39b1cd1670d1b925ed9e772c6c13794ab221f3748fd9f637a5b6ecb6cc3c0212

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 2.7MB
Sample260925-srwtqa1w9n
SHA256 39b1cd1670d1b925ed9e772c6c13794ab221f3748fd9f637a5b6ecb6cc3c0212
MD5 0ad5af329f1a38eefeed96e1bda9c6eb
SHA1 3bf321a7d770c069a13d8051db73f9ce295553ca
SHA512 33590e7de7bc0a7e9494aa142117ef89a618439a05628df5ae105d8ee660abc0344cb96e0429ffdcaf30c0885fe2b7c55ce221ca1b6398a182d17d3f65cefbc7
SSDEEP 49152:U3K8+5FtFpJzflDNiyH80ytwIW2qqU4rRMBs3KuZhutwKQ7P6Q+02djecpBFzLFO:lnPflW0ytwZ2qP4rRMBs3KuZhutwKQ7O
TLSH
T152D5BE06A6A801E8D0A7C178C91A5657E7B13C8517309BDF12D07A776F73AE21EFE720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2948	elevation_service.exe
1912	elevation_service.exe
4108	maintenanceservice.exe
3316	OSE.EXE
792	PerceptionSimulationService.exe
3428	perfhost.exe
4152	ReFsDedupSvc.exe
5960	SensorDataService.exe
1304	ssh-agent.exe
2960	AgentService.exe
2432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b9d48ecd3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000612978ab014ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd5cd3ec014ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c967daa014ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e1db1ec014ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000691a6ac014ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007af90ced014ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
1912	elevation_service.exe
1912	elevation_service.exe
1912	elevation_service.exe
1912	elevation_service.exe
1912	elevation_service.exe
1912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1524	2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2960	AgentService.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: 33	2432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeDebugPrivilege	2948	elevation_service.exe
Token: SeDebugPrivilege	1912	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 5044	2432	SearchIndexer.exe	99
PID 2432 wrote to memory of 5268	2432	SearchIndexer.exe	100
PID 2432 wrote to memory of 2636	2432	SearchIndexer.exe	101
PID 2432 wrote to memory of 5828	2432	SearchIndexer.exe	102
PID 2432 wrote to memory of 1940	2432	SearchIndexer.exe	104
PID 2432 wrote to memory of 1660	2432	SearchIndexer.exe	105
PID 2432 wrote to memory of 4616	2432	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_0ad5af329f1a38eefeed96e1bda9c6eb_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1304

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a0944b167f4644d1ad5f94666b8b82a0b2db9e65ff875db58484c5cfbc0e8ce
MD5 21ec26d4d80c07e57cebe01b0e6d7ef3
SHA1 6f62413f695a319a02a034fa2848c6ed06fb2daf
SHA512 df64f82d49c01b3be83ce9848fdd096664436a006087e71c79751b4e093db8381709206349fa96a4253e115a4d5786d885ed009783663b52a243fa2a8e08e9d5
SSDEEP 49152:3b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6NoKRaxC3YhweoMLa:l3q6mjBhxRaxC3Y1oe
TLSH
T14AD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 83699ac1860a4baced86a602f63a6e86fd66e9f4ec4448099a12093123c2d738
MD5 2a77ba7342fe36d0f6e08cc287bde146
SHA1 fcc7bcd507d4e96d25e8ed74c2e0658cebac9985
SHA512 47978fc6f49511de351f97b806ede249de190394d2371fdab5ea62483606f9aaf290797fea0b4124b36cd9d325c8198f65ac2c8d1d681e0081d65c5753972876
SSDEEP 24576:fXYfDtczAdNou5MEdf/RavguX1c3UrxhVmerUZyLeh:qtcYNoKRaxC3YhweoMLa
TLSH
T1FC05022867D409F8ECAB823CC9A28511E733789147A0E79B03E496765F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a1ac8f4c12c9ed0a8fe12b9bec00d12c65854e6e7e6dc22917bf2636bfa988e6
MD5 72940e15a97eecca7a7137eb31ebcadd
SHA1 0cd7dba5e5743994ead0b295d2dbae70cfaebfb7
SHA512 ac949c6557eccfd31c7bf822c8269fd93bb678f4be70ce4a3f86a3e568f2eac4ae534c9f23aaee1cb45ce81c794ac886db2628cf70201dbf7f0b7630cd70ae85
SSDEEP 24576:o0Le5ji0hmxhrMiNou5MEdf/RavguX1c3UrxhVmerUZyLeh:oPji0AzfNoKRaxC3YhweoMLa
TLSH
T1C4359E16F6748335D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9eaf0b25f26ee7875fd0004bc018c19666b98d53f20e458bfb046725cbd1c09f
MD5 cdd95cd1370c57679ecd4c121313ba9c
SHA1 2548b74d1e3b7774af5ed528baef5ccc09ef04bd
SHA512 a9a71ab790a3a44e33c8231d495c1b67da4a33f2916a2bc43f0448d179718cb1eb639eb4ed7b3a286589567b1d9691a68fe57d36e1f7b66b0a33d0abc3a47cb0
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWj6q8wyuoNou5MEdf/RavguX1c3UrxhVmerUZyLeh:3/ezSC6vUzPv+HjyrNoKRaxC3YhweoMW
TLSH
T1BA756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 88e775b40b5784623f7be1491740c46324345347b9d7bbceb4da2486c83cbeae
