aba64cc6ad58a801e05e205e4fc6a740e4abdf10364f4c9b080ceb4d347c97c0

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260817-bde6dagg98
SHA256 aba64cc6ad58a801e05e205e4fc6a740e4abdf10364f4c9b080ceb4d347c97c0
MD5 0ea4dbbd6dbbb48ed9719de79c54de37
SHA1 813b442ef670f7841ddbf6af5a493b75efd1cb81
SHA512 f44b897ee913f0fb51696bfa99c8f8f79a50c555ac9f74c988db26ce45428a245429e57874d028bb92aafb08f7664c96d73b31e5fe26a7865f62278db51b7cb8
SSDEEP 49152:E1rZgMiCMg/w6UJsFIFEVek9RZ18vjvI1:gdps6kdk9r18rI
TLSH
T12585B00B676901FCC0ABE17899575A06E775744A03709ACB07E056A72FB7BF16E7E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3884	elevation_service.exe
3220	elevation_service.exe
4976	maintenanceservice.exe
404	OSE.EXE
5400	PerceptionSimulationService.exe
1048	perfhost.exe
4304	ReFsDedupSvc.exe
3192	SensorDataService.exe
2836	ssh-agent.exe
3340	AgentService.exe
1492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\27804840b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e115d400e42ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000154f23be42ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000210dc4fbe32ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080183bffe32ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c62f3efce32ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb93e53be42ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000983f5dfce32ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4588	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3340	AgentService.exe
Token: SeBackupPrivilege	4304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4304	ReFsDedupSvc.exe
Token: 33	1492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1492	SearchIndexer.exe
Token: SeDebugPrivilege	3884	elevation_service.exe
Token: SeDebugPrivilege	3220	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4328	4588	2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	91
PID 1492 wrote to memory of 5968	1492	SearchIndexer.exe	103
PID 1492 wrote to memory of 3448	1492	SearchIndexer.exe	104
PID 1492 wrote to memory of 4692	1492	SearchIndexer.exe	105
PID 1492 wrote to memory of 2732	1492	SearchIndexer.exe	106
PID 1492 wrote to memory of 3144	1492	SearchIndexer.exe	112
PID 1492 wrote to memory of 4160	1492	SearchIndexer.exe	113
PID 1492 wrote to memory of 2136	1492	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ea4dbbd6dbbb48ed9719de79c54de37_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe" install
  2⤵
  PID:4328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4976

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:404

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3192

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2836

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c22a01f3af8592efd94d7c120c30c58d7e00174c27391618e8af806bddb189f1
MD5 320b058992ee9f7ba6aa6fb8032f12f1
SHA1 1afc8e21cca325a73caf13e00b9af9feb1c8d6cc
SHA512 5158f1a0f88b9b67d33c57da01075d8f797af4ccf60407b96ecc514286d8ddcf9228cecc66ab27472813daa3dc1288152f150d0f02f5953f4eaee43277f3fee5
SSDEEP 49152:Fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn8ek9RZ18vjvI1:b3q6sjBok9r18rI
TLSH
T176D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c4079e5f9604ed0ff97faaf6799e8969f239f9fc443a4677a2b2ed559e80be2a
MD5 bc3cc6d99d1e57e763442721f0335fd4
SHA1 273e9aad52b5fe8b520a8a5227493bd8db956c7d
SHA512 c7071e7a197348bae1413cdf9a6655279d329affcb205c6b9c875e6673c14095772b99a9ad7d8e6e0da908388c6ae2bb1e31dd55198a81dc9c345f5715a65477
SSDEEP 12288:p1XLsswWkxy2lRq2czANDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:nXYfDtczANek9NjZHV3svjv/A1h
TLSH
T16A65F12877D504F9DD67827CCCA28511EA737C5547A0E79B03B4AA211F332E85E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 57841e97b1abf1f8a1c26ab9e9769744d552bb6ca9e74f3cdd27f69d4b46918c
MD5 6f4c7b9ba08e1d67d1e61c882919eb64
SHA1 b06bd0c27f0bd084ac27d71ffe3eedaf50932de3
SHA512 4ceef1498a7dd68cdcb0fb9847e987c0848a85394d55e7f77105322adc76c569291e3f390eeb298782fc5911c90f9996d29b13dbd6fdc89b1aeec2c6fb579af9
SSDEEP 24576:s0Le5ji0hmxxrMUek9NjZHV3svjv/A1h:sPji0AjPek9RZ18vjvI1
TLSH
T1F885AE16F6788335D073C0B9C5D2A68EE97130865B308ACB4296D77C3F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7b1e95107b7edb7b5910ef9b0a508b1107f0613cf8336368333b560e0c353fcb
MD5 efa4662603821a0d8ccde88bc6aadaac
SHA1 ff18e6982dd9c82faab0a1860204a7a17a85fe04
SHA512 9b890cca4a27446a259c43a4ab9f094f5c00975221870cd9dd4a31221087cc01093bff0fdd957c181e88c3cdcf54e99e0cbbee4c21c4e6feba30de863af21129
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyuSek9NjZHV3svjv/A1h:E/ezSC6vUzPveHjyTek9RZ18vjvI1
