a0f8b1c358803cdf52364e48797ce8b2
SHA1 3c97791b54ac02e789fec85e2ac0a3f4d83f8019
SHA512 14ed9b9f7e197e5ec8d8539eb82ef95148de84fc8baa74a5f66c6944aea2c20ee3de352eeb01df61554f7a70053997e012543ecce5bc9482efaf339c33956074
SSDEEP 12288:nyPz5L8DVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:KzyDVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T167F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 cf5ae2af53db87b400ab08001de8fc40a2992a0664f76e462504c9f6bc40a803
MD5 9737abff497b82f7a0437f668b87a3a5
SHA1 8d9456e6801b3f74e87cbdb615065c36e957973c
SHA512 3ab186bba96e6307430f2ba8a0a21961009afe3b5a816d21e79c596da1e03b60480551b4faf98fa9766eb3ba2f5e8d6fbbcae1f7f4078737c5cad88ae104d001
SSDEEP 24576:/THaLl3z0zDhVXXC8Ac2YV3swxhZPegenZPwC7:/T6LljkWh4sCdegmZz
TLSH
T1940502A5B35018F9ED77823ECD658A46D2B27C590760CA1F03E4362B5F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 cfb0b33e5e700c6b19d0fd7a853293e5d75a64a5ccba75e8222d475028010972
MD5 5ea86f962b6a214d53286898e04ec38f
SHA1 391875c52910839eb9bbba6a1d8ddf5a992be1d5
SHA512 c6388f8b3cc81d08567f12cc842aa04141fc669f42ae1cadaeab7dc017540d7ec8c6085189af62f7da95cbe813c384e704fd5eee61210e9ca6cde847ee749a5c
SSDEEP 24576:G37d9CHKy7GZNVXXC8Ac2YV3swxhZPegenZPwC7:o7d9CHKyahWh4sCdegmZz
TLSH
T1B025CE90F3E414E9F1B78A35CD769611DA767C991B60CE8F03A4261A1E33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d4347b32834d0a221cb057bbd8bd8e970384247bdd69c08337556ff2e7b910e7
MD5 843b2879d85c9f4767300749c5d32fc1
SHA1 e32f0edd246bfcaf06c8178fc6c190d5f719803a
SHA512 e52f8141f5251eaeea2fffe83d9d219cef13f465719c30e557305e258ebe18cd85547bc39577868b9cb2a9452168efab709b5a8d7323288b54875f91331d95d2
SSDEEP 12288:hxVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:hxVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T163C423A5CD0B846BF37E06B4CDE093DCE6289F54A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2a59e30fdf4c0c9f9d06b99dd16eb69bbbce0116e4aa4cb5e48d48a0483a7f87
MD5 3071a2d39b38565c783d519b5e4cd79a
SHA1 cf12cf78b7496aed4b16f8dbac6b8c254564c315
SHA512 2b40bb9670bf9c9e097f2027435b53e5b67b6150038e94558b8b55e7752f44035628b9fe9fa673afc1963438f49275253aeafbd218d5909b02fa114592bac863
SSDEEP 12288:pjVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:pjVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T14FC423A5CD16846BF27F06B4CDE0D3DCE6289F44A094CD6AA2827E1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 0aec0f659566689fe24ad2a5bb3ee02d77c66dc730e67232e0153f6ea8cb731d
MD5 705d8e095030c2aa3b1f52e8352ba05c
SHA1 41d66d813dfecc08dc61b4b8abae03a2552b06e5
SHA512 fd011e394e0df794afd478773a0087d8baeee999586256d578953273269cc98d92d98b636c4ae63f5c3a83dce000fbedeacfdf123fbb8eaca3f112465638ddab
SSDEEP 12288:a6VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:a6VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1EEC423A5CD17846BF27E46B4CDE093DCE6289F84A084CD6AD2827B1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 29b9cce6933a984d4f234ef7d2e0d9e119831a305fdd80e06f27c08b520d06ba
MD5 cefb93483ab039752a7c1ca38c7ea417
SHA1 aa57a908e9b4679daa1cc3d7c53ef506581af5ed
SHA512 5829624fe5454ec92fd276c0e9018ea322883bafee3e56032702ff246023c455efcd61bc83606d6a3e4edc6302dc1637f3d83a765ebd309a8adf4fecba6506c1
SSDEEP 12288:G4VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:G4VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T155C423A5CD07846BF37E06B4CDE093DCE6289F84A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c2f207c419a9ba6838c12f5c96aec272c63185dbfde4e089b2e28cffe468a1a5
MD5 7f8e4a870b80a133b09c462723eb33b2
SHA1 31c02732540c1369b44a2ccc0120dba59c24c668
SHA512 cab51459544b4e11bda6db2de5383d3ecee1a989be7980783e57d59e329a548a47786dec663b65b13bf21d48aaa37b55d4eccecb5f184ca4e3643d4975842008
SSDEEP 12288:0xVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:0xVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T19EC423A5CD07846BF27F06B4CDE093DCE6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 270d04f6c2d3d93dd5227fd37a5299ea5f7f1843ad57b5df0dec9866aef3e076