MD5 bdaf561ff80461a6aae4182408fd843f
SHA1 d412fb5f224223c392c9aa02bcd6f5119c221047
SHA512 eb5f38b19c2c2b8947cfa33cf445f13b95fcc6ae43a9a427e44f131885619e8e956c3363125f676e6333e4d295df040a124284b07d14657e5c83526d8cb848fb
SSDEEP 24576:oVbqPb88hv/l+BxNou5MEdf/RavguX1c3UrxhVmerUZyLeh:oVO88hXl+/NoKRaxC3YhweoMLa
TLSH
T136559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cf0add2528a3d69967ebc95840ebc897dd2b35101230e3d6583d054c94977452
MD5 dc97e36e62b4dd41a8a0ae399275e175
SHA1 68b469857dc6e1d432749c2d43001cf1b9038669
SHA512 b61051f544e44bb00592c0659c0590718499d324bca7b0cc3b99b56a4fd8d7542f650ea0953308743911a6beca687b798c2e5faa363a1421f81890e5a6c80bd1
SSDEEP 12288:LG2jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:LG2Nou5MEdf/RavguX1c3UrxhVmerUZT
TLSH
T1DCC42306891D0684E3ED1335B79B18E5E3644DF5EBC01637AB8073EBDA34A79C92B163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9fe9531db9e2a55ffae4f9e964c9870109721602e8d822e227cc7cc2383b77fb
MD5 6fac21b37fafcca874e69d2f3d1cef79
SHA1 3a4e93e0474e01e36df7f02d92302e258d13354b
SHA512 f82b976b32319c8a09efec1233170e45791b1f423f1a0c49cd50c328a09a53a44ac7b91a202b84c1fdade6bbaa8c69977b837711943b027241d970f38f35eb09
SSDEEP 24576:TJIUZNou5MEdf/RavguX1c3UrxhVmerUZyLeh:TJIUZNoKRaxC3YhweoMLa
TLSH
T14705CF3BEE28ECD2C27E8D785B918640E77278704B51A3CBD165830EDE235E55E3AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b1504e54a8a499374a0798a05b781135904b8e43f84cfac3c41adbaf748aefb4
MD5 ec70be8f24109b7f5d8668106b186496
SHA1 0d397a61834b4040573be99cb0fe30b1662fc194
SHA512 8501916ceedb4d3f5b4cd3066aba7a9f1cdadcbf7f5f6f7c3ceaba1bfec7419b2d323401cdd80adea893aa8335246c529721d4d8f243a643b24082a3fb6f470b
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THJ:kQvGAdlCEL8c/WRNw5C4xRaxC3Y1oe
TLSH
T13E266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 dbcf6acbb4c2f80315e487c2fd1935644f41114824878d514305820a4184edc4
MD5 8e3eca0fc22669f54460433e81619a6b
SHA1 8609fbd01357cc3145b3b29821988b5d1df7a8d4
SHA512 ff87624a7fb49bf292e663f96089211554b5500fd146c2f68fe24866be2a505721ac824be848f5dcbaaa53e808d2d23b649cf1743690a43986f05bb93b662aab
SSDEEP 24576:zfewsAjvNou5MEdf/RavguX1c3UrxhVmerUZyLeh:DljvNoKRaxC3YhweoMLa
TLSH
T1AA15E031FE74E436C3BF0DB61B26C716547C79604B911AC3E3E89A9E99302D22736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1a0d0459ea82e21f5fb18dd34a5b1913649c350e35d1949ce09bf2258512ae52
MD5 818ec2cabfd0898d780982e5a3f104bc
SHA1 db49557d4228d2dba1767ed1f5f087bee2b72ad2
SHA512 ae511dc26bace32a7ce0fbc9beac2ca5a2f67af1b990a3aa11729d6328961946723b4f7ea3679960e4ede17a1bc6ae5712ad70b5575f900bd45f7ef0a76c0842
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHDP3Y1o:zUEtQevvqc2W1cpV20I32Dw
TLSH
T12A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f72882a2e76cc7fe6ed90e5e75f5f526d4b33d40d795d9c938e33f2e2173e71
MD5 47a94116cbfbff0c12dcd6a270596fc2
SHA1 cd9311232ec0278c79081b6c3034032a95e7a81a
SHA512 3d51d86ec85c97dfa734ee46e5bb21afc42314e14a76c6392cae38d9bbcb07d26fa5c081b79164517b702848be319d31ecd34ceb11573aede189712a66dab87a
SSDEEP 49152:lCbRquA/m2yL5zTfFiV+XenmE3/zPNoKRaxC3YhweoMLa:yoquVjnmUxRaxC3Y1oe
TLSH
T1A8D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 55090d45fa9ec94bde344f4f22c37feaf4dea7e03b51850842454fbf82cb8648
MD5 33f32b56ecf85e688336ed0e4d7b738d
SHA1 67094a8240951141ca1f893a67c552bfc1937e3f
SHA512 c39a3576ae9e51736a0710595b24636bd10702a1bdf86a08b410c577a4a2876821e5d0ac50d54995b60f64877691b147e3931c2c6dd46f37dde756eecd73a0df
SSDEEP 24576:dAhGL6IFoiwtA5l7S53YNou5MEdf/RavguX1c3UrxhVmerUZyLeh:dAM5Foiq5INoKRaxC3YhweoMLa
TLSH
T144359D81EBF945D4F5F3AA7899B69171EA76BCA65E30C20F2150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 de83f133dfb864032e97502ad9a5385dfd72689c5ef151b44a654317f00ef38d
MD5 1ac7e592df5d8548faf3be6c8c439c4c
SHA1 5effa610d067947c9e49ee02445abfa9f3f54ad7
SHA512 15bade31885dbd83018d968258436b9fc98f4b4de1fb20a5c0bf71a5721ddff407fde439cd0dce4476ad007cde3b2cef35092687fc8887803d4de699ad5117d9
SSDEEP 24576:PwuROWLNou5MEdf/RavguX1c3UrxhVmerUZyLeh:PwSOwNoKRaxC3YhweoMLa
TLSH
T18505F10676A80CF8E9A74238C6978536F7B2BC522A21D71F1760C75B5F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fd7b17df3587ea85b4ea0bd70d1697d1076e4e43b4a6f5fb5e13b08db8eb4c93
MD5 f87dd547da3c9d59ae0d3e3184506329
SHA1 19a6a5c6c367a3b4b7d1e83b46468e3d9add771a
SHA512 c1e075684a24c9009ab1d0e4ffff36945e651f976efb639e58353f6255eb049688c20519acda37884e86f90e450cad843cee8cd93bb20a64ef1bfcdf146ac816
