42055580bee7f4946b67c66f08a571cf575eb009cf581189d00ca1befe6b71ae

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260809-rtjrhagm6w
SHA256 42055580bee7f4946b67c66f08a571cf575eb009cf581189d00ca1befe6b71ae
MD5 484151a8b3e939dfea5a63630dd2a06a
SHA1 b00175e865abf29f228b1adc619f0476eff474b9
SHA512 61e41164ffb0a8bd2926d96e90713de4772ec1455c015a455bb60718349af582da5480631b4f41d54fa39634d01c3b97f3e8fabd66f4920c17512fb00a95f602
SSDEEP 49152:SAzWjLqQFleFE31v2lxBlFUSB+kn3Hnx:TSFL3ol+k
TLSH
T12385BF0B636902FCD0ABE17899564946E775744A03709ACF07E056B72FA7BF16EBE300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5020	elevation_service.exe
3372	elevation_service.exe
4244	maintenanceservice.exe
5932	OSE.EXE
2440	PerceptionSimulationService.exe
1436	perfhost.exe
1808	ReFsDedupSvc.exe
4980	SensorDataService.exe
3016	ssh-agent.exe
1360	AgentService.exe
2952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2964399238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cbb5cb90b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d61eb9b90b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c51fa8740b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac039b760b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075245b750b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7e88e750b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002087e6750b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
3372	elevation_service.exe
3372	elevation_service.exe
3372	elevation_service.exe
3372	elevation_service.exe
3372	elevation_service.exe
3372	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2396	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1360	AgentService.exe
Token: 33	2952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeDebugPrivilege	5020	elevation_service.exe
Token: SeDebugPrivilege	3372	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3152	2396	2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	90
PID 2952 wrote to memory of 4528	2952	SearchIndexer.exe	103
PID 2952 wrote to memory of 4532	2952	SearchIndexer.exe	104
PID 2952 wrote to memory of 4676	2952	SearchIndexer.exe	105
PID 2952 wrote to memory of 5936	2952	SearchIndexer.exe	106
PID 2952 wrote to memory of 4356	2952	SearchIndexer.exe	108
PID 2952 wrote to memory of 2500	2952	SearchIndexer.exe	109
PID 2952 wrote to memory of 5368	2952	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_484151a8b3e939dfea5a63630dd2a06a_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe" install
  2⤵
  PID:3152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4244

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2804 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2804 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3e13b285b63edfc402983d61426c044f15c2a80b2ca686813d0beb3f13c610e6
MD5 20fced94a82d3618d8e1ea6659ad5899
SHA1 8f124216cc8b54b0dad6a190174ddbb52062a1d5
SHA512 8d660255d8fc498f4810e390b8ffdda53673a70c009705b1d0d3a4d21a3acf2980568a677370f624328a6c707507f0c8268705fab8e303e867e2531282385de9
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnVB+kn3Hnx:h3q6sjBQ+k
TLSH
T1CAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e3c39642a90997f6a46be2641445b8353c72607d2581495ca6e0f9d9f6f572d5
MD5 46e013266db54ce50f00d4b6ce2a55bc
SHA1 f1ace6533d27b655819da5bae8ec8fffad1ad126
SHA512 51dd26a31db864d3daea72108ab68a7c1b965083787b47479b30cc4845c92add13a5fc295b19ae0c10d9deb5f52d90ba28a9f52a6b969dc6b9af3450e1a33841
SSDEEP 12288:g1XLsswWkxy2lRq2czAwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:2XYfDtczAPNyBo4kx929bL3Hnx
TLSH
T13565012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5272277e65803c1f3aaea5293423da1937fbeac5281459db771d6eec0fdda92d
MD5 afe7565205b0ddaa7ea043ece7f21989
SHA1 36f4307c310d9896f3344103add5f934db303979
SHA512 ffb0bd9ab06f835c741c2f92bec09aba6f1ad10da61888541df1b0eafc46b8c4b5f5976ca79da668a4f42e54581f677460f56b2f583d35a5844291e919135477
SSDEEP 12288:fXZNYVLeyUji0h90ZD0wxpGZIVuArHspLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:R0Le5ji0hmxfrM2NyBo4kx929bL3Hnx
TLSH
T135859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0683fc76fe092a7c8d62d70ab22c2fb0e2f92539677812b9d07c92b7935bbc1d
MD5 a0de83ea9b275cf4d607bb558ae01362
SHA1 700defa5d1b3776701ed88014264df901d42a045