TLSH
T122755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2d550c627bde1e98c6e8fc3928d983c371eba56d88efa143bdb2d525e8b21d8f
MD5 af4af924a8ce9b36726499bc5527c945
SHA1 245292dc5d3957abf933ea39d4c1623cf2c2a324
SHA512 70163755ba9b928f5cc2f81e1bae829f1d22292b8ace0fb08399c9bd6a6c0348fe9907664fa036185c089645eb54aeb11f778afdc5f8ef3fda5752a091d2b1e0
SSDEEP 24576:RVbqPb88hv/l+YZek9NjZHV3svjv/A1h:RVO88hXl+aek9RZ18vjvI1
TLSH
T1A1559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a10ea694982a6d3039f54361058704ff77fb9bd5d40252ab4ff377d07f7dbf87
MD5 d89990b2aa1b9cbe6c4d35fcaf1770d7
SHA1 5897c395a98f48b88adb859029cf63cf06fb02b8
SHA512 b56fe7e20fa798d7bda69b87ac14495ef887acbb3e378f04f3780367aa6936585b6305758358087076323c744a86ba883a54ef8e3cf0f046bb10abe7aefe6b4b
SSDEEP 12288:HLwDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:HLwek9NjZHV3svjv/A1h
TLSH
T1204523C8A74E00CACBB36FB43D6EDA52D5A17C6854C63A579276FF5051B80B8E207273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 74f6d80490d515806e6a366a9c7ebd4fdbc77c5fbfc4982a163599d357166008
MD5 c58e7eb9f6c8467bc50cd52471f6fa15
SHA1 8add6c44f8a3f28b553388354909e24aeb76078e
SHA512 6483537f5dcac30f274199437ed7f8b88ae578aa45a40e6978f020bdc5a6be057ef16507b23b102d3e43950f1cae4014aca3e4689d2c76e0dbecb7e8e7798717
SSDEEP 12288:ueBNUbTVO86URDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:uJIURek9NjZHV3svjv/A1h
TLSH
T13665CF7BEE28FCD2C27A9DB85A51C600D77278304B52A3CBD175C30E9E235E45E7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 699251bfca3a59c3c4c45e545ca0b8ab527119a278cf8f68ec4d8b9408cf6b3d
MD5 559930aa5e840b920d54b76e0009f749
SHA1 4d870da033f205896aef8516fe9cea9e0b7528e3
SHA512 8c13dcdbd9b7c8d015759ee8fbc3cfdfe3c4ee248dc588842181a5f0d8e52d2e4c21cb5836dbb880ef442eeb72cfbc798f74ccb2662748ee0210c3f52f7131e7
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:GQvGAdlCEL8c/DRNw5C1k9r18rI
TLSH
T1A5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2d5cd0e72c8f89a19afe2f45c037cb7a589c6dbeb5fbccbfd6e0837133d346ba
MD5 6ec92f65568c8ded7b44cfa64d42418f
SHA1 ec8e63d33570c65e315573c1b63a836ff28db1b3
SHA512 8b0faf8b517155be1ba30071521ad12053f28bc1e3ede9b2120aca99852c7e29f582eb6300db67f2453846c35be9f9c2b12eb2f61583fb554756a59852c083b8
SSDEEP 12288:XAwSfxL/2Dc3RDLLmt0LDQewsAjfDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xs:w0ewsAjfek9NjZHV3svjv/A1h
TLSH
T12B75E031FA74D036C7BB0DB61B36C716547C79204B922AC3E3B89E9D59701E22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d90900f5fa4380df9afad8cfabc555a1ad52de8550c9eadf919c924b2e98af5a
MD5 ca8eac0168b86b7629b4f20a06995af3
SHA1 aaffde27f11edc86cf6181017e98ac674a74c42c
SHA512 d0645553588f8f6de6677147786bc1e9636b961a210d9a3b15a409fe141c7fad26d1a1cecd05f53c5efc0153b0a4d4b6ec1901c4a57612f4bd605739018c6449
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHek9r2rI:vUEtQevvqc2W1cpV2tI32eSA
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 70db978cb563099441859fd0b163cefe60df8deee0a7661785d45419924f0cdc
MD5 5b381df4b84c8de78b9e763c97bb0d3a
SHA1 88f8464331b57b5d1bc35c18d57173df460b5b0e
SHA512 343425842f6fcb9189f70c2e1e2542e3b69af48a58a7a2c716bfd6da90de9b3c5b792118105f18f6ca9067983492f6c83abafa908d83c790b156410f35324c5d
SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/z/ek9RZ18vjvI1:QoquVjnmBk9r18rI
TLSH
T1B5D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 101a7a0bc28e78401d45bf5a37629e7b23af9495f6a584d799df7947b0eedd9f
MD5 cbddceda136840f8dcc4c885c5fc0ec6
SHA1 c405b3f10db06c50a42f5c4a8cbde3b8e26b605a
SHA512 8fa8b7f690b89983d99637d66e1328ea69184589e560c5d0e15edef81b63a5bf7d42bb2d6ea211705758558c9b997af488bb1c8e7672f06ac10cebf2671fcbc9
SSDEEP 24576:uAhGL3IFoiwtA5l7S53mek9NjZHV3svjv/A1h:uAMUFoiq5Wek9RZ18vjvI1
TLSH
T112359D80E7F951D4F5B3AAB85DB69171EA72BCAA5E31D20F2160D21F0E33A509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 67ba530372da388f658797a126087a9e1a1d2d49db487656bd984f8340cca957
MD5 fe4096099fca347396a74ff2ea307545
SHA1 4d15ad3ca9333d046bf5333f5d6df4012b2eb177
SHA512 c4e43e41b0b82ee2605d2ea79abe1b15ce7e709059ead50deef60c296e1a469321f1af8ec1f9c06f0eef21e97291c56da7f59e9555ba9ffb9d5e982543a3f56e
SSDEEP 12288:/mw5HEjsChNVBFgl0WDm+CyDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwanh:+wu4OWzek9NjZHV3svjv/A1h
TLSH
T1D365F18977A808F9E9A396388957C132F7F2BC112A619B1F1370C7575F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 215875e39d9cddc40fc38ff3a6ac7058754079e6f6c55740be04d6977807a456
MD5 1d97a591347ec098a6a75e1662f7f9f9
SHA1 8f538b99565ec8cad3a84372ef299c1c2f2dc790