SSDEEP 12288:TyZ1IyDjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:+ZueNou5MEdf/RavguX1c3UrxhVmerU1
TLSH
T194E4120A26A821F8E1EB533CDAE61545E37178A2677143CF165053AA5F33EE64D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e0fc43ba1605bea63ee27f86c9d8f46522ec14fa8cc7748b15aa44d3c55da434
MD5 843458d6d425b27b455685d54b2ac507
SHA1 6be2a5f1352707164434690691d0c81854617e71
SHA512 4250efb52ab934708c3efd5f2d071842080d73caaf49987ea548285ad019dbc8e5a11cd2d63695a4798c8c8d6d186803c422d866bcbbde63db1e26f819942ae0
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3ZxRaxC3Y1oe:oQyiKanX+PNZP3Y1o
TLSH
T19B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 529154165010da9d0cf62d20b44b604b0c1b612ec9ba99797c667033e14ceaae
MD5 faac2f2b672aa48c702a425e96691b82
SHA1 d510691e2761f9bfa46df4140eb77ddec6ddb44e
SHA512 b0f0e5746fc01148ee706987dc8f0d049d31c47ebb66018875d3ccced964b602e12653847dcdddd1512d89609c0e171234b00e3dce607314a2232625574fe079
SSDEEP 98304:ZQRQyi36YOcPDLvw2gAf+PN3ZxRaxC3Y1oe:QQyiKanX+PNZP3Y1o
TLSH
T1C5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e7a272c8533e212929e901dddc511f79632de8a6a6fa40df215f008421e69af9
MD5 27924c69bb2b6ab8b7b2cdd19662f631
SHA1 4967637eaa8ee781b974e8b5f4440d6805b2bf3d
SHA512 cd23b4c66eebae0e91822c95da882e59c02550837c92dd8700703c8190cb125d80d9086a115a8e8b5de7881daa2696a78d03222c774f050436ef281ea6621001
SSDEEP 49152:d68Qg55nhkeWu7PNU3/jNoKRaxC3YhweoMLa:bthTRc/jxRaxC3Y1oe
TLSH
T12DB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8541721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c7da9ec581b5df579f0b900781bb20be2b361d1676861cc6836e1056ba0fe5c4
MD5 def2c2516a1b0da712f49713867cca4f
SHA1 72069b253b8b3ae591a9535a8448db32a2e800e8
SHA512 9d3455b4ebaf0679bd048d194a684a923db8eb352ade45d4fac877096206d097064b5d53c180b7b8ef03fc5d96e8c33d4b0ac2d3f6927dbe9b08076f97577da5
SSDEEP 98304:Ly5112gYy5azzVvU69nLKnhZyxRaxC3Y1oe:mLIHRWhyP3Y1o
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a0ed8a001b6625ab9fb7ab7fd6a93fd5e284c87ab90496bafa84758c0b2e493a
MD5 5651982a10b251c75609a2cd8ce37489
SHA1 dd0015f07c37c05bc97e1844f0be5b5848c5a26b
SHA512 205e572122282d628ed2fd3d7b71bd54ed588b2cffd21e9fccdc6161dda31895d82f6f71a01ffd97d28858f5d497b700a7a16ce72679bc29fb2a543c9d2dd8c2
SSDEEP 49152:fB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNNoKRaxC3YhweoMLa:hu6JmIxd2dNxRaxC3Y1oe
TLSH
T191D59D13F1DA01E8D05ED178974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2292ad0dddd022f2504e7f540bd4d766af60000d46ea95a5cee31e44b1e99047
MD5 d85109d04eabc2f9114cf27048a3ac7f
SHA1 71c3468271637aa6077a41caffeed3f2c3eb7397
SHA512 a53a8b4221446535ffd0e5a05fa7ee0a54e652572173b347719fcaab72c9cab9bcf9e885ef2adf0771a51d2fe2c833b8b40cd2ed8423816d35e120d54ca82cf1
SSDEEP 49152:b1hpsNoJpF1A67U44CwH7R4xVNoKRaxC3YhweoMLa:bmifPqR4xRaxC3Y1oe
TLSH
T14AB5BE13F29901E8D06ED17887569232EA62BC460B30B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 62355538b4e6f8f97e8c98fb9127ddceb98575e16d3a85f9e010276d91f64160
MD5 4e2ef4fe411d0d97bc3ff0d324957beb
SHA1 e3033957e9f64147dcc816b739175e9bcb85e4c5
SHA512 1cba7eb661e2821c99cb0821e71845a030d53ba61adef98eef5ec69a3d61b50432666041ec878b8fa5be2dc1d1a703200eb526edbe1c70e8e0f0e734f266b691
SSDEEP 49152:vSuZQIY0Be2KkRVtOnks6NMHqeNoKRaxC3YhweoMLa:V5dKqi61exRaxC3Y1oe
TLSH
T139C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 04ffa2a889b6724b2554c955ea0a5d11a7d441397fe4ccf8491e103d32731de0
MD5 335c2b14e3652656f4c8dcb0fb8a8708
SHA1 b61d3dc490f2b695fde8e85501bf94e6934a1a9a
SHA512 8fb33f8e1d766af5b71f18178161d12a09b4b30c24e5f2201f11a3fa4cf64e90492896848964c9bcad89b2c204f627984498a3fe620b139e98d9cd79ba888d5d
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wRNoKRaxC3YhweoMLa:dX2iWph8xRaxC3Y1oe
TLSH
T17995BE13F2D901E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2d5160d22b7d6b589ace9a1409d09cf7323c000241e290c07cac2edfda598e79
MD5 6b4a21014f62e30c8db11b92a40eb2d3
SHA1 9913ffb7fd565ada155ad8a221cbdd411d85130d
SHA512 6c916eef3fd330027b3d5a5ec6e92804e550bf5d8c831539a43c5bbee0c18f7aff4a76fc3094513855a1ee0a4c3c4d03dead971fa9dcb378be3cf1d624f8a247
SSDEEP 12288:NajXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:NaNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T101C42306881E4688E1DC4335E79714E5E3680DF6FBC11237BB8473679B35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ad60a73b232e7c33dd06747069ac4c1651bad891cf073e367cb95449c57c49e2
MD5 ded3d423235483fc7bc52abd905a19f5
