948b1b83b1012681d30ae998194dc964ef6693e66b1bc0aadbfbdc35d03a350f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 22.3MB
Sample260801-nbjf8shr31
SHA256 948b1b83b1012681d30ae998194dc964ef6693e66b1bc0aadbfbdc35d03a350f
MD5 1db6bd55d3266e79a663265f39ad985a
SHA1 43d58bedb13517b4b1457ff330be62a0c8362374
SHA512 7495412ab6ee7d6c4e787f2aaf8a53249e9403e53c44543780369343bbe409cdeccd734d2b08e1e8fbc9f3d618a5d1de69b0abb3604b4ff599d2b2f2e00cc7d6
SSDEEP 393216:4BQ1jY7xOdPuONbgKKw+YSG5jvrmGMZsZB:5ZY7xOdPuAgQSp/
TLSH
T18E37BF81F4E655D8C1764434486FE252EA307C5947B81AF762E1BFF92F763803E26B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4080	elevation_service.exe
5084	elevation_service.exe
5072	maintenanceservice.exe
1008	OSE.EXE
1108	PerceptionSimulationService.exe
4372	perfhost.exe
6124	ReFsDedupSvc.exe
3956	SensorDataService.exe
3276	ssh-agent.exe
5944	AgentService.exe
4608	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\702974fbe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d21ced4a621dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000039ca24d7a621dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008161817a721dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f0751d5a621dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034e3e7d4a621dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	6124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6124	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5944	AgentService.exe
Token: 33	4608	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4608	SearchIndexer.exe
Token: SeDebugPrivilege	1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1088	2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4080	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 5388	4608	SearchIndexer.exe	100
PID 4608 wrote to memory of 1776	4608	SearchIndexer.exe	101
PID 4608 wrote to memory of 5428	4608	SearchIndexer.exe	102
PID 4608 wrote to memory of 996	4608	SearchIndexer.exe	103
PID 4608 wrote to memory of 3340	4608	SearchIndexer.exe	105
PID 4608 wrote to memory of 5404	4608	SearchIndexer.exe	106
PID 4608 wrote to memory of 2300	4608	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_1db6bd55d3266e79a663265f39ad985a_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5072

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e29669ab28d80ae35d629ec69d31404f6737f56290bdbd1743b4581da0a727bb
MD5 1d33af09b4b5b946ef7952920bc371f4
SHA1 4178af1ff2877778c4c208eed8d1c0a5f0d5a042
SHA512 905db72ac4c01b8db5184951afd62c4e2b6d210fb38a491c2f6b7452422da36a9382ff36bca0aa3702aab788e4920146904c5ef250b9e361bad520f91a55a473
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYDmg27RnWGj:43q6sjBTD527BWG
TLSH
T1DBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4265632bf5949f958a4b3e85309a3441b04d5c87c16c40280eed01c693e29a72
MD5 581ca841d4db80cf762d5a7a9a625056
SHA1 f104a9b264b9cb066a28dd4bf4cebea877380c45
SHA512 823e949ca5fb70d1ddef93b024873272e00103449cf83a5b7d43f351e248aa2db0457f0cf163f9d44dc5ed048d8697ff0ebebb7154cb16985b314ba0726d3367
SSDEEP 24576:RXYfDtczADsqjnhMgeiCl7G0nehbGZpbD:0tcKDmg27RnWGj
TLSH
T14765F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 35e9ae58dd19d5e43f3f349ae857571fd74c0d8c77daf7ac10b9b6c3fb2bb402
MD5 da7b5e86b50572429cea364595279668
SHA1 6c2ab1b7a12c63c2c04129f4c45af813315faa34
SHA512 9d1a8f565723a8d2f870083961a87573c2981d768eb5176b5698f333eeccb1be37a5330d9bf7a5d0152d50056a30afdc69c0cd9e8e98118b8822816d7cdc3d7c
SSDEEP 24576:W0Le5ji0hmxxrM0sqjnhMgeiCl7G0nehbGZpbD:WPji0AjVDmg27RnWGj
TLSH
T12F859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4a8ee0fd65edffb28b95a9254ba7b64ce9b7f4bea38da6e37a8e4f5e58e701c
MD5 da0619251fa6091747c3bfb2113a5cf1
SHA1 c2a430981e47c59c0029dcc847c7e0b163b80e54
SHA512 ce1a5d7fb4ebcb6bab942fd537b13b87ddec320d6a8d6eddbb8f56acb257f310623a9a10344cb8f61f40fc9f3b6e557730726a503f9a05abb20dffcaa8943f10