SHA512 636ce53dc404e918c73a1129c434c33c4cb7842b245d927a0c640720916556b1332511bd5294bc5161c09ee32b894f001d371d5fbb706993c258c802ed4292d4
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuwNyBo4kx929bL3Hnx:v/ezSC6vUzPveHjyGB+kn3Hnx
TLSH
T112755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 902a1685abf49d51a9b265f86f7580f4385b0e90ee80d6d344440f82feb2471f
MD5 af17607fbbd22feaa3850ca5694a4ada
SHA1 0eae339e9ac00554fc65dceba0f640130c8f62d2
SHA512 c6acc979a0259010b8439b3b9ff2a787cfe459cf9670d5b6e970eb56f1c43701aab57b3b9dc707617b9d517a6435f73053b2408203566cb3aa3f0aca14cb25d3
SSDEEP 12288:0VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98MLDAptNyvUgXZ32dT4ePc7N29CD:0VbqPb88hv/l+YTNyBo4kx929bL3Hnx
TLSH
T157559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fc3e0a7e92fcc60d55499642db6a1b114a40ec746816fe311f8995faa12398d1
MD5 e44cefb51d2217b3b17d08974753643c
SHA1 3312e1c9cb18e34f0efcaa7eb23b10fa42b54736
SHA512 56d968701b1d75ae7313be79a6d4efe305a12021a63535b729ec72456a86e40fd4cba05bdadb1fef6c7b88a45ebf53d711b40b582b9d990265fa0e197510868a
SSDEEP 12288:JmFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JmaNyBo4kx929bL3Hnx
TLSH
T1BD4523124B0C627AFBBD3E70749E8454CC35FC890D95DB94DF62ACBB58BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0531c8982c2f2d13467f55f2ab64a52202fd16c438a67517f66db31445e5899e
MD5 df66912181c91b06a2d35ef7dea45cd3
SHA1 bd3aea788bf982f686fd794bf29434e6188ffc0d
SHA512 165274292b01ca913a9e79b49902df15ac2f44f7585147a30af88a9344873d3ff76bd34432edaab41efeaaf92feb8c808dce49f95b63c6ea3f7dde3f7bbcd2f8
SSDEEP 12288:jeBNUbTVO86U0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jJIUrNyBo4kx929bL3Hnx
TLSH
T17565CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 060d86d63b0644eb8e4f60c2551234b4da0cbab99d964d5666374fd90712db1b
MD5 506c84bfcecaa1c0e4dcf42bb46cb431
SHA1 9e7a317849faf6ab56a96fad818eceee5746b389
SHA512 1fa1edc18874c06872d2ed16f1d67eea6c277a70657878de1955408c6b95cc2bd795c574ff1f1b26262bdf3c3ce229ff90c810cc4a8ffb1a19d736af22f03a43
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THG:tQvGAdlCEL8c/DRNw5C1+k
TLSH
T164266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 fa07c906458044395d84f9c862c796b0ee67fe245e54079059af9f0d5a8cba34
MD5 ee68cf78316a3f1b5c13a9cf48f7e201
SHA1 c0d7b74b4671fea1324772c24a708739c24ce1b5
SHA512 3745352429e00f9e0055ec351840cbd6dbf771b37efc725f5b75a132a081f436a51f8da48fa1fcead6704aa90a0c9fc00f5f60efe0aed510f1dcc57819b0c2a6
SSDEEP 12288:DAwSfxL/2Dc3XDLLmt0LDQewsAjGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:8OewsAjFNyBo4kx929bL3Hnx
TLSH
T1B675E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 55a1b3f8e6e78d3edca6b3df76ccf674733c5c92c6852e184693de15576d4098
MD5 dcf69bfc9255f077191b7d9a130c3c40
SHA1 5d4d24d0031ea56c50ac10316e6b68feac939bd3
SHA512 409e1325adbcb4426d1941beadfea34737d5db779d75ab981820c42e16017d8ebcef2199685c316774c75cf5dbc6bb815068737180906f9a9eea7712eaaa784d
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHC+k:lUEtQevvqc2W1cpV2tI32C
TLSH
T1B9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 02619c4dd1ad4220bbb705dec5621f4e112697c312055086c625f1e261e73016
MD5 bfb7988105768c54c021065a07ce0c20
SHA1 c4b2898cd8cf0972dc776b04c1fe74b6cfdd1f06
SHA512 24f94284cdf8d1f5449e57499aa84eb4c850c9195ff162dc844a4940792d6d44a962a7b9331c3235097061a3980e79959816d098b8b1dc277d107a7d1bcb7e4e
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zyB+kn3Hnx:woquVjnmB+k
TLSH
T152D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c02899c372348addfabafb7815f8c770596ea2a6792d3c33b37018b87205e700
MD5 947799b268cbb2d32519f028156b86d5
SHA1 f0ba538b450bc6c6fee49f7355357a85b2b59ede
SHA512 68521f163e865465735f9a3a61d6a6de695df6db38e4cf613557e7e4984a8821c1214b6e775f8df6761eec2563c566caeab117f125aad0fcf68155e3dd42fa90
SSDEEP 24576:MAhGL3IFoiwtA5l7S53cNyBo4kx929bL3Hnx:MAMUFoiq5XB+kn3Hnx
TLSH
T17A359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7c18cd493f1956c973b015c66213688bd60058a0eac0fcd0298301ac9b3f9de0
MD5 b771a5206b28bbf205ff241e6e8a8dff
SHA1 32edd0c5082513fcf3bf85f7f6240b5d4ac13f2e
SHA512 3864f80fd55cb88db0beaf2318c51ab590af8a13eb2121d0a3e0f58526da65a5ff7257b3bf3af3312981a34513c3f1c66aa490e6e4491d38d132d1b1f64bb4c0
SSDEEP 12288:Kmw5HEjsChNzBFgl0WDm+CDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Dwu6OWxNyBo4kx929bL3Hnx
TLSH
T10865F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 23b663b8e8ddd993b4563d494393778fa1243b0b5bf0a50a6b3c650676dcf02a