SHA512 91d8c76df0e767fe021da08bf73ebe1d143455528ce23ac588a38f9182b57f33c87720be14cec46ee72fc4672bce21b1bd563a075a2ea36d2c03b684f4f74696
SSDEEP 12288:XeZ1IyvDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:uZuMek9NjZHV3svjv/A1h
TLSH
T17755128933D820F9D6A3567C9CE58605D772386623B213CF1235AB611F726E56E3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9b00ccf21c93f816310cce2e45a2df69c211162a67c5acd12e31137883c9e276
MD5 12fc4a07c8d55f1f3a109844df612add
SHA1 a8b9483e8a79d2ab920a0809bd605781433ea9df
SHA512 73688b646c5a721aa107e220f71eb7a3ecdd0e5954448e25b9e3ce130680ef75c42df1d7f0888f9895cecf572b49bf24e67f08ba46769d13937f74591b6cc9ec
SSDEEP 98304:gQRQyi36YOcPbLvw2gAf+PN38k9r18rI:3QyiKa/X+PNMk9r2rI
TLSH
T195667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1dbce5aa29c699f9e0cfef04e7bdbfaa71c329a0958f65324ef51ff6f604f986
MD5 df33f4554570ff271264aa4b202c788e
SHA1 f7efce4446807b142ba7850dbc3d3935725fa129
SHA512 cddfaa9cfec84aa86e3396f865ae3ba31aba70e88fe1746b28c74e962818da074e4a072bc186f684d004c8ba3206b257b169c308e335f259175a30db5bd16388
SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN38k9r18rI:6QyiKa/X+PNMk9r2rI
TLSH
T102667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f0691cd1b339f6beff61ba65133133313c82a5d71b7b0266f8bf8b5d1a00a545
MD5 411262c4739b43af010ca6ba95d5efaf
SHA1 e2271bdd07cdfdca1ab67333f2e0b7622dc673ea
SHA512 2effad36ac8c6e9cb1edd492507e7dbe31f4fd064213e9c6bad9a0c05efd6c0777a89c5f5092beaccf7fee743c15e61479f2e02ca21dfef50a8432e5e92475d2
SSDEEP 49152:A68Qg55nhceWu7PNU3/Pek9RZ18vjvI1:6thLRc/Gk9r18rI
TLSH
T194B55933B2F60099C44DE1769F4A872196D27C758FE1E3DB851172061BB2AE07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 85b2377e27d2b9d7f678e9fd13e243307e590073c837b92374169ea3ee5e8b4f
MD5 5b4b0c933c7a9df9b4408cd08f1a9b82
SHA1 cae3f1482a4cdf975ddcd903f13c69b99fb53c28
SHA512 c0d175ae629fd5b8df2f68b993b6f42c6d5bfd53187f6094465080e5d04e575e3e4aaf27b80adacb0a7f331385ce6c6c58870669d90270f3bf4c29c3fd27a581
SSDEEP 98304:py5112gYy5azzVvt69nLKnhZTk9r18rI:ELIHEWhpk9r2rI
TLSH
T1ED167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 452eed6859ee44ae0510cf88f0d3633e852517678a36569d95663a1a182d6de3
MD5 2ef078b16c79f63afa19603240e8753b
SHA1 47c18cd49131f72a076221e40da734d8b8318216
SHA512 514c320804d32f091bf5235388693477b722bfeee31dc5b57936ceb060465f86c4b7e9f1fe1df12dee396ee6205e3eb5939776cfdaa85583d7518c656d578d5d
SSDEEP 49152:SB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9ek9RZ18vjvI1:gu6Jmdxd2d0k9r18rI
TLSH
T1EDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 99b664e80ef4631a9d5268a48240b3916da32c5e72153c11e881f5a4a1b815c5
MD5 df4cd682b975400949b3b04cf26f4989
SHA1 588b3b6285c542dfda2d8f3c0461250ca8e0e4f7
SHA512 2cd71ba3aaf7be650146a5e978d462542782c43182b04d6c902d59626d0669f166b80695b3520169cbc43ba964d741e2648eda262c8260fd29ac98144b7e904b
SSDEEP 49152:k1hpsNoJpF1A63U44CwH7R4xxek9RZ18vjvI1:kmifPWRBk9r18rI
TLSH
T1FFB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8519c2c4da9e16bb456ca017e741895fe646f3266d6e73957ad7d0881f258fcc
MD5 271ecfec5cd03a7a29a434185f0a37e7
SHA1 ecdd2231438823bb88f937dab0268b79c6e1861c
SHA512 ef1659cc23aaca8bf954d331c2f3d2634ca6d8818d184de2623196d802d0ba34e1bad0197418a0006354a75cc0d027b020b877f1d149318482bee238b801d96c
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqMek9RZ18vjvI1:65dKii61Hk9r18rI
TLSH
T1FFC5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ebba9c09ba0c8743a69255a63bf6152c5e46e48367383447c2e233c343796c78
MD5 c7289696e1032971180fe7c29be2923e
SHA1 13593f6d3d526026c122ef05bd193caade9537ac
SHA512 ca1727ce428208a0c9cce35d9bee37c3f112a4a81238ec01ecc10a808dbc65032e11daa8eccae31e7dbf93a57992f38de69442d6558f465afa0d9777886f55be
SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wNek9RZ18vjvI1:zX2imph9k9r18rI
TLSH
T16995BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8670eec4e4a2d6e3a5cc67fedc4ae55dcdfe84aec99d7ea9583e77e754025188
MD5 af1abc9ac185f3c28fc3aa1781e2be10
SHA1 97f4d8526ff461c93d9547eba2623f9ee08e4bf6
SHA512 361d16afe59618cae030d247d3f183e0a6444b23e5a04849bff540c912cfa67ed5a32261c06106355da010b010f6604c9563acb7cabcd1c154c4662372308f67
SSDEEP 12288:/oDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:/oek9NjZHV3svjv/A1h
TLSH
T1DA4523C8A79E01CACB636BF42D69D645D4603D6EA4C33697A37BFF1052B41B8610B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fa9e6b0efc518d069a0710b6a2fd93ff12ebab6d9cbd9e7c692ee6fdc09fb2c6
MD5 6a02e9fab57424286a3d481d89acd796
SHA1 6906dd3b6143a7179662e1b1308033b78d3b0577
SHA512 1108c22cab2e6ec39a741e1bced266f071441b9e30c99f2e77f9dda27b79972f759322fb941a0cdecf3de38dcb8b678c2d506fe88c6466e7278e42bff856b81c