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyuWsqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPveHjypDmg27RnWGj
TLSH
T10F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fdf303dc2a6c1e4d35976e2f305dfff1961ef90f4910993784bf78821fe5609c
MD5 f33f78c2a21a88f3feb9ea4243db5e4d
SHA1 25ae60b64adfe89b49fc1e0bcc4fd4a5425f802c
SHA512 0268c4165f1e59240e3d6eed6ccb009fbbaf8465568425342ad0eebf5d61b08ca02d506e6510a201f6ac7dc222eab80f3e109ac8d9576080d26dd28101bd7eb7
SSDEEP 24576:oVbqPb88hv/l+Y/sqjnhMgeiCl7G0nehbGZpbD:oVO88hXl+iDmg27RnWGj
TLSH
T1EA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f9ad839ecd9609239a2a2747aeebec07502d958353a721e27f0c479cd9ac02a6
MD5 2abb1c536b4fe787995daaaa54f9bb21
SHA1 3eef386856594f37de8cd9ab09da4db1ab3ae0e4
SHA512 dfc1e21b2f3671e4b35614a9e18d1a43f86d68f11c880bdc0b984a3137d1737e0bdcdd206638a76b1714b6453c5ed6eea9a23abf98ea42b215590572e7d9194e
SSDEEP 12288:6LgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6LgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BF864C50CAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 527d02870266d48c0951bebd029f6f5180b1c6e0282f22fea09ebd9e062b1822
MD5 a8651a2854e489ee2127d015594aae7b
SHA1 5beb7ad07e7448fbd1a5eeb563dcce21ac27b6c0
SHA512 147ec6a4f76f420f76da25c25863c43aa7010450f9045b914194f3214541e24c537ea1ca2b4973b28b85462a61fe312b7c75962635d5155fa79097c027b3b659
SSDEEP 12288:yeBNUbTVO86UnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:yJIUnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 410b5e95159c2fa778468d5e4212e526a50c8c7d931df2da23ba0e982aee0055
MD5 b9b56c5dba3ed9b83bc75078da5c6ff2
SHA1 e507dc5636a409e2d7182ffa7eba3f5aac7244d3
SHA512 60e835991529265f9a9597bbe721407a0788af5779c306237a27d8f1a8daed443aaabf2e4077b1c5551a95797361b6cd399a8ec1e16d6fba335a18e29af811a4
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THq:sQvGAdlCEL8c/DRNw5CqD527BWG
TLSH
T182266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ce0cf4369e909adf3bd132b5eef9aac33f1d70d07cee39a496ac77884270913c
MD5 3cfd58bd849b6ee69d59f49972981a4d
SHA1 71f6d0c682b08cf94419db6cd0a438e316209114
SHA512 454f8c41b1c0ab2a0a4f3f1c0c68f6fc9808215e7794c37ed42c7518747e6877101dfdf1172c43fa532e515f112e423e0243c34cc3f549dda559d25cce08495c
SSDEEP 12288:dAwSfxL/2Dc3RDLLmt0LDQewsAjRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:O0ewsAjRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE75E031FA74E036C37B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 414a3fda839b33b69ed0c3ef1692664a9612844b599e08bc186734f2094ec6bd
MD5 d09656a9096d69875d892473fb9c5bec
SHA1 e3c002ca5c975f6549d4229c83c21b43e55916b2
SHA512 4d34ecf7443744538d99a9ce6eda76e4eff0e62064604ee4b050d62d72bdb1f738b14ee6478a08d335f15a8ea4576d39de2b834923f7943480e1553a819c4deb
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHtVQBWG:YUEtQevvqc2W1cpV2tI324B
TLSH
T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 068e6a470ce2b195541517e7e273fbdde11f3b15f49997dc0ed719de470d3b12
MD5 07742a8200edaf620be96341c3a27029
SHA1 e949c776489a5a912048eef381eab504887db8a0
SHA512 58cd611392be6c6410e895cda3052ffc9ac7b184602cf222dcc1d8697b853ca99a4049d492fce8ef8363de6ebdcb3e03b411c4234351c917d56e0ae9f79b5f92
SSDEEP 49152:6CbRquA/m2yL5zTfFiV+XenmE3/zFDmg27RnWGj:PoquVjnm+D527BWG
TLSH
T1CAD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 222b008d77f044d51d2e2122e09f5d6c0d0434d49e950e885bfc16ab15138130
MD5 37d3c8bcfe045e3a6b39dd82f76a3304
SHA1 762d965e44be9a1311505a360fbf3bd6f469fac0
SHA512 a715431eee3dfd96fd21a78bb27f067a6f3524e4bf69a8ac42709c15960b4f1cab31e2a979119c6e249eeb4fbd81449502f217d38837c535ff0cb795150f6129
SSDEEP 24576:kAhGL3IFoiwtA5l7S53KsqjnhMgeiCl7G0nehbGZpbD:kAMUFoiq5ODmg27RnWGj
TLSH
T187359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a033ab0d3b03026534561efb0cc1a82b9bda639016cca309febc27e0d4d149f7