MD5 ff8d8a69105dd9da48a6c38d4fb19f32
SHA1 f1442a30fc2a28295dee7b38727ae9c8c63b5796
SHA512 85947744e0c2cdafa50d98cfc0722f345ae1323aa83f52bc1ae3c29efd48f753676adc29ed613b814bf125061a149f69d4cacd4360dd65beeb86bac1fb38769e
SSDEEP 12288:1gZ1Iy2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:eZuuNyBo4kx929bL3Hnx
TLSH
T129551216239831F9F2AB2678D8E58544CB32BC461B7283CF5A2185BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7eea35cb1844bdbac0b3921140cbea2a0d0572082352594d22c5818f6aae1a47
MD5 81ff9a5cbea60eff998f743705458c1d
SHA1 26defc616dd4fec1d78622d00141ed4b2392f2a7
SHA512 58152c7cfed2ef05dec1b001797414883e7ea26552b5f16fa8ddd6c4193c1f9d37e8c758e5889dfa4a60b7b517f192614f41212106f9864872d49e5818d32df9
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:DQRQyi36YOcPbLvw2gAf+PN30+k
TLSH
T1A6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 95533b6b17fee038debd5e90608733662d4bb696cf2ceaf7112500f6a6582740
MD5 bbabd01cd6c2a62006663f86aa2ab61c
SHA1 d2bf89e4dbb67120181a207379e0137ca62e1047
SHA512 ec6f60fc59c1e0e9339f6ccc48d869744373a67c3ae230664320264ee1b2aca5f9e57a30d68c4a1360847d62f12022d7279b918a415e92f53f6aa0500ab86d4b
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:VQRQyi36YOcPbLvw2gAf+PN30+k
TLSH
T165666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e71968e8ab430fdda9805e0fca012902fbae41075623fc84aba2f26bc15632b7
MD5 1747b8baaef6dcf0e9ab378b23fb33ec
SHA1 03c5be5e5ef6d78390aa5dfb7fc7d2f861c9991e
SHA512 24b69b55002273a645da9f1e6f49879e976226173305d40156f31cf138e23e29a0140bd92e648b9d0663682f694834f2768037001e28386fd5087ce21c014673
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0eNyBo4kx929bL3R:W68Qg55nhceWu7PNU3/iB+kn3Hnx
TLSH
T1D1B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8de4a420cc07526364ea79ae1d8007bb8d981ba71e72556a5442e6440aeb069d
MD5 46ed7c2b65ec92699293fe319ddc07dd
SHA1 c8c2214ae045093557dcdab0de7e0d8928551fdb
SHA512 3c489177afe4e66d2634adc3f2ea2930a8d01d09e705962da6a13501e101fcc1cf0b185287f3e701a2f077e9d3987f21c8a66ccb42827bcd8c080b28dff5d991
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99s:Ey5112gYy5azzVvt69nLKnhZf+k
TLSH
T10C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0b0a7d9eeda872ee102b3c40a7f9f5c92ed6a7773223c8999f811bc23753c66f
MD5 1491c5ef22e8466b1c5eeec4312285a5
SHA1 85bcafc1d60c9059be2fd6da954f4a652629023b
SHA512 3d20ffa9ebe700de2eadbccfc335e815dbffc404ba48c764c5b7609be07582abaf91f5667a7b16bfda843460d07af24e0fc134e4769771c3aad8b72bd6e5fedd
SSDEEP 49152:jB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQB+kn3Hnx:Vu6Jmdxd2ds+k
TLSH
T169D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 20458b5ddea58df0e934c8af3bc24608a18e0f65abcc229a1abcddda25fea6c7
MD5 43880c5e987be8831c1cbb514c519293
SHA1 c95b42915804bf29eb8dfbd62532d1415e833aa8
SHA512 a587887bc568612b164f28a7d5f880f067c0f0a8199e36e700064c0924b61fd0b460c1a88f7cfa99bba4ef42bdc255e7b0151246b670f97e17c3a9b0b94bee88
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4xEB+kn3Hnx:vmifPWRB+k
TLSH
T13CB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 67c3c21b3c175afe52ea629a4067c58fd58b134d3d25b61fe054e2ecb9015e5a
MD5 f83a38a2a8e62312a3fffe95e03b841e
SHA1 35f52063a3b1d9a9c2188e5df4df8951710648d1
SHA512 3b9754eef565de8e5f37ec61f559c97f8e995c1b99602dabe440f496df62be5028112d6294d48a4ac40040500d5bf18e740ef32e77bfedb2ac32fe9f9a13f83e
SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHqFB+kn3Hnx:G5dKii61T+k
TLSH
T16EC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ef26f4edc924a6c9c708a8923fcf2ae11f570a2fec934d78f63a9c56bd6705d5
MD5 e8f30e7f690fa6f9bd7b6f8ea6aa4e3e
SHA1 ed0971eec6e7d046813f1b5f60aca47a9a41b7a3
SHA512 46c1d85dac9e3cb2fb1ddf0cc0c0208acd51341d11bcc90c56039735f1e415a40dd8403baeefc6ae839fb2a46f8821243dd8319e8999e161a0218570cda4c1b2
SSDEEP 49152:vhtSn8EApI0fig3giDn0AP5wAB+kn3Hnx:+X2imphd+k
TLSH
T12095BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e6ddc30368efd6ad3ad48632c452b316e3f4da5b1e9203f0651bc0a9ec1acc82
MD5 e41796bdf9249346c199baad88f7df60
SHA1 63bed2c8e581e8dd6ba63ed9bceba66672ab2eb8
SHA512 5d77f629f5d791625a29e8240a9fda70aed1489736317c2c034a5e635c87dd3e3531737dcf8b25e6579eb8fc17c2deb5d0ba01ce6859d7fc0c426f2866fea102
SSDEEP 12288:XtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XyNyBo4kx929bL3Hnx
TLSH