SSDEEP 12288:hbDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:hbek9NjZHV3svjv/A1h
TLSH
T10A4523C8B65E01CACB636BF42D69D645D4603D6EA4C33697A37AFF1052B41B8610B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 68d935ef4e45e9b9772eafe49e53cb9dd5b6d2e15d32454dd2174a1d541048fb
MD5 7c2a5235f02452677692e7840e696ccb
SHA1 db599e790884ab4f3ee355a9f5cd162b5aa9aba8
SHA512 117f3cd06f6a485fb2b445d72e58f3acc59a9d42546d1f8d9be70cdd4ee7c37bd3c2be0eeacc1be1af3ea2845208fe5d4414c314e52f03ef11e9805d15ca04af
SSDEEP 12288:xJDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:xJek9NjZHV3svjv/A1h
TLSH
T1344523C8A65F01CACB636BF42D29D641D4603D6EA4C73697A77BFF1052B41B8620B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ccf7951043a02a0df96fa2fe0d2d1ca3ca4d50a4b3e40d4d9bb315d95eb9d392
MD5 8e8cef50f42518da646da3c7c6db90fe
SHA1 b302b74d1aa2e8ac1d1161f6b1688d361957e9c3
SHA512 f6fdc98c9ad93f7b3fb55c3d852a80907c94f53d48db5411f9b7ce4384bb4d1b6d7b87a1b5e97ceaef7676ffe80976a4b6d4b4a8abe0194cac177b31e99be385
SSDEEP 12288:UVGDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:lek9NjZHV3svjv/A1h
TLSH
T1C54523C9779E00C6CA63EBB45D7AC641D1B17CA9A693379FA3267F000AB02F46516373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d59a2c64eb65cca7b53ff29cefbf4ff15d996ab563ca8a14bd08cad127c14609
MD5 f93dababc3adeefe00a0eaab920ec6fd
SHA1 0651377c4d44f64c284e6ea937d7e9c519887920
SHA512 fa566b25ab54b639d4304a438a20ecd43ae7ac89acfd805d6ec32e2961a7ad856acf5610b3f46d7c9ff4de18c0f733d15689548bb7a1fc1e188f7dd3f13b1260
SSDEEP 12288:+uDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:+uek9NjZHV3svjv/A1h
TLSH
T1004523C8A65E01CACB636BF42D69D645D4603D6EA4C33697A37BFF1052B41B8620B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b4ebfa084c24a27d62e1d5500da50e4dfde057bc0f0252e17fc755bf28a72944
MD5 22e0870a9b0af23a243fa92b0dc94fab
SHA1 c9421761a9d2e45ee0d032067d8834582d375099
SHA512 2873eac915372fe6bffdef23197d03eff94088d0570552ce4f0025600c719ec235a450488e5aaf194334b51aa0cab3842e3cb8f3ab9d08e776716a61c87b66c3
SSDEEP 12288:r3DC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:r3ek9NjZHV3svjv/A1h
TLSH
T1774523C8B65E01CACB636BF42D69D645D4603D6EA4C33697A37BFF1052B41B8620A1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bc23b4846b53fd92f3be497f72f66e82d3e58dafc119e094386cf0bc1cb90eab
MD5 5fb48059cfaf8e4d226f20f74cc22e8b
SHA1 802dfa162b19361c5b6b1e8be3a09d2cb860fa00
SHA512 4448945791efa5ea41146df5a190e1034265ebdb9444a055b100c3b8528b5180a3bccd31668082947229873c271389dd7e7c1f54c565ef1becce14d92fc1b43b
SSDEEP 12288:3jDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:3jek9NjZHV3svjv/A1h
TLSH
T1C14523C8AA5E01CACB636BF42D29D645D4603D6EA4C73697B37BFF1052B41B8710A1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5c6ee289a8cad6b589769537d64aad176c1afc791b2fa129198f6183e91c4a15
MD5 0b6c9f13b3b0c21e01e6ae198f04ff20
SHA1 9bbfb12dd4f7363d911109bc6cf28b0f09b937e2
SHA512 9977bd09bd7a0c4c75ba36c014c97617a32f0569b7fe84db0091d2e7733060104d802176197e38304f06c96d722cee9000e579f5c204a3d80aa57db1e89c47d1
SSDEEP 12288:HiZwbVzzFEoS2cPvy7DC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:CZMRzFVSO7ek9NjZHV3svjv/A1h
TLSH
T16B650295B39018F8DD63827ECD258906D6B27C5A07A0C61F13B837265F733B11D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 61f418fd41782202e69a87e4709d393862e70d52eeb858f09e43bed4790288a0
MD5 37eb67396ff65442c9011781e53d86e7
SHA1 9aa2c454c9c6e6ebe33c21c0179b7c3a18aed59f
SHA512 a298bee04ca5f24481ce1c21720979598eee86236e40f25d488a8378fe525794ccd32914146ec3835cbd2c9bd7cb6a52486a92db02df55bb92a4e435f6aafcbb
SSDEEP 12288:QcDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Qcek9NjZHV3svjv/A1h
TLSH
T1EF4523C9A65E01CACB636BF42D29D645D4603D6EA4C33697A37FFF1052B41B8620B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 dc0773d04d46f120a0b0387f2808cf632a35237a4c3ef9a0042b9e083f9bc571
MD5 af1a33ca349d66e0f3daa7ed3ebd6386
SHA1 46273df1550e27a14197f9592c4e28c5b0e71a52
SHA512 91658ed590410cf8752aaa73fcd64a308379b7a8c7a590e0a675e924bca2c010ddf1d840723ec327bb34dec9957e6d8c14733257e9e51cdb79bd719be87c6e74
SSDEEP 12288:pADC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:pAek9NjZHV3svjv/A1h
TLSH
T1DC4523C9B65E01CACB636BF42D69D645D4603D6EA4C33697A33FFF1052B41B8620A1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4b51726c6dc4e7e5e498aa9ff1577fc15b1601eac10196c66f937fafca3504a5
MD5 c0015d40663b6f489986c4dc6eb2bc49
SHA1 f1021067df73f0f7a6c25b979ce7b0dff6c964f0
SHA512 84f16b03ae6c0cad30345ee3a67988ba1ca5991ca3c3ab5dcd2d607f1f0b421355cd6a2b4c3a570a38d94cd7bbc00df1914a8f4d08ba55fd25eec6251b4c0c77
SSDEEP 12288:2yPz5L8vDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Lzyvek9NjZHV3svjv/A1h
