2c985f68d97ba8fcdcff051e10dee42d3bd50e11be1cf10ad3c8d278c55167f6

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample261024-ep7asastgy
SHA256 2c985f68d97ba8fcdcff051e10dee42d3bd50e11be1cf10ad3c8d278c55167f6
MD5 959204975839714e32b20cb809c4cc52
SHA1 9460b7c6da84b2507257463ba3cb2c9dd774225a
SHA512 b2214dbe5e0277406a0802239b5d08b4970a8acd3747120578b5c03985a4ef3402dea4c4ac9febe53eb3e5c6f6acd1fbdffb79abeb494a03b84102059dca7008
SSDEEP 24576:41rZCoV+Mi2iBgFJO6/nw68pJpu1bAUwFrlR4lsnQ/tbw/2Mkjy6Fr7g0oL:41rZgMiCMgnw6UJsFIFEaQ/lFTjN4
TLSH
T1F985BF1B626901FCD0ABE17899574A06E775744A03709ACF07E056A72FB7BF16EBE300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4404	elevation_service.exe
1164	elevation_service.exe
4752	maintenanceservice.exe
968	OSE.EXE
4260	PerceptionSimulationService.exe
6132	perfhost.exe
2084	ReFsDedupSvc.exe
3044	SensorDataService.exe
2388	ssh-agent.exe
3040	AgentService.exe
5440	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\12ffdad67465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a43d1a4c6d63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002ed8464c6d63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c4e56906d63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4404	elevation_service.exe
4404	elevation_service.exe
4404	elevation_service.exe
4404	elevation_service.exe
4404	elevation_service.exe
4404	elevation_service.exe
4404	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1672	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3040	AgentService.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: 33	5440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5440	SearchIndexer.exe
Token: SeDebugPrivilege	4404	elevation_service.exe
Token: SeDebugPrivilege	1164	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 108	1672	2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	92
PID 5440 wrote to memory of 5844	5440	SearchIndexer.exe	103
PID 5440 wrote to memory of 4296	5440	SearchIndexer.exe	104
PID 5440 wrote to memory of 5348	5440	SearchIndexer.exe	105
PID 5440 wrote to memory of 3728	5440	SearchIndexer.exe	106
PID 5440 wrote to memory of 3536	5440	SearchIndexer.exe	108
PID 5440 wrote to memory of 1240	5440	SearchIndexer.exe	109
PID 5440 wrote to memory of 3748	5440	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_959204975839714e32b20cb809c4cc52_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe" install
  2⤵
  PID:108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:968

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e13c2577e3cc8754fb9b17db9b8b5f375ce8a885dbada02280a17fbe9d279ca4
MD5 f1bbfa433df7be18241bb563a9d87783
SHA1 55ffc882441469dbb5b03a3655aed7d463f252fc
SHA512 6df7159a6cbf324c90325a1ce5dee437d680022f7242107ec4db790d2c3364890077b40743bdb9c48b6ff13e63bb474dd6af20e069217aab9243a2612c272b2d
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1Q/lFTjN4:W3q6HjB1Lm
TLSH
T1EED58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 09912eb21d0bb5755750916adf7175b5fd4a3dabdf8379cf829e3efa3ab9893b
MD5 47b5545f91991d986f0d2cf22e0d9f42
SHA1 10bc3d8695d720f90c2fbaab2c2f03175ae190cf
SHA512 1a3afee6d1590c07463808efce415b5321ec0a274746c82c1b6def72a7fd72e16a5ac7fa9e6fcef5c12f1c3ff52fbff349a480f340ecf6b770a36d2dd9bd94c6