T1984523129A0C627AF76D3FB0644A8158CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b9ed9054c66020f06ae3c31cd794aa687943426fb624d16121519ec59b8d268c
MD5 28fdfff7ebabbdf32848305a72a11fa8
SHA1 81b0ac003adc4bc6b240ea2fb569488021edf679
SHA512 979a112463bb5685192c5aff33e4a5a11f7fdc598b55e1a2d580344d8c1d302846e045bffd119639e6d90fe7bab7af12f5123fac88675737494096b414cf8ddb
SSDEEP 12288:hyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hZNyBo4kx929bL3Hnx
TLSH
T14B4523125A0C227AF76D3FB065498098CC34BC8F1E9597D8EF27987759FCEA25B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7fdcfc65ad56a4796bbaa02a5d1f38c18234ac8965646af474e66d41413a7153
MD5 ad14c0275617f142eff86433b2e77f21
SHA1 1124624fcb012ef749dd01a61c5c615fcbc5d328
SHA512 6f757c6794d51d577ddf9ca07fd640554ef67ab4632f196aba626fc62b66d467066679a9081c75ef2a591234e019cfc07f0d437d7d512037ccf0482f3c22109c
SSDEEP 12288:wcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wDNyBo4kx929bL3Hnx
TLSH
T1F74523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7d27b4a480ecbe210e968732069145aeba71aaff11c699caa962f91ae742da5e
MD5 7aebb6d45b2d9653a01043a6b1ced39a
SHA1 60eb01f5c327102001c2c8299950916a2b70ec89
SHA512 d760a40b52fdfd9fe9f9b146b4366cda4bc2ea9aa657a93ac7dbe3274d7399cda1b99b869e8173970ef32cfb010b09c372fc08495d113de48a32b5a44f52094a
SSDEEP 12288:3VHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yNyBo4kx929bL3Hnx
TLSH
T1174523125B5C12BAFA7A7BB0985A8054C835BC8A5F7197DFDF124C7B0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4b89ec7c68db5bbef45d1aae05ed7a465bf307a88c604207cfd744dcdf9d150a
MD5 434263b26de5f1813b6cd654c9a23d1d
SHA1 d7f3a1a28596fd9a6ae4385d387a0c537cc15dd5
SHA512 21bacfbf17064ce4b8b225e33dbd97638e067b12051633a37d7a38e8a21832712c1ef64e0a4e45ad4f37d5ed1daaa3a08e0f88b3c43a027d4a4663fc0f1dd844
SSDEEP 12288:AfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AkNyBo4kx929bL3Hnx
TLSH
T1054523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6c1286e9b92bc924e26be95d7bf2655a8c5d5363657a096d0c4f767c05446872
MD5 2d5c48e239f43a77876e335934f85623
SHA1 555894685f359e3e310885b8a079218ffa04d074
SHA512 07ded4d67823af7389e59e96da370275651abbb7c6eee3cfb3eff8b23a9e5b3261989eff357d6e7e80fbee25b675830948c9bf247bf5da00eb0011ce71af7c8b
SSDEEP 12288:9OLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:99NyBo4kx929bL3Hnx
TLSH
T1C34523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f59bff2c1af79d2cf3413a172efc6b44c93da5917693675b75b81eef845eaf9b
MD5 9ccb584e8249b2be76e021c6a8c090c8
SHA1 96afaf39e67f624f9e406850360806d5a5dd039c
SHA512 67aa67305a7a6c7cbe142e7730f198d981b0388d055ba2ffc7b4e3e2c57d451d68e635bad3508ec1bbba68ecf22356d0c53a582b5306c6781c76c2af08e7fc8c
SSDEEP 12288:zqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zhNyBo4kx929bL3Hnx
TLSH
T1AF4523129A0C237AF76D3EB065498498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 55508a4378cf4a737aed05a08e8507abe08147ca2c3b1a51ad8a6fef675bcc1d
MD5 b37665a3a9331075ba7b317e8de72d6a
SHA1 bdecbdc7f16d1b5004e7324ae73ee4915cfa9ac3
SHA512 f0a08614d984b1ab18ce2903bedd7311c183785c8669b1dd1ac7459b07ae5235804566c10b6023bb7d730e4c9ea76a09c746420d52b491172a09e11d3373f1e3
SSDEEP 12288:YiZwbjzzFEoS2cPvySLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:bZMXzFVSO5NyBo4kx929bL3Hnx
TLSH
T1E2650195B39418F8EC67823DC8158906D6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ead68a8d88341da474c4e43a66b8e26ce8b51a55fa68327e0d4bed59abfcb42f
MD5 3417a9dfc48a34a3a8280d69d14e8ac4
SHA1 2988ae1a9416965444f1cb0464a1049c6833fca3
SHA512 9691e981a28108456a1a1b4e5e26fdd1c654b6f8b0dca6bbc34c7d27d9792251ce16d7b3f7a0599471257fafcb88dcc19e21beb8df77f1d06dd8b3c9bf9c867d
SSDEEP 12288:QBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Q+NyBo4kx929bL3Hnx
TLSH
T1C04523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6df6e2bbc133c35a3c53a3eec2f888f65ff7de43efcefe0b8625a2e7bf116288
MD5 39b7d73e2e4e535f172b960245eb9fa8
SHA1 c8974215a4b428346d5df7cc38eca43d23628036
SHA512 f9c51e9ffb728d67035290584c0d61f78ae8c68e329d81cccb4d7326070f1a754229c7abad46f8cf7fdc7c65b8b340addbd5eaf2a6da631e4f6f9af746878e7d
SSDEEP 12288:41LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4qNyBo4kx929bL3Hnx
TLSH
T1F84523129A0C627AF76D3EB065498498CC34BC8F1E9597D8EF27987759FCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0b28d22e010fb5368b7d95b9588fbd9ae58f2a5d186d37302e23d087ec3ce7f1
MD5 a292d8a61922fde8bb50f9351c3ee78e