MD5 80560c640dd5b67c767e971cb6d7fad3
SHA1 6b75e91d897463991a467359f00f8e9d49a55565
SHA512 4fb05c01e60c25517451f14b8b0b35b89dc1fccbef3baae8bef7af600cbf361892cad681e66cc2c0a80642fcb5ada0c0184da2aea113e5f29815290eb235c458
SSDEEP 12288:emw5HEjsChNVBFgl0WDm+C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:3wu4OWVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F165F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 54993d8bdf8aa84e60b273986af9f0833b8099b179b14ee508e68822f5e0be0b
MD5 1dbf93d623cb6d44987326736e5dc96f
SHA1 ef304b3cf9db235487786b35e50574889157763b
SHA512 8a7b48a81e62f540e6e1d980e9e4d3b217d4539f051d0deda43c617e1a33686450077ddc2bce83221ac489619e22edccf2f78ea5a95b869bf2691fd02d6929e7
SSDEEP 12288:qeZ1IyhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nZu8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 368d53fa81de375625f0baf51a993363dee7d0df58d8e8fa355ddbf378fa2355
MD5 bf299afb06e9366951975ef6d16da6a1
SHA1 670b87fba9c52cde478ad46112287cb971144165
SHA512 36ec9be6c9cf5c64096c03bec1ae06d5f74eb53605bcd71c10206a1537f1f42afef4538afd96ea0f7ff408a8372948a2ccc7bfd2caf2973c5863641f29d1b09c
SSDEEP 98304:eQRQyi36YOcPbLvw2gAf+PN3/D527BWG:FQyiKa/X+PNvVQBWG
TLSH
T110667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 53059bb6b7bc326a14ec0806ed97669bfc3b637afe1fe24d57f24c233cc12d2d
MD5 b08e944110b1b95acefd1842820c06bb
SHA1 1449739e182f27b2ff8b742dddcae99c85328589
SHA512 c7a85c34a1a1ec6efc24275f237150efee67975249d9578f24f1b93d6db5bfdc095be6c8100f823cd7b96e33117227ddf1e580e18103ebca08130ef374fde560
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3/D527BWG:NQyiKa/X+PNvVQBWG
TLSH
T156667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 08cfc851176cd102c95aa4ab7a936dc34efc14061ce96be929eed4890fff575f
MD5 6792864ffc89640dc4335d5879635d8c
SHA1 d2adc830b929847ecdb94238f03a5457579c3102
SHA512 879811670815d3873775bd495f86fd1f95a86d04a1135ccea0d550a6d5de438ab12a8333e0ab4e05b4e2406dfa5b9db294dd2873f13fbc7a255e97c38ced566e
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ssqjnhMgeiCl7Ge:V68Qg55nhceWu7PNU3/VDmg27RnWGj
TLSH
T1E4B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b19d09899255d720940ad070a56463c4934b8982d1c9e81e3fa0ae59134be281
MD5 875d1a40b82caf8f433aaeae8d4dcfbf
SHA1 8efbb40fd6073de6d0cbdc44441fb853572d224c
SHA512 c9e8e7785198a2100b7776e4910ad9da525f31a5e8ff149260490f85b70d93dbfc9ed54820cfc1b4e433f219296e8d6729fd4412afe520b353a82268e4623d4b
SSDEEP 98304:dy5112gYy5azzVvt69nLKnhZcD527BWG:ALIHEWhmVQBWG
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 958135e7d2cafae691ecb8f2ad96c6172730d2bc7b14e1530b252dc6ec080c79
MD5 9059d012a50b8d62da28661fa54da16a
SHA1 c90317efb5fe807a193cf158bf7215df19273521
SHA512 2fe4941e6340244d1adac8484507920df9b56fefe05e1bd937faf6d9286b1262966012655eb93f46ad2b1a25d09936134150ec27ddb21c81c06e6165dbdbd832
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3Dmg27RnWGj:Ou6Jmdxd2d3D527BWG
TLSH
T115D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9f421e9bbb42435ae54c6138eceef560175d7af1b2f692b1580edd27f5381b9b
MD5 ccce643405ef27906d1422a59e6d4015
SHA1 7bdae936a24e0b29016ad5659ce81ad7cf4c5436
SHA512 f237da75eef9c5787e750be55023c73f9f1ecba511cf0643dc272fb25e4ae609a3360421784021b91d8d1328b30e4742880286226a6f2487aca9f40bc5916f9b
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xbDmg27RnWGj:9mifPWR+D527BWG
TLSH
T130B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e2ac94368b7aa2b11d007cee1112358b12b7fc082a81e6e6f2a325eb7c093006
MD5 4dc55348629a7a018b81c00ea606c7ae
SHA1 c24acfb79bfb7a71f2373a4ac5bf2b7f7172a51e
SHA512 00a00f1878645fe2cbeee7673d7f0b1b7b9a6e381c3807fb50d9f635187396c981a7a41923274054b020347185e5ae81196b567a4ed2fd11e6c912911f11a512
SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqoDmg27RnWGj:w5dKii61oD527BWG