TLSH
T1B055024B73A620E9C17392788C625A02F3717C3647615AAF53745B722F372F0AE2A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 410de4eaed053dc33e90ddb778f85f7db945a94ca79189c3112c5ec836865839
MD5 84bb84c24c63b7591fa94edafe881b23
SHA1 4b4c8d6e3914da74185ba3a9018adbbceec59043
SHA512 1d58951f3a115efeb318927d2ffdbbfb0ed6beda0bc3163b319e3dce4f202f67e6057743eae03c9f69d604d37dfd3e15a0e6ec307f142c9c18f046bab07132b5
SSDEEP 12288:WcDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Wcek9NjZHV3svjv/A1h
TLSH
T17F4523C9A65E01CACB636BF42D29D645D4603D6EA4C33697A37FFF1052B41B8620B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ed573b246dd51fb4462ad03c657ec874bab04ff21304049ff1d57910cf527405
MD5 d5f83ad806dd6b6fbbcff03b3398ce85
SHA1 c056b813965fe95c0e63208bfbb2eca206f4722e
SHA512 23e85af9995f505b34955f95eb1ae33d378354e5a2b967e327576b960dadd28af643766a4dbc35b75513235d2daaa8f53e884397c380b5729a283ab03657f8a9
SSDEEP 12288:9cDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:9cek9NjZHV3svjv/A1h
TLSH
T1BE4523C9B65E01CACB636BF42D29D645D4603D6EA4C33697A37BFF1052B41B8610B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c01a8fa86f036593e179df8c7bad651ca69170aa6303776a860dcb0302d6c6a0
MD5 cd58f20a79a9162395b18dc544c2b921
SHA1 24a59d93443d5c340606722db6a2744e124cd760
SHA512 c35ddeef66a822b66eec7395dd273fdf5e1c457efdbd2481f011ada51c713ca8473690e22dba376236b8a62f8445cef7bc174368277b65403ca8f8cfa4248167
SSDEEP 12288:wyPz5L8vDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Bzyvek9NjZHV3svjv/A1h
TLSH
T1AD55024B73A620E9C17392788C625A02F3717C3647615AAF53745B722F372F0AE2A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 63a109e18a45bbf71d5fc4ade362b78252fae1b4fd4f5f72f44f2220a91151d5
MD5 4462f6f20980f7dae4e8472d54f5eb63
SHA1 93ca5453a86361997b773ee8e5101698cef4f021
SHA512 e15853de83c305f75b9e1894668cc46a18e1e162357002ec004c03fd1b823986199bd06b6f4662ec7501e563b603c59ca5ed9051ddc7e0e7a7ad7d9e401fbe38
SSDEEP 12288:mCd9CWYoaLHF3z0z04PDvh5DC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwanh:nTDaLl3z0zD5ek9NjZHV3svjv/A1h
TLSH
T1D7650294B39018F8DD63867ECD258906D2B27C5A07A0C61F13B837665F333B01D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3f5dd4ce066cff962520ed1708fca89f6edb97d59f5f6b2b7f78ff959e7a08df
MD5 d0d348984e7b3e81277fdf0a71dfe896
SHA1 af9fc355125347395f1d8d4ff46c6b972168d894
SHA512 9fd1b6e66f6b8dcf4b49adcf4daf178b0118c656c2228faa0d4138f56af5b166a2f84b3ba7fa33e69d5fc863379fb53178cb9cdf93893fe9655bd00b8ac64673
SSDEEP 12288:0i4e7KRdTfgwCHKy7GLbbdIv6DC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwg:03vd9CHKy7GZlek9NjZHV3svjv/A1h
TLSH
T1C275CF90F3E410E8F1B39A358D768511DAB67C5A1B61DE8F03A4661A1F336E18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 10be675de411bbeb541980e6fa5422e517f91bf0919376ea89ba8dbb12da9690
MD5 13a803ba26e7bb4afe9b4df0edce80ea
SHA1 764c3a8b99c8144eb37f71ec3be51a200abdb33d
SHA512 84b88648315f1153cc853afa886b3da952a3a5042046bafd2f79dd8891ab01c4e481cf65d5bef39168509dc6ecd6df2a1834b63da7356a5f146fa9cfcca15b05
SSDEEP 12288:MpDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Mpek9NjZHV3svjv/A1h
TLSH
T1B64523C8A65F01CACB636BF42D29D645D4603D6EA4C73697A37BFF1052B41B8620B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 610ecd704eba59829629ad5043181fd19c045073f9ca07cb92b47e4657b817a0
MD5 545fe90dfb30567eed302570fe9acdde
SHA1 1b7089bd7439f6638ed641ed5426bc61e6e83f44
SHA512 18a2102a1f36a5503c11657aca8f664877cfd95c6d6ea8d5d4266540b5c0e20d9ef9aa0a9741dc50c3366d9aa8428eacfc42f184afed660464cf8c2719f3027c
SSDEEP 12288:+PDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:+Pek9NjZHV3svjv/A1h
TLSH
T1C24523C8A75E01CACB636BF42D6AD641D5603D6EA4C33697B37BFF1052B81B861061B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 35d69c26a654dade968de5ffc20d0607fa7f18cdaf5f4c1268974cf2f9d6e406
MD5 5eb0e1bae89ccbfe039d33cbf53e3fc1
SHA1 2392e26b3ed264cd8893c0b51ca6f02db7a00f89
SHA512 b95644922291499969487c8ee277a7af3c36498c6af9707dd27a1921a30beae5fdecd72bb20760615f9a158964c4d94707c0c30f52d572b1bcbb304add654991
SSDEEP 12288:G6DC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:G6ek9NjZHV3svjv/A1h
TLSH
T1A04523C9B65E01CACB636BF42D29D645D4A03D6EA4C33697B37BFF1052B41B8610A1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cae1fe0892a5dff2a61c1af2540c292309a295c1f9f0d1f8b89c88c4d597cb32
MD5 19859b03fef8ed25351c0b284a688797
SHA1 7e05f8e60aee8ec7d1e6eb751f5a3db4deb0030a
SHA512 397a738da44513fa9b6b627116096d08610eb443428d7fea2331d05c1ccada4762ce48082f2d603a25621d994bf3e06fe92338f621b7653e9f9cd3b39297a593