SSDEEP 12288:i1XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:oXYfDtczA+nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T19965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c3800196db2c344472142747fdf4acfb0665ecdd6e7ea7f9b682ee9ed760a8df
MD5 69da6528116facfd7b3db42e33c36164
SHA1 5fe85119906b73a1cc8c94fea97b35b4b55a1693
SHA512 34d1199501aad2beb6606db83a3bcb57306e472134c3533cf524ac8bf8a379f21edc9971952a3d219e604efecde593a0f781606409359c7c9c0fac1c57ccde48
SSDEEP 24576:H0Le5ji0hmxLrMdnQ/tbw/2Mkjy6Fr7g0oH:HPji0AlsQ/lFTjN4
TLSH
T191859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 62fcf42558460d301363ddabb51c644000869ccbd8fb8c35a87fe422a6f12815
MD5 f0778744bd5fb2eb55b16f1d0a2b12bf
SHA1 bf0d06ec872f700731f62970dcee829d75d47157
SHA512 b0f1910e4ed57483443f442ca62e68bd55b9f4909ed853814f7eec2f6f4ff04e6817d47421f57ac3e4324dbbf2965f251090ecb0e619c088d80e6eb19f443526
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuHnQ/tbw/2Mkjy6Fr7g0o3:s/ezSC6vUzPvxHjywQ/lFTjN4
TLSH
T165755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5f57ba9447ce6e8df224c74483a9b1438208d7d7dabed0f19af855efade57bf8
MD5 6f9db03cb03cab482a5d068ae809202a
SHA1 1198b80e124c44bf7df449220d9656abb1bf19a5
SHA512 3661e3eacdef67a979bb968ade66480586daac86f27be6792283852ba48e06690798f2803abe0ec58f8d433f919381c0c9b5de723743e4ce7f2c8e10758b67cd
SSDEEP 24576:VVbqPb88hv/l+6qnQ/tbw/2Mkjy6Fr7g0oE:VVO88hXl+xQ/lFTjN4
TLSH
T1C2559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 15fd7eabc367bb7cb165afde6b7ece390d7608c707170359c90e422310bf1050
MD5 cb642cce9fe4c0bcb89fc9f17f5d4ba1
SHA1 780a59cc8b271c9b6d22becea57c1a92c84003d7
SHA512 e1c753638544652a13fc4f323b789569582f2d2b64394a25d9b45453f43a1b6e657d9bfd2ce0389eb1d6108d0aea43215aa789a8a7fc994ee999fbe1738cd81f
SSDEEP 12288:wzZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:wzpnQ/tbw/2Mkjy6Fr7g0or
TLSH
T18E5523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E7B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a4d49063e369c2ca84fdb1309ec8e3a02bf1e3e4155da04eced86d207b60a5e6
MD5 8438928326b971fae9918b5ac7906e99
SHA1 498e40684211d6e446a6399e799c4d47fcbfadc2
SHA512 56300abe3920867579a8cd669160b44598cb27e7341bd7823cd80644cc2c7a6c8dd6d7d117ec600b847137624de3251b75efe8944aa6f2350873bd2338306086
SSDEEP 12288:+eBNUbTVO86UyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:+JIUynQ/tbw/2Mkjy6Fr7g0o8
TLSH
T16B75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9ad8301ae30f374ed7df96add0297298a1c05f60b39fcaebe62453775c62b9fb
MD5 3df2407ca09dd12628eb91e116669d12
SHA1 eb5319afa20682d368ab1f32908fde6f267bbc56
SHA512 b40036a6d9749ab54210ea8a7006f79450a29685f7cdb5294b0b529148ae233beea43d651edfd31a2bcfd03b3abd2014c26889260b4a220670cf4b4e9648fc8a
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:JQvGAdlCEL8c/yRNw5CcLm
TLSH
T1E8267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 54643952d7465d6d4c86e3fe41873e485bb1e3ee1bb19462003b4adf64cdedde
MD5 3e0d093bb3119956601425ebf3a349e4
SHA1 c132514f37661d685c16c10fd34058380687ca33
SHA512 6faeb6c3ea63834015756931278c1c750e60036fa982fc6fa865ba5afe7d4890a57ada6012ab9ea117263f928dd90fea07db887c7b3ad87f82480383b1c5ffd5