TLSH
T10DC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1896357a99f1926f872f5ec80c2395b43b4f70c36c6e9466d3c59d070521f616
MD5 b0552b45bc90bf825ddd261d8e05fde6
SHA1 9f3c5a4881b1c8aecb70c35ca3ed621cd0703cd7
SHA512 da036b10a4dd940c9bd603698d43fee561cb043074257b70681fb8133cf800729b89af077186f82a5b3f341525a5c7c27866bf92c6c00d96640590cb54235fbc
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5wHDmg27RnWGj:/X2imphyD527BWG
TLSH
T15395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e5cb9ec16604d2ba7008fc867a462706b2dc521abcdc5f7c33165e831a6bb13f
MD5 20bb9ec9167590c3418b812622eeca7d
SHA1 1126bcd2a0ec2c2fcb3a297fca005c794cdabd2e
SHA512 4339c03d6c536f4fd8c1452704784254dfc5027268636746a6215b2ec8ac7d1eb0c92c6ea791f3486e17034ef6cd769a2aedf6ca11a342264fba8f2c0d899d6f
SSDEEP 12288:6IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1094523BE965C41CAE52648B5C3E5F10EAC073E57E92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6424a88d8cc9d9797d9b541a20b5da1b991c1510f4778c4213ca3a89992bc166
MD5 2774212a810ec6d0bbbafe2ba20c8b27
SHA1 23e0bd2cda0d1b350c9f1c867d2c2ff723732add
SHA512 a29d632486d4dac203772dab08ff9a78f511878516eb1de75e9194c11b399eab69e79e06b183b91193e73c601816116791329130fb6b3ca6399418f121c74482
SSDEEP 12288:OtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BE955C41CAE52648B5C3E5F10DAC073E57E92004937A9B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4f0c7bdcb67a57ff89207843b9ff99c2265ac22ce45c580b7f57383b3c50fa7a
MD5 fb1857e0edd4517dbc23efd0227d2344
SHA1 8bb23448b9fb07f0a09a253fc0dc41a4ba08b8bb
SHA512 ce10a2f3464e61a789c9004be907787c581de47e0822ff6bd7fbdb234796998023e5e78db8cd94d2d6f48337d77e67d04341430f656f643b962699386928e277
SSDEEP 12288:fvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE965C41CAE52608B5C3E5F14DEC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b85aaa48f126a2524386bace1cdfca3655d0ba189802a875e2edb199f5e8ab7e
MD5 f2cecad3ec466ca57bf400f3ae7088ed
SHA1 a64cd4feddd98923cd42873909de338ac7283160
SHA512 1d04a6e4f9b465ee14652c759b1107a021e7c58fd789a8e3aab33b65389e2a64168abf85bc6b5d20562022cba6e07f91070cc0d5824db49180406c88fabc7e6b
SSDEEP 12288:6VqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC45236F675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e86add0be12778dc9c4eb6002ea6bc27631dbda9d059d8f5dad4062138cfe5ab
MD5 d027cab1ccd053fa94904b1cf5383f6f
SHA1 ab6f4796e0e8e99aade305d043ed94417680e95e
SHA512 12e93609b84822040de66d9f0e151b88623afd3ca37c8d29e7931a7a31bea7c5a3dda60e21cad25f56462904a8bd19f685c7ae5858f6c78e0462962715a77490
SSDEEP 12288:ACXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ACsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a740767fe679686a14795e1b3fcb11cbd5792c35bf3437d500869c4982dd9f8b
MD5 9f40857ed7722f3a8105b5b2e473f403
SHA1 61525e3eae2a811d939c5ee26cf77eee5a2f23b7
SHA512 5c0649331b40c3ea8d3f946b480a2568ea424526dc705608447b21094bbff33194628d9e8fec03629918a592cec8112f595bfd61a97802bd4f19f3d4b8dcbe4d
SSDEEP 12288:z5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9fb883b2b9f945670612b4479c31e735f3bb570b73b12ccf748d6600246a7851
MD5 41b474826148b43bdb64ec0dd6e204ff
SHA1 69474ca6140d6e704ff26a84b53d749f413eb5f4
SHA512 512dcb7b57c601f3ff60107d2602570a0304e02ea2b377766341b46f792d0a243d079e570778173f43ce30b27ede8df84484e9241b2396d547fa37a489bc3a75
SSDEEP 12288:IFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A44523BE965C41CAE52644B5C3E5F11DAC073E5BE92004837A6B7CBAF7F14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 31fe6a53545b5b482f8c752cf3b1910bdd892fb667fccc04fadc70b9346fa2b6
MD5 a8621bc64f30d07b3a8a0eef44081c61
SHA1 83e2781b261b2809a9787428ef599f9c395bc001
SHA512 e68753527944346a0947a8ce529484eae3f79fa76c117d0a6afc2eaea8da0f7bf5a37f9c8e22aa28fc3d538c038395fa97bfe8112f2408c77dd24c0d067b49a8
SSDEEP 24576:mZMRzFVSONsqjnhMgeiCl7G0nehbGZpbD:mZMRzfNDmg27RnWGj