SHA1 c0d8decc1b595dd414cb3fcc2a49ce44a46a4083
SHA512 c2e689bbc3a1032d0e0adf9a4f69692a8b49b63a3c05124663cc7456cd7e70be4a4bb2fe5e699933856efe664208139f8f039dfc4198c97fb47647f440f9d541
SSDEEP 12288:ByPz5L82LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QzyVNyBo4kx929bL3Hnx
TLSH
T13555120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b294ee8f9d1a532575f3fe5c72cfc1156d307210f33e9b01a63bd7fa2d2a1d3a
MD5 0c20725cb52448db332f921d70829afa
SHA1 53cc0814c78330ced7b3526802c349f4d9b798fd
SHA512 8953e13959a48e1117e8a155208c4998c0d6a5ccb27aefe71f0f65cb315a0a077597b7b498e6cadde56865e431e96fe93a8057f26f042da4450b20f51f8832fa
SSDEEP 12288:WBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:W+NyBo4kx929bL3Hnx
TLSH
T13A4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8e4d5c63452835ebb2792ad5f12f42a7b2d052ddc2e1934e5297825f4bd3901f
MD5 f9764d30158c772a0b6d27a7730bfdd5
SHA1 0cd09595bbdec78695ea96890b4cfabf5696de78
SHA512 bbdaca4a4d18484272d1275495d9537d5e3814f702756a2fb195064450ef76ecb33e3908ab8f81566b219788c2de87e3165c9c5c0ec29457d5fa30a78179a171
SSDEEP 12288:HBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:H+NyBo4kx929bL3Hnx
TLSH
T1154523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ded6c4840cee0b60cc4bdb4ce4038fc214246f456d037b29e2f32d63b7254b91
MD5 b5345ed1177a92ceec3a7ef19a6e76e2
SHA1 57d07766f42d7c69f4f0f565e285256e99c465f6
SHA512 d9a49f483e8c4fb5411973f613101690d7228645b44653b2221eb1c3ab0b98752fdc4e88a2464d837cd6494b00622d66e4f45323509ae6e7bfc2a01cfe30e463
SSDEEP 12288:YyPz5L82LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5zyVNyBo4kx929bL3Hnx
TLSH
T1D655120777A831F9E17A6234C8960A05E731BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f734d0ba6dd94ce8e0d1e84d29089eda94ec923bbe9f124ed3068345bf067824
MD5 c7fd52492a7de1ebfd5039215544fc4f
SHA1 940a1f3d824e58d89bbac094c2372d11bd928df1
SHA512 300164e215a0fb3347e53a173f6d18987eac658ed44a4eb56ccfe46bfb69f3197bcde3d8877d88c4453d9915f8c86c34eaf80d8aa87c01f18506e3e120a59a31
SSDEEP 12288:kCd98WYoaLHF3z0z04PDvhsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:dTtaLl3z0zDzNyBo4kx929bL3Hnx
TLSH
T1C26501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b0f4e4570555fc3b3c6fea3d9738ff3e71b0ad3f0efc62bf9c8a9fde3a0908c2
MD5 f2e290d61e2054c5d165e17624d29520
SHA1 a7403abb8e23c8e24b49bd00f9a73278a149d2c1
SHA512 8bb71badaff79473b5ca97808ff1112e8a659fb58b91b40e7756d0723c89baeeca7315a8186b1fe3a7b7cca65a3e942f0111548b3ce0be900d6bf35b918d2060
SSDEEP 12288:vi4e7ARdTfgwCHKy7GLbbdIv7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:v3ld9CHKy7GZnNyBo4kx929bL3Hnx
TLSH
T14375CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e94b1bb1af9127301363ffa314f8297b3f14435209d45e0d8ffc8549637b927d
MD5 340f507485532454c91a0f5be8498174
SHA1 b85a639d94a241343a3c7dd8f72f13e44e0ae045
SHA512 eccb8cb30821a461c5c0c05579a11b8ff8c783bafe484ea5d1f077fb08df73c6731d602e46fdc905764ca3ef1fa834c006f6d91cde56aae4f7ed1b2403ad3cd3
SSDEEP 12288:E8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EjNyBo4kx929bL3Hnx
TLSH
T17F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 03f385dd8206d89b312bd52b259330b87c74b28b521f352c0bf07eeec2b30871
MD5 7837f7afc5dacab7e0f72a61468bc5f6
SHA1 509a881b4cb6b90bf72be33e2366e1412fd04f26
SHA512 4723f2fa8d799515b2951644945597530b8bb7c363f53fab13ea9519b850900283fa7c65a56b86201269ff8e7223b162b53f2b011a5a682f1578406004e00f23
SSDEEP 12288:gWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:g1NyBo4kx929bL3Hnx
TLSH
T1A84523125A0C227AF66D3FB0644A8558CC34BC8F1EA597D8EF679C7759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 064fd556a1c2c5306be08dfbf4b78bcfab03d33e16be4f2b3658bb92fb4ecdf3
MD5 2e8852cd4b6772ca3c1ca8deb57cdb86
SHA1 b70d1fc5fa5199c65f0349076d7fe6db63dbd889
SHA512 a6e41847dc9c7c384db111fe2ed8c0a8e7241b9738caa611903ecbe34dd6fcb84eb8522205fb5cfe764837d0304f8d1269ee88bb0fa1b572bbeb7149b33acf5e
SSDEEP 12288:87LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8YNyBo4kx929bL3Hnx
TLSH
T13D4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1c32c75728cd0069fb9a37e18e1ca34242d82adb88f73c96c5f5029aa36389db
MD5 b7df23465c6c89710288df04f1e7429c
SHA1 1ca805823d82e3166198cc724750136a8e2f98d5
SHA512 0156688d5c83a9856d52408ee026a31cf01f02c2b115f29920567043a85d14f136722699a6b954b4aa725057e57eeb17e6365ea50040a963709d5ca4dadb00a6