SHA1 837b06a114f5cc6b2a5a04a7e0ec4dfc2a9f783f
SHA512 9d27f271ac2e21a72cdf18c80970a7d337668d5dd021be604cefd817199614705465e0d970688ea035e2e3cd68aaef7dd18e0deaeb5e61c0579dde7916c04c56
SSDEEP 12288:pvjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:pvNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T178C42306881E0688E1DC5335A79614E5E3680DF7FBC11237BB847367EB35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 398bdfb03103a34e2990364b0544013892c2fbe96c9c39307a91ba4b7748eedd
MD5 aa2de44f4e80387ab384edf804e24fa8
SHA1 b381d85bafd21e6a07edc43463c7818a0788e609
SHA512 9cb42e9421fdba42ba991650fab88d3792287f3752a71544885029c067cc1690e2dcc7e63cbe7bd4b584608d46d89ff5066a2aa65fc0730fa7edb797ab7a95f9
SSDEEP 12288:C9jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:C9Nou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T15EC42306881E4688E1DC1335A79714E5E3680DFBFBC11237BB847267DB35A79492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 519cc505e53a8228a9043c01008ac1245d39f88a3f1366c0ac58f86d42a49253
MD5 96a78279e10363d18af9d9b8fd5f1641
SHA1 f11bb50adff289ad6a609eb88719e5936122f42f
SHA512 749c81db4ca2ec652770231ca6318e27c31cd49c968f3ed653fcd246496df7fc18ffac4d39e5759516214d083c3acf1f08c4220ca152147b2c721d19d5ce90ca
SSDEEP 12288:dV4jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPha:gNou5MEdf/RavguX1c3UrxhVmerUZyLT
TLSH
T1A5D42306491E02C4D4ED9338DBA714A5E3B87CF5FB51136FAB4022AB4F317B94D396A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 aade729db6c8e05774d580fb2f362ffa9ea92078ae6f01536dddf81b0cd280cd
MD5 862622283f5d22eacc9bd1512e6ff294
SHA1 b4bda4c9a36c3cfdd957a0b83ec126ef0b28c4ed
SHA512 8f2d40dae89bdd710e9d8b59f0bc85c987bfa0fbf8f4fdf71f1eab8d852ba091be2ca0cff412de01774f57973c6641058d6d0cc435e5b0813f1b856d4e7e7c69
SSDEEP 12288:9QjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPha:9QNou5MEdf/RavguX1c3UrxhVmerUZyP
TLSH
T1C0C423068C1E4688E1DC1335A79714E5E3680DFBFBC11237BB8473679B35A79492B1E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2c0648c7f79d24c787d950d3ec91e54d3eec851071e97c94e8eb3988415c07d0
MD5 729218bc80741c2b3da36c9efedd596a
SHA1 2624794f4c5ec60f019dca64cbbee7ae0d974639
SHA512 57d76b891c47561edc187879a6d5c6b6a89f4bc77bd842c447c286f9f3c8ac9fccbbb546999a78aacc80cf344fbbcf4df1eaeb730019a29e946ed165789318e7
SSDEEP 12288:b7jXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPha:b7Nou5MEdf/RavguX1c3UrxhVmerUZyP
TLSH
T11EC423068C1E0688E1DC5335A79614E5E3680DFBFBC11237BB847367DB35A7A492A1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1f05e5d25b08f3a88909cc24b8f40a78443d1f701e1da187be2e7aa0d803ed56
MD5 42a8f9cb148edc8049e603be3283cb2b
SHA1 f01fbc6af374397dba474a755de6b82c95b01f6d
SHA512 f819add1cdc1dc8f0b9169d3ebba09c76f85ce4e7354bdc90986814cd2f6ee0b876d02b51e5f956d1e43fe6c26968cbe0a4f15a7be22c03e9b188c8498ca0967
SSDEEP 12288:pnjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:pnNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1ABC423068C1E4688E1DC4335A79614E4E3680DF7FBC11237BB847367AB75A79492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 06283496963e922573beeb16c93ce4c4701ee8b32c6ca5c797d9999b38836482
MD5 a6d9e659bb9e587c94a5eeb38bf7472c
SHA1 690f8c725ee9140fcf67a01381e66915c68fee2e
SHA512 29a4d3a521bc90da6af2e1e74c13f7bb1c454ba40dc40487da6dd4cd2c37e29bee84d8cf2af792f446622d2877c0951565e7848319ca735e343b9de3bf16113c
SSDEEP 24576:pZM3zFVSOPNou5MEdf/RavguX1c3UrxhVmerUZyLeh:pZM3zfLNoKRaxC3YhweoMLa
TLSH
T1D8050155B35008F8ECA7823ECD564916D2B27C6A5BA0C61F13E436675F333A10D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d82f7c9abe5b9aa6410a4ffe14a0407316acbba0d87f883d04d19f6273d85229
MD5 47f0bb5a80d09540deac0804dcc6f3ce
SHA1 150d3ace88124a1a32b63f54f4fdcf0324e789f9
SHA512 a740305cff1cf2a8310bf82ed166ef4a113028e215200a7ad3578bb9c2d2e44545e34a2a1a52d9134c459832ab41341eecf1091014a4d4d0f2c437f000e4f943
SSDEEP 12288:XujXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:XuNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1CBC42306881E4688E1DC0335A79715E5E3680DFBFBC11227BB847367DB35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4ee87ff1fcde0c215f0f2ccecb500a11cf1b2bec0b4c4251e7eed92bd5261147
MD5 70c41d6d3d145b843fd73e039f8b5378
SHA1 2357afb2a2c61e90294535d2c9125f89cb9792b3
SHA512 70f335c1a34a44b04194ba24b643af920248e01355a2273b47947bfcbb37388ebdcb6d5c717edd6cfb7edba80a6d4a0e1f37c689f4b761f8a3153c8602fb8f7f