TLSH
T1576501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7b516b495e597539dcbdebe46b500bae6538476f464e7f3fef049109b0dfe7c7
MD5 e53493eb0a43dabbe563a7a06c4bbe48
SHA1 c18e2e8552356e12b9533391d1079390532a6530
SHA512 3fceefc19ef165b6c14dad8a597f3357b9354d9486b10adc488672e56c580d3158599436c955258f854b18872a24a172f1ec95e07c409dab7a1599a1a3434c5e
SSDEEP 12288:aMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 847c2afc186b4053b78c74fcd69553319f4c8ef7759172c99c6408a47ded0585
MD5 d6285544307808fe1f43dd55b8281205
SHA1 6f394e1f9946a8c5521b26a33041e35eba16a0cf
SHA512 593f4a3e3198227effa6bcb280637cdf0bb3482fa343554135b941896e39ef2184e190275bc8068af3aef9d1be26a255df28a58022253e83c174ae6a2e11bbe2
SSDEEP 12288:MwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1244523BF965C41CAE52604B5C3E5F14DAC073E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 dc739588ef64554b9866166abbf58694a01769e6c258b165b16677067b66363d
MD5 d566122cdab5002b74e91d22886d8ac7
SHA1 28ed05f8d80e67fb3dde59d74dc7a4f1b34afc6b
SHA512 3faa1c868597606e73b6577b64950cc41292d3caa357847a3956fd9b37c81f7ab388b7f4dcfb23993eb7e2f80b20bb5f1763839831d57e8d8a864a4695ece095
SSDEEP 12288:6yPz5L8hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nzyhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 efe21fe1fe0c625e893e8e243bd9f727a545dee093ce1d49fa46b21b92707ef9
MD5 a486d3cd5535f8787adea821ca049dbc
SHA1 a12705cd68ea5309132ef010e6bf70acba87f3c7
SHA512 aa65aded9848d4c12aacb07327ab2ce8d632884a9aa752a6421ef8354f20d55919afae754da79dd3fc16f40a8500ba8d5cac2bbf7abbdfbdc3f485e9c28d8842
SSDEEP 12288:YMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8fcfadbb9e8d8130a2a8c8fd77df21345e4d955ed4cab7ff7de9e1b887ff051b
MD5 2d71f007e8c4e003a99375012dd3a5f6
SHA1 fa7f4da51a3b6c201bca760c7bbcd2287021d612
SHA512 68fddea47cf2e952747436e27054e64c617aa79e02bdf98d1d2b3b182e115ba2e562c22cc4c78f0a9bd2c649f4584814233539f965c5d53c553029da825f926c
SSDEEP 12288:rMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 db8bda4c7b725bf800180fca881ad3582cccd6d5b495b6a129361dcdd50c2646
MD5 3e9d2359c913d8b58aacd88a48997fb3
SHA1 bb5bf76e3d7c0a193dd3c1ff8df4cfa4a6a7e4c4
SHA512 677af0266a1ad7a6532077a10a18c8c7449fd58b93bf861edd376d644f0cd7281c71ec90e45feadc204e7cc9bcd73e0d3de5887d04a9e4550719d67328e23fdb
SSDEEP 12288:wyPz5L8hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BzyhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A255125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 4798d53f8618a0339ed820f0e36a8931608a00dee87c1b70c3f41d8679176bf0
MD5 b5762ccd15e45b5de12e34c602ad90b6
SHA1 5b1199eac3ccc439c3cedc3cda56c9d28d4bbf9c
SHA512 f5741ee7eb5a7f33d9cffaba8440b5c488621e6c27e5fce292d9c43833eb92aa19edcf89c6c0baa3f22dd1978f3c8094a79615c61f54ab9bfccd47ed0b73a57f
SSDEEP 24576:vTDaLl3z0zDfsqjnhMgeiCl7G0nehbGZpbD:vTuLljaDmg27RnWGj
TLSH
T1846501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 093689e727b310e51b13ec9b9a268abdfa58826c9040792a60cc94b3d995d338
MD5 ae9e6dac37f9dbe96326094a0ce83a4f
SHA1 49151a2f981d2867ffa94c0f6364df484b5967e2
SHA512 85d7b86191159595155d5eaa357c534a56f66cab210c0e7b3d11af2d34d6781dd7a63e7068c86efa91766bb4333b435dfcee0b1af74c65a690724ef6f9853ae0
SSDEEP 24576:s3vd9CHKy7GZrsqjnhMgeiCl7G0nehbGZpbD:Wvd9CHKyaNDmg27RnWGj
TLSH
T1AB75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f987db3d68300cc09cbf0e2f7db8dc5b7b1ff99110ceb45b55e0a6dabedf59fc
MD5 9409bb4894da2658301c26337a4bd94a
SHA1 eb9838e5cf96b02f86ceb7e648ab31fac65c6081
SHA512 b3e842e8fa2cbb4e62a970bb1e159516a14ac15f793bd9df5bedeaad7f2256d3e3a37d39a9c05dbf75dc9ad6ad3ea6f30ddc4bb7f39e70149415eebd249c49c3
SSDEEP 12288:vPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F4523BE965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1973d7fa36e335205680cb1dd8edd04afa1b9d34844667f07a500775a1bd4d6f