SSDEEP 12288:XBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:X+NyBo4kx929bL3Hnx
TLSH
T1F44523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9bab278d650f461a675a6475372d8fbdc9b553419f58a3552871de325fc0ff82
MD5 2ca11e6c11c6c9e5087e65bf9fbfeb3c
SHA1 0371ba88706db02f0a73e6ea542b317b0821f045
SHA512 928e3a61a14845ff5a8a436db6ec346c4f2ea706d7bd91c9fa691280dc5b16c125f89815f260754db7983f92758ea30472bcbb796a05a356c9e5a1666c1232d0
SSDEEP 12288:/8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/jNyBo4kx929bL3Hnx
TLSH
T1D04523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 24d03282b1e0242ab86e805e5b619cc5805ea72ab7b6e02349e3b12b5d5441ff
MD5 0cf0fca1fd86f819c0c7d0453f7df712
SHA1 ac8774e440df86ddff932dcac8d2ce13e3868045
SHA512 98de8e8382e908a8916a56926f3cd7de13f6bd04b16e0839055f326a886e06fac5c6b3d17441011dce9dc79e7e53d0316dae8a2f38b343351aeb0dbc2507f2bd
SSDEEP 12288:25LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2mNyBo4kx929bL3Hnx
TLSH
T1934523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987759FCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ea797355ec85f3cdb766458ed23004a7df3323e08f0874fb5f33e29587b9b928
MD5 88514ea9074686b3dac95cc769f5df90
SHA1 4e7fc277aaa6f61103e166f884f5811fc6c91079
SHA512 057d9dd114dd005fdc3af9518e12ebeb3f8779410b8231a1cb2a6bf875879d7551e2e6e559c88e0514863ac96dd2137604f4a7403535cbd5f087dba3d463d1a5
SSDEEP 12288:DfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DkNyBo4kx929bL3Hnx
TLSH
T19F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0616f28e30bf863cdabd6e5ab804bc385094376c73e406e6123061776ff4f542
MD5 91bbed8ad58e9212c7c8b1e7d5fc3e82
SHA1 bf08e66a7368f6156e73429d076eee0de1f09bab
SHA512 29e24ebfbdd8c9a9fa6596a7a664d6507212a14d38635cf47eadf87e1fea0df6efd4bc8e2798753e7f63fb1f4686aa892707a7d47d6a09e5cfa823e7f6b9dfdd
SSDEEP 12288:HkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:H7NyBo4kx929bL3Hnx
TLSH
T1E44523125A0C227AF76D3EB0654A8554CC38BC8F1E9697D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 0ac1af11229a1b09b84e3d7a31fd2e1fd9202590a124a309c53cacaaa8a2fddb
MD5 1a65f969fc9bcdfb7e836e1d560d6826
SHA1 4642640390f24377d4a05525b156d79fad69ed49
SHA512 ac48fc7a4233e3b3f5cb7b1940118ed6c597e2ebc73c7da0c0620ae0dc9f7dcc154a38b4bf88900633c7926f3e159e36370924710555556fd84617124b825014
SSDEEP 12288:qfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qkNyBo4kx929bL3Hnx
TLSH
T1944523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 9c05dea9fa47e1628225f3c9f8f06392d45ed771ff57d0fa60f46ef7b54a2a73
MD5 0ddd8a3ee5e8d048dc342914608e98d5
SHA1 3721ebf635c258ed1505a582baf162825bd796ae
SHA512 5597ba18c3e3c21d7b615b0e583995a8535359fe6efde822b81d55ba692e7075730279c936ebac27ba6d3e0f3d9de203f0eb3451ad7d74db3428ed4b1afdc35b
SSDEEP 24576:Jfwvqk9RX6wkyAI6NyBo4kx929bL3Hnx:tMnYIpB+kn3Hnx
TLSH
T17B85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 88c6eb81a7d6ec87b04904c21b347a6b96aaf73d69c9e742d69b32934dfd3479
MD5 36f5b30245b22652972eebbcf79f3e76
SHA1 43fbef83039e1b86cdceabb049e1cbb3eab7caa1
SHA512 c31350b21bb272c84fba1dabfc12dd0b02725b8ea873755c25e62664a08ff86123de162d007d22a8fd219a9e79efe0fa48696c272416a948eeb7b965e3f717d2
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gB+kn3Hnx:UySzPU+k
TLSH
T148066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2bd3786ccdac921d5dc686f896bf863db9d5cf3351d35106fe3cffb4a2a6279b
MD5 c746fe85c8962e9a5644af79301d1d61
SHA1 fb7356a1b005c2e80433b4562d944a32beae76e1
SHA512 6dc5dbc90d24e118cd715336b7677016bd628e85853630bdb7e9db3a9614e5ae599934545979d9181242e9268ec8cb30c21ecc4fbe3a02decba7944b3956d6b2
SSDEEP 24576:N47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYJNyBo4kx929bL3Hnx:N47JUQjTirIhCnDHUPfF/QB+kn3Hnx
TLSH
T11365AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f11487e31029e046f677ebca0623fb975fd3ad6e4f386312881429f6690b4f17
MD5 76f149b471fd4f7399531db087046b89
SHA1 ff19d16fa562c6a285eded75a8bfbb96a477db4a
SHA512 e086debb4615b1a73215e727feea8aa82f3da877a02daf1ea5287c8288ee324f1a9abbe330e137e7fc3acea6ea639f51f786646b996019a3c4fc38fbf3021af2
SSDEEP 12288:/psfRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wuNyBo4kx929bL3Hnx
TLSH
T1FF55F01AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9fc27c2cec8375afb2c6a3c19d0940c420b2780dbf7b2a39f2eea55dcf98986f
MD5 ac2c6469daab1266cbb629cbd7523ae4
SHA1 e72bf783b7a8802af464a48238860d55af5af018