SSDEEP 12288:xCjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:xCNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T147C42306881E4688E1DC0335A79714E5E3684DF7FBC11227BB847367AB35A79492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 50bd99b45a696d5683bf1f20e0829c5ab5af028c7f366ee949de2bb622d07e6e
MD5 477fc48a44a7f4fbcd57fe118ee19044
SHA1 a0041788c98a5ce2a2857dca1cb9fc937bafadb4
SHA512 98f396e06f3a9e016cbbe32d79f4e5e08b7e2c2ff3c668e99cad47ee2dd389d746ee5227909dbe53d49418123f5174b235af0a518669855756bb190561631924
SSDEEP 12288:SyPz5L8DjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhZ:PzyDNou5MEdf/RavguX1c3UrxhVmerU1
TLSH
T154F4120766A521F8D1BA8238C9A21952F37578725B608BAF179013772F336E18E3F771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 21a91f49e004ee6106d5ce8ceac873881c693d3ec9fe361e9e1cb879e5d733a4
MD5 52ff2b8d105547e8b3166b1548a98375
SHA1 71bf48154ce9d4cffdf5eeda4f8a9ee16e5655ed
SHA512 11270024f8e5f824ca0425f86ca8d213182c958353f1c4914cc6e037b6e3e2c9b50784d0547932a1630b58c82d39c5ac3e84bdd7612478dac84740338c384061
SSDEEP 12288:3ujXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:3uNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T125C42306881E4688E1DC0335A79715E5E3680DFBFBC11227BB847367DB35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 da2b32829a166d9ec4a8f2b084573ff1653f048aa6498a487f75122170c2df1d
MD5 186ce520cd252f3133fdd48f9d4c4976
SHA1 ed2e8be0800c6b445d1937d3875dc6acf4653337
SHA512 fc3efe169d7f85a784458b9149c92d38e93bfffaee53054eb9b12fe9f8226d60ee4d530323997c6055235511609ad55c47ccb7e60b90a1a5754a1fa92a7308c0
SSDEEP 12288:KujXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:KuNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1DDC42306881E4688E1DC0335A79715E5E3680DFBFBC11227BB8473679B35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2e857cc81d1f50f20ffb85b0c8f6cb9f6f142eddd3a819db623c7c2dfb52f23e
MD5 482101d06786c325fe807edf4d27a354
SHA1 c60912d40d1b845fb01dfdbdd46a35b5493029c9
SHA512 f150a5eab5d5bd167e04394d1540528b7eb8c6cdb09b5194d7ea57422605247691399a90934961185f7c7105a8c632f1a4888392dbcba1b7273d4465b46e8653
SSDEEP 12288:hyPz5L8DjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhZ:wzyDNou5MEdf/RavguX1c3UrxhVmerU1
TLSH
T18CF4120766A521F8D1BA8238C9A21952F37578725B608BAF179013772F336E18E3F771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 2c8953f069b8cd3f7bcdc559215edec0f6e62eddd2302562177064fa0591b5e8
MD5 a19d54d5dddcddb6e8f93bee8227e6c6
SHA1 fffd6b7f90e37bbe6d15ae0aa74ff82b26096a77
SHA512 8b1a1740fa4891d7e52c66d5469915cac65b8805fa62824627328f67323f4a40239d42fec4c730acc19158456472765a4369d3ad44307b745c0ea36b87138038
SSDEEP 24576:yT8aLl3z0zDtNou5MEdf/RavguX1c3UrxhVmerUZyLeh:yT7LljUNoKRaxC3YhweoMLa
TLSH
T1A1050255B35008F8ECA7823ECD564956D2B27C6A4B60C61F13E4366B5F333A10D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2a1467c706347be02cb7eec67b002431be2f6ba8765d8531ef482f41af8e0283
MD5 c8a8e932f2409e75dfd5bcc170dd2289
SHA1 9b9145dd3fda1a9fa7698fbaf6d1b3c17349f4fe
SHA512 ea620258dce880093b18b6486106182f154f4211c6b606d07bd6cb1d4a36d5bdf7f0db79c0d7ba37a15cbc7f1923954631b3f9ebfdaa18ac35d6fb3d3aa30a08
SSDEEP 24576:K3rd9CHKy7GZ5Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:srd9CHKyaLNoKRaxC3YhweoMLa
TLSH
T11B25CF50F3E810E8F0B79A35C9764511DA767C9A5B71CA8F03A4265A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 7b2fb4140ada3467646ae61bf8b0ed9eb4f669079894505dc152402f7b655ebe
MD5 0a65e3673e50dabb362a52a96c3b92e3
SHA1 7f8eec09c97283d360f1c720e2fd5baa6f11ccca
SHA512 f21f101de642774a0ebefd361af924dc9da54856db44937a71b0e179997f529084ad55152e80093564d3b1a241db83b76c33dc6f1b4d238346c73226d760be45
SSDEEP 12288:GdjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:GdNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1CBC42306881E4688E1DC1335A79714E5E3680DFBFBC11237BB8473679B35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 af00978a1b8c612cfb159e23ef89cf80454000217c909c11bce4134b82570bdd
MD5 4ddbe52b9edc31bf35a9d1a9816345af
SHA1 2b810b1ba2a4d99962ae8c0167a1a513d4d58a8d
SHA512 1032f187575d23dd6535b0e6896b7a014e80f8fccb50fb2637fd56f97ef8b843ec3c82ffc94773291c6ca4541f60e8788ed0224b9a0808a87901bbe13e211e65
SSDEEP 12288:rjjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:rjNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T105C423068C1E0688E1DC4335A79714E5E3680DFAFBC11237BBC472679B35E7A492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9404c38af8162d5193e300e67ac5ef68ef081560f40985840b44edcbe7b7bdae