MD5 0d7eec86f31034e32b5244bc625884b4
SHA1 f0b218e36db04da1954a6d374e24c72a10ad9172
SHA512 48df44b699b1eae3def2d8c83ea4abee47f7c0a1751b29be09a8b44d02c3203ab179a2d1c3f00314a9355ed00c6fbb2156f7e77d71716a3aa3eb9d633ed5c6e1
SSDEEP 12288:dBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE965C41CBE52644F5C3E9E10DAC073E57E92004937AA77CBAEBF18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2fc6cb6ea0e450be3889a94b0b257df564067866281d1b9ec562c368e0637c68
MD5 1f7b5ab25473e4a6dcff5d80af5335c2
SHA1 610e0deeff5438875d2ddaf661f3a46461fbef39
SHA512 36bfaba44ee22cff007bf12f4809b39b1a67798310571a4c0a986b2132c769d2e55ce273ddd926cb56da7842d9b1f6267539c9752374e33a25b9db465755ebe9
SSDEEP 12288:9uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9usqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 849658588914400edb4d9aaf15a24ddf2304a00fedd302323988d0701c819a28
MD5 c3d714f7dea583437669b9364404de79
SHA1 703c5a67d912a976e7c575c4b4eacbaba4e887b4
SHA512 6795c227d587fc442f74a3dfa1bb4aad2149357a76fff6d20e6087168883367ed47ad630fcf7c32d7fe1cacb06cc8c055d6430c0b7b903b671a98b48fef9a861
SSDEEP 12288:nMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D84523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6c60476161bc2aad62748e81b1c5efab8bc428f27abf55df0595effcbb1444d8
MD5 41187eaba3497c5308120d9e5d0abdab
SHA1 5f69da93da906577d762d2841e97b71aeb33a53e
SHA512 5490896384b9ee8f834be8be8a8e963097c33568cc37dc9475a28291142716c1ca0a8405361f0fd99fd748b15b78ff34c41ae99f90b1972e5e5c220c84a6e458
SSDEEP 12288:LPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B24523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 48489e4f47b6d0f47c378b3f193ae243a47b1c3cb68fd930bba86b0f1e9476e4
MD5 58f741241dcdd70cf189ddea55ff356c
SHA1 f31bebdbcb089c205f1eb62b0ccab8586cd213d0
SHA512 fa2ae0018afafc06b36ad21283f72abae364bcf42f68ee01fab6e482f3107fb0196918bba9721f63f9e77f815bb1a424137afad64dca04109e3dbc02f74419a8
SSDEEP 12288:CkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BE965C41CAE52648F5C3E5E11DAC073E5BE92004837A977CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a1e07709379a70ade72e02f9a0516114955ee1579907deb71f78e4e1f8d0a0ae
MD5 d72f763a952d97591058142d178f6324
SHA1 bcaf64a83493570d3c35fd4c54170883ba558970
SHA512 5bbd3fbeac2860eac61479811c65e1b4a7b044f98bf927aabb6fc56665388c3158f82c00fa8809325f8f1701faa030187a37f3aebf9061a5ddea7ba4056ff694
SSDEEP 12288:wCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BE965C41CAE52608B5C3E5F15EAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 efd19c4c306378d4d0a4e907688054adaa76637fc9ac04c7234350f7b326be74
MD5 f46781e92a6a01ebbfc4f8a601a2d51e
SHA1 a90ba615094d257130088554e9d5dca3e3e5f944
SHA512 088fe6067022bae1552d85392e9111e8bc543d25eaac8ce11886a153557824b93dfaf0035b52eab2fd193b97961b07c0ad2ee7dee2ce7264b9a6b05ef2e3bf44
SSDEEP 24576:JfwvUk9RX6wkyAIAsqjnhMgeiCl7G0nehbGZpbD:DMnYI8Dmg27RnWGj
TLSH
T12B85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2e82e97c593ddd97df0803835d48a2cf1b06890a6ad04dc2f427567809dd025d
MD5 1956758d2b308fc3db6500be6d58aa89
SHA1 3fa650bed811d398337349270ea9963b950db12e
SHA512 64dd1f2b5b70e5d3c0e56720a3de91889824fc0544f666b94690cbd543ebdecb1d5af9d9c8defa710458e6773c771d88360c32f659dc09cb5881f07e2ae9d8ae
SSDEEP 49152:AYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nDmg27RnWGj:HySzPfD527BWG
TLSH
T159066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 166f0dc609a480c5e3bfe01f67aaaac75d8ac1782e582e79a73ed40be4f89cd0
MD5 0c63465b739d73105e98791ebc49ef74
SHA1 fdfb736d780fd75772f93f7f029a9d511fc653f5
SHA512 2c792db5c55c26fe902017cb19427fa1f875c45d2686cd91f8eda89f58836ed7cfb8735e245507097ab65b26c8cc49d9388ccf32684e2736f8fdfcabba54e032
SSDEEP 24576:347Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdsqjnhMgeiCl7G0nehbGZpbD:347JUQjTirIhCnDHUPfF/3Dmg27RnWGj
TLSH