SSDEEP 12288:CAwSfxL/2Dc39DLLmt0LDQewsAjcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg4:HQewsAjcnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1F675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d9b6253748442077092be37f37002e4075e20c68269dbb3a594410456c1e7179
MD5 45e7daa01def941b06687530ef6378a6
SHA1 0cf6b7adb045ad6661b38a941b925ebd606a7423
SHA512 4c8421633b8acea42fb1148ffc309c08f9e0dac32ad800c453e16a563a0f422820d03d0de2a3851360dc3742b499d0a9cb0e58e7acbbb345646d5da105b982a2
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnL:DUEtQevvqc2W1cpV2EI32
TLSH
T1A6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9fd1aa658e4aa4969bdb0f22ab2851ef435d0365e85e67d5f0bd109b625d2b14
MD5 9d4fbd8cbaec8367745791e700a874bd
SHA1 3019b538bf129869215f8e07173de741c125c449
SHA512 e3fbcf54a2e4c7e3d93e1b4010ef251554fd55d9fa8a12e8f3bec59cddb802c35d25b3d43b4ebff90a93df2dd54a5fd622df6c33aa7e2b02349328f66ff3ac23
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/z8Q/lFTjN4:JoqtVjnmQLm
TLSH
T16FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7697251c83a269628e6f6b1bf0028086543b99b17eeec1e0fb65ae952199c55c
MD5 446765f82e1dd10bf121335872fa3866
SHA1 aac77e3b9267e0bb15bdcf5c87d9a88215fcdef9
SHA512 b25d7bb419d4dad6ccfaa096140c6ad493aebe3973f7537bf2e1b22beaf9d2ff82da90f4dd3be8f92e78e1a8f2bc84a97c30a5242eed717dab0ac4ab72242d39
SSDEEP 24576:rAhGLJIFoiwtA5l7S537nQ/tbw/2Mkjy6Fr7g0om:rAMyFoiq5LQ/lFTjN4
TLSH
T14035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 889a37c3e05189c666bab4dbcc4a99c7a07b4a3b4d37447cf7d16803e63aa141
MD5 98eb2d8e7ff79aa833802de49536153c
SHA1 d9508e02bf55d9462592d31657eb172cba763b7a
SHA512 17a236c58a31316b624f60d68a57adeda4b8fee60cd6038dbe1128164097aa5dd813ddf8d6cb9e6ec0b08d1e4de6ceaa70d2a4ed92736ba38d1d01a70d6eab32
SSDEEP 12288:0mw5HEjsChN2BFgl0WDm+CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMv:xwuHOWQnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1CF65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d00da94e2bcd3c1d780ac9fd00f70a2845862f90872bd19e286d8a408b94d384
MD5 a626f0339ddbfc5bbc58491ed521cf9e
SHA1 d7edd334d05476bdeb555012d72f9007bd639ccb
SHA512 a5659f2b299d68900f6a9e65b6e3045afb81e62812ab711377d0e3c183a8354c86d7c8ccd1d398b0fe97d1e0f800dfa7f7eae4313508a47fb336a09c90d6749f
SSDEEP 12288:pXZ1IyMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:xZulnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1C655126937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9fc6209b018c883af0054c9a9d2430cc0d99053243bbf6aee072a7f03e5b0f3d
MD5 f542dfd35b891b2a3a7668ef3f0766c9
SHA1 cc1e5ec99473d7715ee02d04f401f289acf92bc2
SHA512 ac8047589d9ff501522be99c14b6023f66ddc4fd7b8b1dabe59a5878ab441e97960546c6490901ee61ee98e4df3a179d02ebdcf6d0886909abbe29cd764677d0
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:RQRQyi36YOcPQLvw2gAf+PN3RLm
TLSH
T197666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8318fe4b336ef129937947663f2b76c89771b92cd5f10bcfd925ae778b0e55bf
MD5 28384103d62235fcba713c6e6eac95b2
SHA1 2c4c2b2f0a71291c4c15f921a34707962963eaa6
SHA512 f4e83651d19232a0196a9c3d143e99fd846ad5db3b2cf84cbad72abce853d892885d9461347b0296ab57ab929eebd8ea3a6049cb7e715d33b0c7f449096c7a62
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:bQRQyi36YOcPQLvw2gAf+PN3RLm
TLSH
T195666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e9a5057b5bcde5fac695c64667cd2cccf71c5fdb046996fbc8cb24bbe438a652