MD5 449bb4813686cb547ccefdfe7881d212
SHA1 61c3c40f785692660456d0977dbc8407d3e07228
SHA512 e906481fdb7fcdc9a31ace12147933de1502126fce758581ca59b0d8002ff056672c8198b2d8af92de101ec32f0b09c13b60414b8d303323c51c38adac0a5740
SSDEEP 12288:igVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:igVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T139C423A5CD07846BF27E46B4CEE093D8D62C9F94A084CD6AD2827B1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 11fac55e5956b79a03a0012bb796e132e27e7785a09b1a5cb5d4d6d088cb3be3
MD5 8901e39efc166ee611284632a5e7c9bb
SHA1 06681703096ebcb7c6757470778d914ab3c81c40
SHA512 7ae385d6548de6559e8b28a90f8af2646e32419fb676e399082c0ca8b095ea7c1b4e70cfd18a74bf9b23b96ea6e5b8b124582184e28e86c339889335698a81f4
SSDEEP 12288:muVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:muVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T18FC423A5CD07846BF37E06B4CDE093DCE6289F94A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 eeacec2c7bf9de57e1203c33f15dd4c091a42166821f288334ce8ceeea9a22b6
MD5 0bc080ab3b21a5190ec0c999badcf56f
SHA1 182dfbfdac08eae0ffa373147df4374bb6d4a3cc
SHA512 4d4918ec01a272efddac99070b140635f864fb485158cefe40b469c103bcf18b655d41085c96ce4e88979cf4135ec4c7648cebe10a75d4d48b4d92c3d243cffc
SSDEEP 12288:sJVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:sJVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T147C423A5CD07846BF27E46B4CEE093D8D62C9F84A084CD6AD2827B1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 983098e91440d7ac6251263958acc9b630a96f80f8c6ca76264aa6d01db80a10
MD5 08da71d1510083263bb69256c02ee5c2
SHA1 bf57ce0a0386d415fb41f0739a204750bae4d51a
SHA512 f926a8ae4abfc0b2f8ba1d87b099e5d2234bd71ef8c94b6979e39c6e89951d7f051548cac129eb42c6be0c23943acdbfc920b65b853112b25757e526d2ebad6e
SSDEEP 24576:Efwvok9RX6wkyAIcVXXC8Ac2YV3swxhZPegenZPwC7:kMnYIaWh4sCdegmZz
TLSH
T14A35CF29EBDC44E5E177923C89B3464AF2B178581B31C6CF029A536E0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 66fa4e5538b5663ae259e6e430dfc7d9345b44513cc61e3e6196bf3b624f64a2
MD5 f850945692ff018a7ef9bee256c852ba
SHA1 3b7ca13cdbae70ed3dbea88c06de9e76796d601e
SHA512 461e50966d50e5cc0131f23ff220ab89b19a678070c33bd47ff395ec8c59a076d79f37d6dc4f2f0f080532a012aaeaa5eea50a2ec2e22316734a2ecaf9936243
SSDEEP 49152:WYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vWh4sCdegmZz:IySzPXWIURZz
TLSH
T13D066C96A16801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1b66eb9b5a253b797e23d8b92f285946530a27775176c3c231f841b4a88d66b8
MD5 02c72d7a7bfa6f397d597a27ef5e91f7
SHA1 cbf7cdbb663fe336665c4bca60da05fd31c0ed0e
SHA512 601c06ba26af2556a8bf9b72eeb4b3e2237fcceb1392b21108120eee791dd1a35b3adb930cd49e88bb2bd8664b3509e6896fbd1bab58f73017e22a15b1bdd459
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY/VXXC8Ac2YV3swxhZPegenZPwC7:C47JUQj1irIhCnDHUPfF//Wh4sCdegmB
TLSH
T1E465AE1EA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e05db5d3d402749f6d3b713cd961b7ffb1298601cdd51b84565127e8e24433ed
MD5 36bd7e6832100e446ad59eeb353be9f9
SHA1 818fe88cdfeb35292525540f275481877676db97
SHA512 225f4ab9742d9edd10032fe769f49d8a65933fe815d9f26c5e830fbc0cb22d66dd005058eee84b380c50b28a83fbe395a256c78fe541231236f2443833b60406
SSDEEP 12288:9NsfIVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:SIVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T173E4F05AC25801E9D16E5278CB918684F3377D6493E0D7CB52C0FA3E2F3A5946CEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f9f8d065cac6d7ed5741eb9a4b0426730742dafc19c19f5e2d36a93730379ea8
MD5 38f3663774b1549485e79b46d32e2632
SHA1 d79c67676d124ad462eef796a15cde84a9fe802f
SHA512 bf9b014e623a7fa8dedb168a0e3d7847cd90daffef8e66cdbbea49c2ab0a659b374cd8ad846700e8635117a0fa454384d1bf1346322b0dea9ca8a2462a3b0f57
SSDEEP 12288:yB6jtNjnGVlLRSmA1WJnybBMy15JRMwkVj:yo6VVNAI5ybBB5JRMwkB
TLSH
T1A3352700B666CB9FC66940326E37C5CCAB707D51EE04AB0772C9873FD576658BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 728515396161bf67f798a29e3baf4a0ddebb4d7001f615596379d1b82bfda49b
MD5 6680abeea0c739ec1f7762317b114456