T18465AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d859ca7bc1a846fc1bd6350e09bcd7dc7d9531a72021d8455306c3ee3e7565aa
MD5 7c87477d378abecf304c053846f121cc
SHA1 429ba2b777e731b1c9bc7e009ef48d5490257e7b
SHA512 0ae19e3655fd8a2d39ea8a266a0eae082b53ec38c5b7bf789bde030379e51d3abae62a306b3a871d9e260d51b40bbcde2742d37e2042e70746a09f4d9216a69a
SSDEEP 12288:wbsf8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19255011AD29802D9C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3f3ac75a30644a282caf3ca27926029477692797f0f5c7f8c60b122d5e7cd25e
MD5 e6dae955a75f5159515761bc069ed539
SHA1 850e1ad9b58c91091f58e4b68906101c522e6160
SHA512 421b113da710b693fdfc7b9d6c1b66af58ea1af9f4872f81644aaa31445a9649969c94e2ea3c7a38fb867e6a60b65944e55db20d04d8e86414fe474f46ff5155
SSDEEP 12288:R07UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B45237B935C518AF93605B482EAE12DA80B7E669F1044C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 04f25fcf97987fe69ae06f2245f7d9c0de9f34dac3aa916c27b99db9c06f06fb
MD5 13a1062a6102b43432e859efd5e6fefd
SHA1 3dee5bdaf1e33158f54fdb7682d3b811b671f269
SHA512 ad6dc286cb83f9e7524e08f430ca7b91d0c30a6a79feb43116249d7f6b42e2b81f8fd2d58321fe1724bf437da3aafcfbc31cab05f042ba9ad30d6918ed26654a
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYWsqjnhMgeiCl7G0nehbGZpbD:wgb4mBIBhGFBDmg27RnWGj
TLSH
T1B7659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 22899cf853e7079f9d635aab4d1ae5948f7620cfb35458f60fb51188fdbd5ca1
MD5 0bb2914af1bf0d6a06dafd449bd78b88
SHA1 7580eea3bb478ccf72f33f6cde6247ce294fa205
SHA512 121122d9b1e6fa67e21be7e5e7be2eae6ad86a60e436c4540938416f2c773a0bfb3b09fe9073e2fd2c4e4208e5601810645fc2e5a0bf1821680cf1ef3abd79b7
SSDEEP 24576:DG88u8FpJqH1bzria7/mNsqjnhMgeiCl7G0nehbGZpbD:y7ZFPqVea7/iDmg27RnWGj
TLSH
T14585016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a2a998dee44cc82e6d29795716f8a0b58f27b31a9ac0348083e357e8ff39575a
MD5 1acfa247665a4c03a95e57656958812e
SHA1 79fb749f6a444a92484037963f9d6fedbc3c59a7
SHA512 90e3defefb2f05b94964c518aac44737841c327c274707c7eb23ebdf11b0edcb5e1bab68b8c23c546f80d484b71ad50a10427b8989c78df50fca21fb36a351b3
SSDEEP 12288:3HvUrBFrEjwaQJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:3PUr+NQJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 72963db53ecd5404f775422a66c72b42f238f67ee9aab16abd2ff9a550796a11
MD5 5de8331dc357435e5b0713274264b5c0
SHA1 c83469ea3da2c32df395928fa33627a2aa2feafa
SHA512 55a7288b10c1908296fd75597339b80474a7b2c839eab1ae15afc7ea0f0d645fb52c805134f7f6130f238d17cb0ef098bad5d3efa862d7fe39e043521ed94d44
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9Dmg27RnWGj:PG05lO43bED527BWG
TLSH
T1B1D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d4661f1d53a1be9ebd1f466d2c672e98c3fd32eaed594b5798728951f872df3
MD5 001e6b6e13b012c5753428f4616e1742
SHA1 7a15756e8ebbfbfffd0c7606e463a12d14bd3dc2
SHA512 fee402d47eaacc74faa806e0b9de3d2522b03acd650050ff898376761af4e6c5b850c1cb8a0deb85dc332fc49f859e9c7ed32bbfc70ed1bd6190b9c8379e94cc
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnjsqjnhMgeiCl7G0nehbGZpbD:ia5POZ3BJt2pasx2+mVDmg27RnWGj
TLSH
T13E65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52c25a3facdfc147da3bb8121e44fbc70e5430aee02be2d51291fcad92a08400
MD5 b9c42fa35c7c3094202bec62c67768c4
SHA1 96741bd8dd5f2a4f708ea4155bb7e3cf890e7fe8
SHA512 c21145ab78660a1702d913c0bbf6f08e5cbd4a8f6f4fe45813ee551e20ded11f10ad4bb62aa179e6d42d1815e8c375f31cb635572047c639a06eda2b8d229646
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7Fk1sqjnhMgeiCl7G0nehbGZpbD:JNc/zEOVHFCDmg27RnWGj
TLSH
T11F857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f67d6448675a43b6be033b4897441bb1d1c3c09d4fe205ce8f41a4e711963402
MD5 a8956ea9487ff51708155b3f483a94a0
SHA1 cc8155d751fc059655cb7bcd1a242395c67ce434
SHA512 a34b98a05e9fb6dd1c64b778acb7db900cc651a16e87c9a580f483ca306cbfe79ea99299049d62b1a978a2050cb356fdfc94ad978119cea3a2d670d8a6bb524f