SSDEEP 12288:CcDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Ccek9NjZHV3svjv/A1h
TLSH
T12C4523C9B65E01CACB636BF42D29D645D4A03D6EA4C33697A37FFF1052B41B8610A1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7481cd17800a8d3b94907ce614a5ce795cecf10e610c9e60f0eefe369e93eb71
MD5 411d61352086304d15fc8152104b98a6
SHA1 c28d95ff0ed31314fb2847e1e8e9bb96c0f91e6f
SHA512 4cc54261a1864e9ab610875927f7b1f3840899de77d4c4d0242032ab45e458d7a2952d2899b6cb904d13ee4c0a2aaba9666334e9618200200b6c465893e362eb
SSDEEP 12288:IpDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Ipek9NjZHV3svjv/A1h
TLSH
T1514523C8B65E01CACB636BF42D29D645D4A03D6EA4C33697A77BFF1052B41B8610B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 90a318f48fd00fc9d4b4d8d11b63ab740ad1e8d9a3149482b754a5f3e525d7cb
MD5 e94bdcdbff1dc54a1de34690db2d9a80
SHA1 db86a80a5f718ea05cb559dcf58c852ac8b5cbb6
SHA512 f0bcd6ee65eb6e30862aae412c05c5a5b61079e6359742a189c334a3fb8de653a8ca0cb1f84dfa076cf011bf874d95b0f0046290ad97db8fd9da7c1558639e35
SSDEEP 12288:XEDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:XEek9NjZHV3svjv/A1h
TLSH
T1944523C8BA5E01CACB636BF42D69D641D4A03D6EA4C73697A37BFF1052B41B8610B173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b9e56ee0f5ebdd8ebd30330df6ff8cd4b87668e0cc4a8e2a7734c38afc657a11
MD5 ab5258e1e6098d82b90d5b80154f990a
SHA1 62f39d4f5199bb48fa571f8601ec664e1dcd0ccf
SHA512 1c561a7b128c5460704752ddc3620fbd657997a8ff073c881f16e20cc0a13c4e8e68b02ed4c86c97e52579d32e3837080747d9748c396ed1a4f31b73be3e1e9e
SSDEEP 12288:6uDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:6uek9NjZHV3svjv/A1h
TLSH
T1784523C8B65E01CACB636BF42D29D645D4603D6EA4C73697A37BFF1052B41B8620B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f540dd943eda6d42d963568baf73aff8387c5c159106c9df76905936860aa147
MD5 7bc52d3c565f59c8d888f7137ca6e0a8
SHA1 f60d67f7bd7dc37ab17d55f61f682f68aa8fbba2
SHA512 60c8cb430d8897a90ab244182d5e006d2fc23777ef5ddabd9d4d982b7db3acdd4f25ba06fc07f7c4052eb387c2bc7b6c2629388230d11e586c41fdca0c314a9d
SSDEEP 12288:LhDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:Lhek9NjZHV3svjv/A1h
TLSH
T12E4523C8BA5E01CACB636BF42D69D641D4A03D6EA4C73697A37BFF1052B41B8610B173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 a09a5df590817ae20a0a597dd97bde5118672d9ff8b446a4258bbe98f8c44902
MD5 bcd501d8b1ad359dee56b787fd2f1bc7
SHA1 5c24c1ca54c7da863054a9b556aa713cceba00b9
SHA512 8a05c2a93af550e5e94a10bdb079e6fe7e6c5f0b259c93cc9c1e7862f379dfa0046774eb14ac19ec169bb94ea3e6e9aa06f6ffae90b3d17acc22413957c67c36
SSDEEP 12288:5uDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:5uek9NjZHV3svjv/A1h
TLSH
T1154523C8B65E01CACB636BF42D29D645D4603D6EA4C73697A37BFF1052B41B8620B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c4382e295880abaf7bfcfbac3ebfd850b03c2f925cae4cb48f27e19adc22f746
MD5 a5641495597c173332709b82f52d1860
SHA1 cfe7ca6908d361da3e01191266fa7c33bbb0d07d
SHA512 a37872b7c044f2928eb97b5712c1523f8671fca493e2fc0c979c3d9fd571c33b429f087fe1a41db94d6300e19e88bbde7ced117d1a9d91d4b2b9b66aadd94d54
SSDEEP 24576:MfwvUk9RX6wkyAIQek9NjZHV3svjv/A1h:oMnYIQek9RZ18vjvI1
TLSH
T18C85DF29EBDC04D5E1B7923C99B7460AF2B178691B31C2CF025A536D0E37EE46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 783a761166929d6a3bc0be128cdcd8a91ca90588a5b184c7e85bfd8f8acdc978
MD5 9035eefe7adaf03a0fdeb695b474e735
SHA1 c9c6f751bb741b6875e39c8413da4dde6e59347d
SHA512 8f57180fcaa577d5c6da0d6fa0b4c0d8964e2722c06368b69617975b886627037f82a2bbfb940ef73686ac5c9f9b2235e2cf8ea5f81f3de99e84c58073f562a3
SSDEEP 49152:kYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tek9RZ18vjvI1:TySzPck9r18rI
TLSH
T152066C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e95b201387c43bd067ace89c42d4293c315c1b93281fe5e929f6089db57164f7
MD5 767129b09ab8d100d831861dff3bb0d3
SHA1 ba1fee1283bee2318468cced5c7b751f25567403
SHA512 92cfcc66e6e94ac0c38f922615c193ffa398f85c71baf4a02d3d2faf6bb48b9b83e74b9942283f739277b52f626e278dec4944b2db969ba10262d196a519968c
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYLek9NjZHV3svjv/A1h:U47JUQjTirIhCnDHUPfF/9ek9RZ18vjo
TLSH
T15365AE1DA3EC01D5E1BA927885158A1AEA71782E1F31DACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6492f1a2edbe02a83204780acfdbd4d62122ffb43ad39d9f788b77af09e59f0d
MD5 cda29008da1c48450c02f5417581b03b
SHA1 415e8a4dc6b42716905b55e490edc6ca40ffa8b3
SHA512 bec004ecc3d5adb80765250a7487c0f0d6dbf834e663744c30de0b54a07854d2fb75431adb57106eddd33174bb35572b4c0e675387f125c699c0d778e3c3c9ca
SSDEEP 12288:6bsfMDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:RMek9NjZHV3svjv/A1h
TLSH