SHA512 cf0f4fc1953474c428c693000efb7124bf6b4d7bea63c0ca94b0151655a01aec397c2b0fdf465c060074761ec0f8c7ce41c69b647ba5ab3e60892ab114bc089c
SSDEEP 12288:rjAKiy5BUHGV2vTTS/t1rRgqh1OcSG4ZaRMZOP7p3Z:r3iiUmV2vTTSRgqh1EJZaRMZi
TLSH
T1FE352811762BD75FC6A940325E33D1CCAB707D41EE45AB0372C8872FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 82adf79fe05674903119ef6f4c11992707a2fafdf4a173ee1983d0390385566e
MD5 0cea3921a610a65ef07f3b3be907d8dd
SHA1 ca097a97c68c1b0e31966ce196f32de5d4d8e2b1
SHA512 5f79cd53bf17b4416c1616da7c5bd2ea3cf4d076e9f5cfe974d4191e83596107d7901b7171f1f9e92711885e35bac9c11c260729f33b98d8886354f0ab4645eb
SSDEEP 24576:WGZ6wf0kk0VQj90DF7+4I35RiGrHcZ4GKrFp7:/f0dFl
TLSH
T1FF65D8815137E39FD1F76072072A9F4CAB64EC0677096F27A388053AD86A725B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 34e82ffabf903172d44b2a4fd97fe457701503c245ed48006f1458238bfc700c
MD5 b2bb8636970b1fb0a211435bbf6a9f4b
SHA1 55dae1adb38f1bcaef520981423a49fece26fcf0
SHA512 1913c75d6dcfa7c4f04a844ec7dbce3efa235ffca26a53d9d0ecc9d58a37ef16d30e5bf55abfc640589d661c177949b1de34328d3a4b934ab94fe3530f6cc53c
SSDEEP 12288:hy7JLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gWNyBo4kx929bL3Hnx
TLSH
T143452312975C663AFA7D3AB0645EC024CC39BC490F50D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e52d0c2bcfb34a5a05937b93b12a69ec60cbc19da46db689d877e2c6e060aac2
MD5 788fd9446cf6204bc0ee1e10c1b34f5e
SHA1 f8f524bb632792ec6b6b92db0a66245a0ef7aff3
SHA512 6600236290a5b96d81b9c2c8d2be09b1c246c50bd213444582fecef2d3ad40a9b1d4f5e9b69777fcae0f6e5376b275358efe96b99d29ca128a9b3c6a44cc62b5
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYwNyBo4kx929bL3Hnx:xgb4mBIBhGFuB+kn3Hnx
TLSH
T14D65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 76491fa4c0bfa874e9281b9bf99a5f2c70f4339eb6d63dfb5b928848c0bf0718
MD5 e894e603696cf61c2e7ba7589d8c341f
SHA1 c10a9ea2f05ce394c77fee51d9aa182c2d6850aa
SHA512 48b5b51139a5e5014b1db5aa878bafeb8dfd6d2931bdba284018b70c1344c02c5cc8dbc6b44b09e46385a55e5f3a149052371d87dc86c506ef77cfe32e18183b
SSDEEP 24576:+G88u8FpJqH1Jzria7/m5NyBo4kx929bL3Hnx:V7ZFPqVAa7/7B+kn3Hnx
TLSH
T12D85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6501da78c607c0e94b73c6b87ebf183ff48148b18c593adaf58f1c535ccd721e
MD5 7b6de7a5ad68c77e152c034e86a4ad4f
SHA1 91e4365c15256d3871684da720636ee16a00f99b
SHA512 644d7383b3e1471912a1c30b525560a41c45f90f84da7743220ad195833d2a225e3b8e207fa3925f6fbc1d0c94056a3d0571e9abc216c804ee23e876773a5f4f
SSDEEP 12288:xHvUrBFrEjwaQ+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xPUr+NQNNyBo4kx929bL3Hnx
TLSH
T1F465F22F22AC18E5F67AB17C85868619E771B8520711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5f39eb2bfb1445aa2e7dc53c3915d0d82f9d5c304db1d5cdf39d477f5ad60ec6
MD5 ab3bc91a22f3cc202ab527dc8a75b0f3
SHA1 df8285e7b3f4617b5a2d06562f128a6722351c69
SHA512 9e52684a8c3b461771ada7ba5415c225db8780f7091141f6a813b50f3b1bc7b9d356cd9dc156468e596b9dd5e3efb11bce7066c8b6e9dc3fe46a5016d5c17621
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6B+kn3Hnx:DG05lO43bn+k
TLSH
T10AD5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a50acd3a5e8e38881e9433701ee6fcbd723f89ccb840fc2a3d1ea8094ad9bfd2
MD5 7b85b14cea46c09f8909aafe76ddbcc9
SHA1 00d610c7dcf0578573b9930670975b9b6668ca04
SHA512 95caeb975ceb73f051b6b413d02d40a9d9ac0978824757ab99eaff047960290aef295aef04493facce7cbd482417c99a2d15f739c05223cc37e3cb8bec93c355
SSDEEP 24576:cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnvNyBo4kx929bL3Hnx:Ea5POZ3BJt2pasx2+miB+kn3Hnx
TLSH
T14A65AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 80d24c90a00634b3698f66a1bf6affff5b384ffd7998d3ba301afa98c0ae7f5b
MD5 463a5a37bbcf7e175cf8c59c6987ddd6
SHA1 004a90ba126ba0bae5121ad1f5b2d6b8ae790ef1
SHA512 3da6bd0c1d5329c4dc8e60a636d63d8fdd478f86fce0e9e9bb71e50a68418b63b187db422d29e0cbbc4be9ae689dab76240414221b01efe9ca4a1debd103bd44
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkRNyBo4kx929bL3Hnx:YNc/zEOVHFbB+kn3Hnx
TLSH
T10E858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9e048c1238f216b59cf7fb89eafe0e3d11ff41c26b64dc5b45f054a29d351ad4
MD5 b047d9021dbec00647593eac40222b16
SHA1 a0a2f945bb274835852ae1012e2502a92054c9b1
SHA512 e296044a2651ac55b94de2d4c08a99b570b748f5418d6a6f8bca896de231d2936705996366cec298a85e079b7b682180e846814b80655e22e8a45e7502fd074d
SSDEEP 24576:sTkNvNnaFeYhJNtmZBm7NyBo4kx929bL3Hnx:sTMwBtOmUB+kn3Hnx
TLSH