SHA1 4b13ef82d8fbd8d0b6dc197502603adf01415fc3
SHA512 b93e922a945e4a2347067efa511e35c92b11cb22944e5149f13ff9d4c581e5fe0de33f00ffd75ec03e467b88e9691e7c4d89b89e1b9d377a454846958dbcf645
SSDEEP 6144:Bpx3cAXAhuSuBXQXzo0NhNyX74A1sP9uytMxAQytMxAOnynoX/eAB6Mf+iNilny1:BDwo0Nhd98IiN6e
TLSH
T1EF65F941A037A68FD1B76032072A5F4CABB4EC16B7456F2673C9443ED82BB51A0F87D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4e0ee351d2eebd0a09a5d48481dcabc7b23d91e9cc75e939bd1c9a4edf13c08d
MD5 1907fad72c67d9fc24e0982df8d870a2
SHA1 de16efdaa63eaf355696d4ffb1a914ac5fb3ad4d
SHA512 88c64140827aaead1d0efc384ea3c0e495018773c838d54788ee4e176a7c12fec73528a9aaadef0a60db7a0c2ee7691844723a4f9534dbdc60b925bacbf7f203
SSDEEP 12288:ZF7wVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:nwVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T11FD42361CE0A8827F67F0674C9E4D3A8A22DAF545744C9EBE1417B1A7C3C8D96C32637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fea97af435274c1a0029c1ffffe0d968e335ed76c10c14ad9841fd3c0855dd85
MD5 bb3deb1ebe1fff87fc1e099ec00a40b0
SHA1 8b8d485202d30ceaf2301cc868bb3790593c8b1e
SHA512 7582c1799d3135d69a7df8b6cd1a187518d97004b16b62c9083c553ca299f6093e16478eda44fd9eb5965ed93ba44901dee91cabc2ebae5964cc029204e12abf
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYyVXXC8Ac2YV3swxhZPegenZPwC7:tgb4mBIBhGFVWh4sCdegmZz
TLSH
T15B65AE1E22EC02F5E1FAD2B8CDA64417D6B278160731D6DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1f83f35c8dc93bb2f51627c44e7ab416fe6a276574f1b10805184dd80b37ba09
MD5 82b4eefd6ea72e90b86ff3805298c91a
SHA1 e9f4cd6cbbda672a401bed0a490ba80222f06eca
SHA512 719c1d59450bb8fbc770c6224f5ea9ec4f6ff35dfd774495405cdc9ddb28a889f063a314df2205d895250caafff8ae325c76a257c4e6816b6f58d3903ae242f4
SSDEEP 24576:5G88u8FpJqH1bzria7/mPVXXC8Ac2YV3swxhZPegenZPwC7:s7ZFPqVea7/cWh4sCdegmZz
TLSH
T15535F165A6E101F1D47BD138898246A7F6B1B8250364EFDF07A88B551F33AE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 95ec7de846b4b193d3097a5699f19d141f58152571df323c350200617394b4f8
MD5 f540bd48de25e1b4a9bd1f307916486e
SHA1 fcce4be3b180db89184f2bd2e33db902cf2caf2d
SHA512 0a39624fc4d97f1838d5b91f34843821b102eac282f547e4fbb92623ed41b60f636940e7b17844485128ab950771c689730c59156068c5bfe5f7e7642b76a652
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRWh4sCdegmZz:mG05lO43byWIURZz
TLSH
T18CD5C06A62EC11F9D1BBD17CDAC6460BEBB23815033456CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 47c2a9d6a3643485d053eb85004af39e617d379f134a106380d21c613eca9cd7
MD5 08c397d8b4531e95ebe9a6a0b2595d82
SHA1 2c2bb55fef557d83fb35c7c5d97fecbd089ce2c5
SHA512 4f990dab56d138f1111ca6ef0462fc2ef135a154177581ff007c0f5feaca6d20d809957f70013c5844bfc8e45a38c1e6a69b936b96a2c33f5614ed4aa58486fd
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVVXXC8Ac2YV3swxhZPegenZPwC7:Za5POZ3+Jt2pasx2+mZWh4sCdegmZz
TLSH
T1D765AF5EA6FC00D5E5B9D17DC583861AF5B1382553319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4aa8900d75a632ace3c5ef2bb5932281d7b30aa2d04a43f2cb874565311cae0f
MD5 6c4345ffa61fa84900f5a87cc7d4db04
SHA1 56a7ffaacf0946b10cf4d2f4e1187dd2a82955dc
SHA512 cf3323e45819e686619c1b9ac4357b50abf16e6d2b23a014d186a8f58b553ffea41ede729342384a079d2c6ac63642a4d9512d79e9e1167a44b7ab48382befa9
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkHVXXC8Ac2YV3swxhZPegenZPwC7:MNc/zEOVHF8Wh4sCdegmZz
TLSH
T149857B2622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3fbd5e8d55739dc034abc620c31852a3acf5a429f901c03815469cfbe05424d7
MD5 7c74e1ad85004089190a24d21a1807a4
SHA1 e08a1fabdfab122955135b8a25cf578121f0ccfd
SHA512 29a803d9f6cf4cce2fd165136b3f34ce27a2c9bca8cbf60bf60fbcffec5e07c9d08be19c4438bdad6196721ee363d4d4d17709a5e203731f55503a595883171a
SSDEEP 24576:F8kNvNnaFeYhJNtmZBmJVXXC8Ac2YV3swxhZPegenZPwC7:F8MwBtOmzWh4sCdegmZz
TLSH
T12A55AF6EAAB845E4E1FEC6B4CD238512E6727861073293CB5390C13F1E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 754821795f65c9ec036138a29100043d0ab07432a0ba02a248e0063218ceb00c
MD5 5ad5a85ce6fc77b0f4c7a31a09d4da88
SHA1 b8171d8162dd4a02fa0979ced7955d038a4af030