MD5 789cbc548128df2b3d79f621cfd0ddb1
SHA1 99cfe2cb27c855958996ff4791fe8b8433237411
SHA512 ff77e3daf400753a2b7e2e9052b24be07e104aa0a30db612a0f7840f45cdbe00f2116fc9d659c31bdeb4bba51dd15eda1693506bc6a4001e445415396c447f4e
SSDEEP 12288:DMjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:DMNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T123C42306881E4688E1DC4335A79715E5E3680DFBFBC11227BB847367DB35A7A492B0E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c1bb689249c4c0b9b230b3770dc71a34a84e2987384386fc41b48c87d412f2f1
MD5 f4e618c1028c318dbd6fb545eb22fbf7
SHA1 731b032269b0d748dc4730577db5e8c8d3c240f8
SHA512 e2b64f73c9e3e7adf92f84290680fc4983ea80d2fef7e2926ca5383368c0b19997f39b642e8e01f401d046b8a2a0993ad7fadc7025ba8fe48e2d44b86de4ffaa
SSDEEP 12288:7ujXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:7uNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1E1C42306881E4688E1DC0335A79715E5E3680DFBFBC11227BB847367DB35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8c9261e4dcd33b15a79ba1fae84876b38767c8eb03e69ab540a35452ac76a9c9
MD5 29f0d7b84ecafe813eb8f4632752711b
SHA1 bba22aecc73c984882b92c2c4b1481f6acf35cb6
SHA512 79732d57db8b4bd98b070ad79728e2a8d7c153d16e3b1a0ad718728237f8fbb0f84997becd955e9834f912199ff56532bf4ef46a4631b9e580fd71431e689157
SSDEEP 12288:/djXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:/dNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T18DC42306881E4688E1DC1335A79714E5E3680DFBFBC11237BB8473679B35A7A492B1E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 b2cd5fcdf7db3f70d5d937d121ac604a78b6506c87a8c066ea734cff8dbed672
MD5 89dc2371eded03387204bcfd94a94dd6
SHA1 1d0e5df3da5aa96627270c931865dfe5e3ec6a1f
SHA512 12a59672f3597a999ed634aa5bc3e612612718879458230ae6f306fbab7acd0d1f51d4013ba55b281d8b329b7b53bd0bfa1c2310270a2f1e292940151ec55a4a
SSDEEP 12288:hGjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:hGNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T16EC423068C1E0688E1DC4335A79715E5E36C0DFAFBC11227BB8473679B35A7A492B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 b5bcd0e03a8c9bfb2154d38c52688b982f6173ac64f1cafba24c1199bd8f2989
MD5 c4749c8af46c74e35c2f2842fd4bd7b6
SHA1 8f55b498421f5677999471243140433da25b5003
SHA512 6e77f80bbb28a5da31090632fbfe23b89b2d1758161437bac9ce7a04f13cc10f35c4c98d6e436643a24ead3487946ee4200d76bc2bd1ef5bcf1c66733c5cd62e
SSDEEP 12288:BQjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:BQNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T130C42306881E4688E1DC4335A79714E5E3680DFBFBC11237BB8473679B35A7A492B1E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 29c1b5d226c2c3f74fcd6c07a159a999089a6348f9bba13ed7f27e9600405a46
MD5 105a9507dcba1e1de910ab040dd48827
SHA1 04325f26c25ffa8d051cd7789ef8879eee8a2e9b
SHA512 4d857d1193a4dc307b9bb676af59f2c2a7737d976602554ae6f18f63e50744818ae29edfc577f6397a60d33ebae1404efe919d733bcb6000301da7ff49d18b05
SSDEEP 24576:Hfwvzk9RX6wkyAIWNou5MEdf/RavguX1c3UrxhVmerUZyLeh:iMnYIWNoKRaxC3YhweoMLa
TLSH
T1B135D029EBDC04E5E1B7923C99B7460AF2B178691B31C2CF129953AD0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c7442c20f29afcab82f647338d76d4e916c1fb8ea6f1ad85915e278490738098
MD5 300139430a0c200476dcae09c9786122
SHA1 60db16a1dbe394db5e223a586af60009662b72e5
SHA512 bd21847275793a7be6540369a1e418db6b222a433efe6180f9bd5bfcec15cc067f6600312b52aa4b62cde91e2a891babf7df5f289d9e5a6a77aec25c0220c31e
SSDEEP 49152:3YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09NoKRaxC3Yhw5:aySzPFxRaxC3Y1oe
TLSH
T180066C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cba93ad434c4b77cbe03545ae92ea712ddb2772eb75380c1b250ad163a933387
MD5 f32d840a32ad678794ff3e7fa87f6c63
SHA1 99f966a5d9925b8ec36faa47d93a28826b0430cb
SHA512 e2551383f505a58a2b36283aec0a8bdc19dc8e3bf5055935a6f665f72145f31bc6fd27fc1859f336ac7c8aadf7fb3d2cf6dbea897ad5ef5644acfe9137b360a8
SSDEEP 24576:L47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYzNou5MEdf/RavguX1c3UrxhVmerUZT:L47JUQjqirIhCnDHUPfF/NNoKRaxC3Yo
TLSH
T18F65AE1EA3EC01E5E1BA923885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f0396f35880e5e0f24d956539b5d65f7a07a636fd67193f6eb80913c2f7a80f7
MD5 98896bf3b446478b064240d40018b4ea
SHA1 2463043d835e702834275d58d8acd3da153fc53c
SHA512 5128a2ba76a2af7c35ea15fa15a535633e49c1365c482356a32bb226a50827ace57fc9d9ff85aeaac11e60161c74c21f13e7e45a4776b42d7ac5b3d02e6af23a