MD5 5a06ac5fc59c031c5b6f9071db3f43f2
SHA1 44eeb079d70e5a3301293712736aa3e3a84ef834
SHA512 813574031d147de5abcb5bc018a5571557e6780a8a3de6668a558a61cb7aa5e349fa1f4d91ee2f1cc443331146f47d61b14ec8c9934f3618201ab5e1e26f6821
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01nQ/tbw/2Mkjy6p:E68Qg55nhheWu7PNU3/sQ/lFTjN4
TLSH
T1D8B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 28a3fee988305171d595c0530b44a3995d441c20a0a23c5353bd3d425088732a
MD5 08b2119920f9654b6be4aeae3e7ed8b4
SHA1 b2d5eac0b0a040411e1d3917f520e81f0ff94a5b
SHA512 db5c9479400a25b433da5cbd7ed1edd4841cb89b9ed4a0d1da1144b64130937bf69fa8a79facef1073e691b2f3ef5091e29c86f087ae3935b2e08ac1f3c95707
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:dy5112gYy5azzVvL69nLKnhZeLm
TLSH
T1A9167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 121ac55236ce99f660efafc9eec11b2e16af86c0e0641eadf572f668a65730b3
MD5 987da47089485575175334f644a12c67
SHA1 8ecc418044023fffa99a6bde11430f00094e2d57
SHA512 3eb4509c44b8079a10640f172d8692900d3b7d68a1ac3e6c4dc89ea7737a0ca7ec99301a6051442cec2bf7be6de8415158478890079e725563de6c6a8c99886d
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:iu6JmVxd2dpLm
TLSH
T136D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 64d6ad1e430af325bb9ec7fb923014da37d05035fb0a0b57590a4c6eb96a6405
MD5 6411cb62ee57beb25daed2f0ea72a1ad
SHA1 772d9e6bdaa4c9337c229c128190383a525f7855
SHA512 810abda255cddd5e643ca0d7eeb5680ee3ef311037029acc4028fa9dfc927c16ef6967fb4d4d1d2e02415bdac53485a50f2eb55b0c001502811b377b5323eb3e
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xSQ/lFTjN4:QmifPbRQLm
TLSH
T188B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f65db5659462fd0a0a508d24f914772f57cb9d7afa147d6989bb8a4996e006d2
MD5 378281d647e204ebf7b58ba13a702c99
SHA1 d9fe55e4f05ba3a977c98052289dc8ab13918f8b
SHA512 8597a786b5af193eddf5be56f5016df73a46b9dd6732d117d91e4c7ea3ca6178baf55994d8982edca47fda1ef275368e029f7c95a3cdfdf52c046bf63acefffa
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqlQ/lFTjN4:u5dKTi61KLm
TLSH
T1B9C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9644e354c54cc8cdfffbbbb783558436b3477a4bbad40e8be0fdfcb0a536b08
MD5 34f0927729a25d0ff01fb0f4754bbcc2
SHA1 e2276abb8fab317b9eb8045fa0cbc9136462118d
SHA512 ab111884071b23bed1c66ac8fed1e303519e039180495ae72411e6408a61aa22a9a036179362af5866f272f1a28af851a5018dfd804ecd5a7ddd6a9706eb1802
SSDEEP 49152:KhtSn8EApI0figngiDn0AP5w+Q/lFTjN4:rX2iyphELm
TLSH
T17595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2f6ff3bbcedc29778a6e622e13d04d5a78f277998549ac2ce3c2c24e359ca31e
MD5 6fbc865729ace54f3cf5d63abe4a4a2f
SHA1 f717dab39ffeb6cc54f0f4edaa05804ef5e67e3d
SHA512 6e9edd60e40e04bac6c968696617735c5adfa17f027eda0ca40a0a52ad475019881fa09764b057c4f2ca22220217f58d936dd734bdb8107a3ec26d2f35ab2c16
SSDEEP 12288:IhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:IxnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1DC5523697964F98BFB1706F14C828182A73F0EC6BFD1938F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 01fd1a9fc5836b88e423fb2ef49a0bb86b73cd58e76a3659f270b39adbb54b57
MD5 5d2c1f7f0a4924fb880ca45e1a6f4ed2
SHA1 7ae696012edfa825d6ca0a9ef4aff9b0bc85ff67