T14D55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6e41fe832d5be4a889c724462520df1c36516a461ea9c05c690e77d3a54e54cf
MD5 a411433b66bb61d39efb9703f8033635
SHA1 dec4c05d6c3c8d6273a470e4181bda88e1dd1d27
SHA512 539a39debf41b75265896bca7509d63ab34d966d668baafbbe0da71b62d75089588e1f4d12cfd0250bc6c7262617b984bb58ebc42b049ec56461f6a37014cd06
SSDEEP 12288:EQcMxWDXN1Dp/fshBItT1IQgANLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:eD3FHshBIYQgASNyBo4kx929bL3Hnx
TLSH
T10A75E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-131-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1360-142-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1360-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1360-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1360-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1436-315-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1436-90-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1808-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1808-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1808-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1808-392-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1808-394-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1808-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2396-1-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2396-89-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2396-0-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2396-9-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2396-317-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2396-321-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2440-77-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2440-314-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2440-79-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2440-85-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2500-430-0x000001C27C8A0000-0x000001C27C8E4000-memory.dmp

Download

memory/2952-378-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3016-373-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3016-119-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3016-120-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3016-126-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3152-45-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3152-39-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3152-49-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3152-51-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3152-26-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3372-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3372-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3372-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3372-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3372-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4244-64-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4244-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4244-48-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4244-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4244-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4532-377-0x000001860BEC0000-0x000001860BF04000-memory.dmp

Download

memory/4532-421-0x000001860BEC0000-0x000001860BF04000-memory.dmp

Download

memory/4980-375-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4980-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4980-112-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4980-114-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4980-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4980-376-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5020-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-15-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5020-23-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5368-431-0x0000020FC9200000-0x0000020FC9244000-memory.dmp

Download

memory/5932-66-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5932-304-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5932-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5932-73-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5936-387-0x0000023EC1BD0000-0x0000023EC1C14000-memory.dmp

Download

memory/5936-419-0x0000023EC1BD0000-0x0000023EC1C14000-memory.dmp

Download