SSDEEP 12288:IpsfejXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:peNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1EAE4F10AC25802D8C0AE6239C7560A81F3377C6597E193CB67C0F67E1F366A49DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 21904420cb7fb6f1b35ebab97a60b8a4361a0f972146f8ea141396685913b95b
MD5 8d733cd019b0f63c60dddc72e62dbf85
SHA1 1ab6d803789f575beb763579aa3e9637c7d7a52a
SHA512 5362acc52669aa7805c2c814a104a729f7a531131b250a15f9278a3916e1d07091db2e40277b08d19aab3ff3b0ea0d7790fb6307fe31857ade0b9862f316b34b
SSDEEP 12288:J2c3uIBqIeGROPT4dcIn5ig8w2yNCgwLO5wRM3pcAIugnZpB:kdIfeTTMGJ9tkwRM3qAIdpB
TLSH
T1415528107626CB5FC66940325E33D6CCAB707D01FE056F0773C98B3F9576A59BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 843ef71c50970ac0854a0925b5cd697397cf4c64d8a429bf2aa3960e77089c16
MD5 535f6d5707378b3862ef713ff9047582
SHA1 b5d08420a6a48d173e8d4826c3bd297be40a3fad
SHA512 4349f2f64081d26a19e50c6c741187b7bf60e23ce79a293ff5b1766a17c5f0e1d1685364fcc1c829867c2c398d1b1246234009204610144f373fd3b5f0331fcf
SSDEEP 6144:dpp30yzAj1V7rg/kWL94nqKDeoH7qKDeoHhSWtNcIvvKvAK2qvXaVAkxTd1:Z0NHcNL94nTJSQJA2eXaVv1
TLSH
T162751A41A536A78FC1BA503207365B8CAB74DC02B7456F27B3C9493ADC6AB05B4F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f9216a7761f683cd712b79b0b61d63ea72e7c3253d8ad18f5dc1eb71fae7df1c
MD5 1b24fac9b80a09f426b505033b746841
SHA1 a9a8666f867f49aca0980af7c329eb39f8ddadb7
SHA512 47bad09786badcb708d1da95e1ceda4e8c0d46fb2f8cad2cee4dc6715f9c0b9952768e25e372e985ef9b0b4b70d1040b7affe7fc87d2a999ee645ad2f4988e27
SSDEEP 12288:/07CjXRIOou538Edf/XBavQC4uUUTgArc3fujrcDdWhVmetsmUZcICLTkjhPh:MCNou5MEdf/RavguX1c3UrxhVmerUZyW
TLSH
T1A0D423068A1D4A44F5FC1334669B1474A32C6DF5EF8051E7FA4073A7AA31EF98D3A253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 667a8538593c6fc9aec37c384fac2c1a4325b1610507c02c5ae94b9692e97195
MD5 79ccb1fb2dc94e0a5d2f9e37d25a8322
SHA1 959f1d456083e123be67b9d1beb4fb1c942bad63
SHA512 227f5ff6ee4f2f341abee43de7f48a030f4fc97f8824e16b767af0132f190d511430ea272721b0c0ed18a311a63705c0ef7aea56fa16fa768374781f465caa38
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYoNou5MEdf/RavguX1c3UrxhVmerUZyLeh:bgb4mBIBhGFzNoKRaxC3YhweoMLa
TLSH
T15A65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3ff22f2a2bb437d50e15a03ab7f6f6b95e9a311b0c4983f43de93cae66ba94b6
MD5 b2488a82d8d4abef9d180663dc8bc104
SHA1 4254c759290b9c159bfeb90333d66b2d20591e5d
SHA512 1a1971549d707963b22793e39346b4eada5607457f46fb206f54a1c289c6c417e347f2c2fdac2c401ab8b288f5e39f8e9966fc21dddf74268673b577b37f5505
SSDEEP 24576:RG88u8FpJqH1vzria7/mjNou5MEdf/RavguX1c3UrxhVmerUZyLeh:07ZFPqVya7/ANoKRaxC3YhweoMLa
TLSH
T1E135F22576E501F0D4BBD1388A864663F6B1B4251360EBDF07A88B561F23BE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3b519a9551edad6a5412143750a724f5563f1745acc3f22c724c9a27e4351e48
MD5 048893532f8e844883a5d1966f003e5e
SHA1 92328b33e4a842fb2e90eed55839dcca2df6d3f2
SHA512 d64aaba697212132f8b47ee7dcd50aff4948a7710111ce8e4ab3f84d80580ce94402a0f4dbec4a8d2fdf8dbbb84dbd9fe10da218a5cf3049ba5284773cdc10a8
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3NoKRaxC3YhweoMLa:XG05lO43buxRaxC3Y1oe
TLSH
T1FED5CF6E62EC11F9D1BBD17CDAC6460BEBB23425032556CF02A486A91F27FF4593E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d8d5d38f2f650e2444ff03c81be05cacbf9d2df1d9e9f9efb0e4d78640fdc207
MD5 8cbef3705d66cbe6a2a35072c0eebf88
SHA1 fabc4169b1b8a24cb1e36bc4e31c9903e5961a27
SHA512 aa007a2bc3d7236b2110f32a26251367e07e0c125a88f07901588d0701c9e2dd129259cab228d5742d53cd47569a0a8956b60f0bb1003dfc2c9c0978b084fcdf
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidn9Nou5MEdf/RavguX1c3UrxhVmerK:qa5POZ3lJt2pasx2+mfNoKRaxC3Yhweu
TLSH
T11065AE5EA6FC01D5D1B9D17DC683461AE5B1342253319BCB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c2c9e621f0cf04728ea916ff351395a3248ab581b3d0bb480e0cd2434c1e5462
MD5 89a0df2786efa4268a1a295273d56464
SHA1 b7fed3b32bab27f87ba9e4affc683916593af3c8
SHA512 8d21b96937e0f2248eea4db7ec721ab3d945c0b3c7c393c5aa5c40465af5eff93f5b5123a47ff02b285756ccd6dfedd85c27dafe427ea21d918653650a75bc66
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkrNou5MEdf/RavguX1c3UrxhVmerUZyLeh:hNc/zEOVHFgNoKRaxC3YhweoMLa
TLSH
T14D857B1622E901E4F1BBE1BE89779546FAB17869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0a75e660e66a25358abb020149e09111bdfebb6a244ef90015624a778cf1d554
MD5 c406101fc5b273e52868005bb8903f48
SHA1 794ca04809c2a2204ba160006c12d3cac62d59d4
SHA512 3b90f586d1b9e40b7bc31a7c8e5e42003a1674ee150252e38a528ee45d3c4b649fba1c9cd6b3c820067307cce4207b16df94b76bea5b1ce89b4fcfe5ba3a743b