T12455F149D29802D8C16E6275CB568A41F3733C2593E2A3CB53E0FA3D1F752A05DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c7c66145d25121df70d548c3cf9695191aa930f74c26fdddb20373d44c1ac020
MD5 8105a12519da2b36832a7e6c45fe1cc8
SHA1 e0f00c9581544e585b55ade02708b03ad753f840
SHA512 dcb98a292737a63474ba692f951ba6010c0188f151c5f0d9a6376507b1f82181ed5a2dd28b98fba8406930ce727ed4a34abfbdfdaed4485932eef0863b19f2ca
SSDEEP 12288:yB+YzKDU3flCBu/QymCb+pYU2Rk6ZMBQ5W8W+ii6:yBzzsUPlkuQ7toMBQ5/W+3
TLSH
T1FF352841762BD75FC6A940321E72D2CCA7707D41EE05AB0773C8873F8576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 caa1fa4fcd852987138f28f359dc13e2c45b920771fa840e5bb8ab5f62ae00dd
MD5 e3458beb3b05bc4d2853a50fbfbe0d1f
SHA1 e2ddfbe3c69791f211d482a11cbb61300d58dd71
SHA512 2d28233d0d4a6313ccc23d84ce8029c22c4da1aa4da1c7b3a22e1a89238c85b160ba0d531535f3fe185c2bd5809c7a4eec977ea2b55d300b81bc57fdb1359b8d
SSDEEP 6144:U9BQTwLMeRl/oaFb+pYw/E/A/P/fZcmeTIacKfC3tMxnMBz4jfVJj2qDWhc70C3A:U9BQEImb+pYw/E/A/P/fZcToBceOu8ad
TLSH
T19165EA815137A3CFD1F76032076A5F4CA7A4EC16B7056F26B3C8453AD86AB21B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a863a26bc06bafb384e1a5b9bd6d9e8186ab9cc6fb21640e1aec85b6526ee933
MD5 b467d769d2bee10e841a59da88130f2b
SHA1 c35152f5788fc619b12e234bf5e21157bce0941a
SHA512 baa63f83cebc6a58d2f34d9f711f1e55a956cd249063c0095886e3d46b42393ace6d9bbfc14750716ef04c026677a42af0f6cc37c439c469382e0e8831f513ce
SSDEEP 12288:G070DC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:/0ek9NjZHV3svjv/A1h
TLSH
T18A4523C4A79E008ADA736BF42C2EC611E5217D6D5BC236D7F23ABB5051B41F46E26233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 579b33f6664868909d94e32e14084636fb9a42355aeeffd99f8f8015d0336e7a
MD5 3dafdf589951d3b9a7f43351242d9ded
SHA1 99512f60b6a2da1f693ff38b22d00fbbc5e5d608
SHA512 bfccfc6787d73cce867380ae70bf9b01e043f68abeb14544c032f2f39adbc9cc1630db246d15ac7f0c33ee8f029664a36b510f6b53a72dd0321ddd94967f0189
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYSek9NjZHV3svjv/A1h:cgb4mBIBhGFLek9RZ18vjvI1
TLSH
T1E665AF1E22EC02F5E1F6E2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8ee7d62d8535800946140fd59cd134c71c9d8cb9c127d3ccb1615008c8be9424
MD5 7688dc909cc3c7854378d2c44978fa18
SHA1 98c9aec40a9cd84de6e4e52576c40966e53a4bc4
SHA512 d279f7d9178946d827749b1ea42fd91f0e9659b138d1730a18efb87795554c90a0d8958849fd2fcd44f8d780b73913fde1d795a749d1c975f55f3af88ceb8a1d
SSDEEP 24576:AG88u8FpJqH1bzria7/m7ek9NjZHV3svjv/A1h:T7ZFPqVea7/aek9RZ18vjvI1
TLSH
T1BA85F16577E501F1D477E1388A868663F6B2B8250364EBDF07A88B511F336E44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4f955024e10064eeffa033e45c8787bc0adec24cb792a0c6d1ea0b284ed6d9c9
MD5 29c7d96c34274bdc4bbd35ab521d8231
SHA1 341a6d96413ad3a35b1eee2abd93a89bdc66611e
SHA512 0e55e0e1cf975cce3cd147dc1449f41a486a214893513170e3b1ac4cf6f5c463336189b829ab80a9618f15972309423d1360ad95d3f0172c3398a210f55eedd0
SSDEEP 12288:IHvUrBFrEjwaQHDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZwan3x:IPUr+NQHek9NjZHV3svjv/A1h
TLSH
T1D065F15F22AD18D5E676E17C89468709F77178620312A2CF02E1817E4F779E8BD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 79194b9c9d387eeb87198436299f16d8241e5d7c31ec089dd05b5529f88fc6bb
MD5 a6cf4202e51cd52a2fc2169bb54fa766
SHA1 27b214e61f4b4f0b965337458224b76b8667892d
SHA512 7a8a2a4b3e7ae5374f65b1888191dff14db6d0b5887807427da1543937aef85bf570997b57d51435760af490ace613f74bec4369fa51994a7462d4dd858d3ab2
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3ek9RZ18vjvI1:0G05lO43bbk9r18rI
TLSH
T196D5CF6E62EC01F9D1BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 daecddc8775610d0bc3a848bf54a85a5d7a3535f95486d1a9638bb0b2f021b6e
MD5 b3d2b9d20c0d4620aca9ac776b128cef
SHA1 c57291573d49643264cb6f0c7b2adfc0a34084d3
SHA512 aa1a3e9f294954db3ae922c706f2c2c7b6c32d64498e407fbeaca7ff9008fd2f4d0c0870b4aafca06b08711c87c46abf21738eb1ce83c5cfa54b3eee6111fe2b
SSDEEP 24576:Vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidntek9NjZHV3svjv/A1h:1a5POZ3BJt2pasx2+mPek9RZ18vjvI1
TLSH
T18665AF5EA6FC01D5D579D17CC583861AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7a7bd7bf1e94c2e66ef540160e55cb31c07be6d6928e39f6b3feefb0ecda7d95
MD5 546799b65e6ef489657e2a1177e03e45
SHA1 516d133d9dc58958d5108263a008166bad80ed44
SHA512 65709dad74339bfad871ee5d89f68918f1f53e8cdbaacd068db6612bd009c41aa21435f12e0ee5579d8a51cb58ad743a400443579a0b1fc39049ecd2627d412c
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkTek9NjZHV3svjv/A1h:MNc/zEOVHF6ek9RZ18vjvI1
TLSH
T14B858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 95699f5caef2e935d105e9ad91240d7920b23ea017f1464fb29453ff624c78c3
MD5 2b93ed7c1574626b5332a118dd5e14b5
SHA1 2effcec90637083030e5fd6aa1b776314a884e6a