SHA512 eb97e60b6b32df37cae355f0ac5794e71bfec96ae3819376eeef84f8e299d723aef54f94039ecb934e15ac28ba8962c623c22b614eb7b6346b609a88603e61b2
SSDEEP 24576:lPUr+NQ7VXXC8Ac2YV3swxhZPegenZPwC7:lJQhWh4sCdegmZz
TLSH
T1A205E12F66A918E5F67AA17C8982870DF771B8611311D6DF02D0813E5E37DD8BC3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0e5c34f0644b18da937486a7cc24c5dca812799163f71f4c7da20f3bb9bdeff1
MD5 cfbaf1ca86901890148c0693b79377f2
SHA1 aa985be4301cda791b225a6ec7efbaf3be89fe8a
SHA512 bff98f95addad448069fff2ba489cfeef7325fc2f10d8c1f3026645ce5365ff5982a5087f4d54a71cea76c25aa1a3fb212c03420d48d8bea84f6c0d30de0abde
SSDEEP 24576:pD3FHshBIYQgA0VXXC8Ac2YV3swxhZPegenZPwC7:pDVHeBIAACWh4sCdegmZz
TLSH
T17025E17DEA5D04E5E57BC1BCCAA38606E77138A9032159DB02D081BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1056-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1056-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1056-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1528-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1528-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-312-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1528-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2068-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2068-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2068-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2068-380-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2068-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2068-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2672-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2672-120-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2672-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2864-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2864-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2864-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2864-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2864-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3128-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3128-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3128-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3128-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3164-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3164-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3164-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3164-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3556-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3556-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3556-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3556-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3556-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4472-316-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/4472-4-0x0000000140000000-0x0000000140106000-memory.dmp

Download

memory/4472-0-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/4472-319-0x0000000140000000-0x0000000140106000-memory.dmp

Download

memory/4472-9-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/4472-76-0x0000000140000000-0x0000000140106000-memory.dmp

Download

memory/5436-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5436-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5436-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5436-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5436-126-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6028-54-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/6028-292-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6028-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6028-60-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/6032-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6032-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6032-78-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/6032-83-0x0000000000880000-0x00000000008E6000-memory.dmp

Download