SSDEEP 24576:wzkNvNnaFeYhJNtmZBmpNou5MEdf/RavguX1c3UrxhVmerUZyLeh:wzMwBtOmpNoKRaxC3YhweoMLa
TLSH
T19E55AF2EAAB846E4D1FEC674CE238512E6727461173253CB5390C13F4E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 720a2e7a5756a9ccf1902eaa8dbfd0d94a7ece6ac604e721a010144fe19e642d
MD5 a0d1a517bff718b5a5aa0dd794663666
SHA1 eb47f0a5c0817a7aee0c981b067b577dbea51064
SHA512 48aa96f9365cfa6d44e0c18e782656d8bf7e9f5cda3e58e53d02f9cc450823ff7506758ef0b4eab7d218366bf2c4f2b3f2913c48ea9809d1899dfe97c5819cd6
SSDEEP 24576:ZPUr+NQHNou5MEdf/RavguX1c3UrxhVmerUZyLeh:ZJQHNoKRaxC3YhweoMLa
TLSH
T11D05F21F66AD18E4E67AE13D86824619F3717862171192DF02D0817F4F27EE8BD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 3a339572805f67395f4010863e2887ab10ef76ea3733a06391a3f79b555d5341
MD5 5905743fa77c3171245699ba1cb18baa
SHA1 a16ed4a279c9072f801a9ac600fc54ab2b706d6b
SHA512 b1ab0c6c3469c062c8cacb9badd7b2a0ba51b384ba2ccfc968858ce7638047ed89454aeb0b67c53768e8ebb12818bf762ed4811a4f1cbe5087e27458efe04c10
SSDEEP 24576:TD3FHshBIYQgA+Nou5MEdf/RavguX1c3UrxhVmerUZyLeh:TDVHeBIAA+NoKRaxC3YhweoMLa
TLSH
T19325E13EEA5C04E4E57BC27CDA634906E37138A9032156DB12D481BA5F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/792-306-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/792-67-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/792-73-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1304-114-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1304-108-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1304-106-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1304-323-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1524-80-0x0000000140000000-0x00000001402C3000-memory.dmp

Download

memory/1524-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1524-0-0x0000000140000000-0x00000001402C3000-memory.dmp

Download

memory/1524-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1524-153-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1524-163-0x0000000140000000-0x00000001402C3000-memory.dmp

Download

memory/1524-8-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1912-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1912-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1912-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1912-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2432-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2432-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2432-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2432-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2948-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2948-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2948-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2948-16-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2948-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2960-120-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2960-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2960-126-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2960-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2960-129-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3316-289-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3316-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3316-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3316-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3428-320-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3428-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4108-41-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4108-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4108-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4108-46-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4108-50-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4152-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-82-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4152-88-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4152-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-339-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5960-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5960-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5960-324-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5960-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5960-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download