SSDEEP 24576:sTkNvNnaFeYhJNtmZBm3sqjnhMgeiCl7G0nehbGZpbD:sTMwBtOmLDmg27RnWGj
TLSH
T12155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 074174b3de7469b8ec6ea29a65517ae5d87a019ef3a4972bf7027422a33a6fbe
MD5 920750a490fb47f53bde3bb491966b17
SHA1 727c6ac4739dc57858255c73c330004c5a47fe72
SHA512 4e2187f851b18dee5d90a19d3ce8d597fece6d2e079556dbe7d728ae2ed775e3bc93618b42740d63b567d33a8483c7877fe336c22d929d7fb616291e09299dcd
SSDEEP 24576:GD3FHshBIYQgAosqjnhMgeiCl7G0nehbGZpbD:GDVHeBIAAUDmg27RnWGj
TLSH
T1EB75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1008-268-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1008-52-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1008-59-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1088-6-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/1088-0-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/1088-11-0x0000000140000000-0x0000000141704000-memory.dmp

Download

memory/1088-72-0x0000000140000000-0x0000000141704000-memory.dmp

Download

memory/1108-285-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1108-73-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1108-69-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1108-63-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3276-303-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3276-111-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3276-104-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3276-105-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3956-92-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3956-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3956-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3956-305-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3956-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3956-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4080-20-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4080-14-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4080-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4080-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-75-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4372-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4608-132-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4608-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4608-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4608-133-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5072-37-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/5072-36-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5072-43-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/5072-47-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/5072-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5084-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5084-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5084-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5084-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5428-310-0x0000017422BD0000-0x0000017422E5B000-memory.dmp

Download

memory/5944-117-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5944-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5944-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5944-123-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5944-116-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6124-79-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6124-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6124-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6124-319-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6124-85-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6124-301-0x0000000140000000-0x00000001402C9000-memory.dmp

Download