SHA512 04500a63723dbbaa32e400527a43727cbc5aab707280d89882688ed8ff661a259e5aad86e1f89fe13b595e244ca7e3f1642eb9018bad1ecbb2b1841f6414bacc
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmhek9NjZHV3svjv/A1h:wTMwBtOmhek9RZ18vjvI1
TLSH
T14155AF6EB7F806E4D1FAC6B48D238512E6727861173253CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 018b772e9dde8dc4b3cf6f5f50fa1a6d38147086cdd6d34bf6567e91502dd0fd
MD5 d0684d3b9c50da056a73f501b8f5a00e
SHA1 82ea796a0e48ca96035ce1be2f1537b0da43ec9f
SHA512 fdc7ffaa9c374c284f77c382a07ce38d01eff2d0db3949676bf23e72b365d0f2b56d213187bfcc38221667f03f456bd20f41a00597b131e8c16c08d8653b3d25
SSDEEP 12288:wQcMxWDXN1Dp/fshBItT1IQgAIDC9yHdVPjOBKmA11gMHHp33ItUQPvCWhN/xYZX:iD3FHshBIYQgAIek9NjZHV3svjv/A1h
TLSH
T15B75E17DE79C00D4D57BD2BC9A638A06E77138A9032266CB0294D1B51F7BEE47D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-72-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/404-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/404-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/404-275-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1048-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1048-299-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1492-373-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1492-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1492-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1492-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2732-384-0x000001BB973F0000-0x000001BB9767B000-memory.dmp

Download

memory/2732-403-0x000001BB973F0000-0x000001BB9767B000-memory.dmp

Download

memory/2836-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2836-119-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2836-372-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2836-125-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3192-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3192-369-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3192-371-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3192-112-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3192-106-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3220-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3220-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3220-174-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3220-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3340-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3340-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3340-130-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3340-141-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3340-136-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3884-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3884-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3884-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3884-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4304-385-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4304-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4304-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4304-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4304-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4304-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4328-27-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4328-35-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4328-48-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4328-45-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4328-29-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4588-0-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4588-304-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4588-2-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4588-91-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4588-8-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4588-7-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4588-301-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4976-57-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4976-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4976-61-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4976-51-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4976-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5400-78-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5400-284-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5400-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5400-84-0x00000000006B0000-0x0000000000710000-memory.dmp

Download