SHA512 b48bc9d0403b2a9decc8f732fe9caf2cff39d23cbc40bb6c9a1c4b1f9fdf156719ef7ae64e3c0f0a312e0d48934fbb468b84ac35cdbbf2ffe16fb06a541496a4
SSDEEP 12288:poGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:ponQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18A5523697964F98BFB1706F14C828182AB3B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d1c8b6dc89f35db30c5fbeaf5fac6452596891abefd369d37211718a9937f1b2
MD5 63f9754b55d60838178f7447fa5f6748
SHA1 bf6c53ad3a582f19fa0809b09c2cb075a06af828
SHA512 42c95f0ab75169421cf2b69a1211f4c0a5eac403497c87fc18d1be32c02bebd3d37e235b8e0acc039af68b74ea87e41f63377de20be4ea18491108a7871d2467
SSDEEP 12288:T6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:T6nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1F25523697964F98BFB1706F14C828182AB3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0f54fe0a45094d580ff23406713fd22bc840d62e003a329cffa55239935f33e0
MD5 7807117f400ebe85189245fdc3dc25b3
SHA1 60fbd2a027214413fba9baccb21b64f7295d60b4
SHA512 1496b4e60711d48067a99ec0fd170ef6ea8c17284b8ffb8408c10f94b41338f7f3aa7c6a0705532ba25f6ebc243a3237f1cbd61fa07455462e71cdc9d056175d
SSDEEP 12288:KVrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:YnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1605523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c6b9607093a941432cf87dbeea95c2c95867110535e496b08a046237d49b30c1
MD5 b451336559fc319bd958a7d430413739
SHA1 79beaf305d15c15cfadba6a5d0e3eeaa9eb7e4a1
SHA512 2a648e455eac3870e2d22be4a0b659d82d9b8069b59cf9bda65dc7576f609257fdc9ab50156c2c330ef8b51df7806c7889bc31bf34b9e16f172ec4b02c4dc991
SSDEEP 12288:JjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:JTnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1D95523697965F98BFB1706F14C838182AB3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e32b76379fb6423b9f5166f436bb67915005d31c425b6ef1a7c4fa98961ba9a9
MD5 75639bc45218eb1ae15583593b74cdc0
SHA1 526c56f35bc7ff549daf3ec34e5122bfd1919124
SHA512 cd1eef8b008dc33cc0d43efb1f3f87a4a5fd04011fc25b25a408110d6e90015893a68174114af74f5c3545c8ee8d1e1463087e80bc53bdac2facfc22f0c4fe3a
SSDEEP 12288:zEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:zknQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1B05523697964F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cf885212113e78c43c903338984e09e7ff85a5396fa75f097e5c92cf3012d309
MD5 01fb6c406e53971ddc6574ca59f17657
SHA1 647f3977d688a0d88655ce2333a826dbfca882ff
SHA512 9c28a7439a282263aa307093fb79541f59016adb49802e7534c1854a97962dcd3ef46dc2056f365a5435cbd37ee0bd1f465512ae31c92b078c2f30693558b012
SSDEEP 12288:FAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:FgnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T13A5523697964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1a190d51014385b8d98e716bc0b9fbe51b48a3a690da2ed364d07b7ecd953033
MD5 a0c14d34cd7abef42fb52afeacaaf283
SHA1 939243d3ce166c2bd3dfbadea3d426cbdcbc4597
SHA512 3836def0743299aae66d0b20e826f46e99a9daf250e61b9376161338932762a7506d9b60fd91f94dac5d1a11a3ac3d4978d89fafc70065ea7fea9e1a7d5470bb
SSDEEP 12288:HiZwbDzzFEoS2cPvyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:CZM3zFVSOInQ/tbw/2Mkjy6Fr7g0og
TLSH
T1797501A5B35058F9EC67423ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 20374e102727bfcac5bc090e302ae3324776d7cfd7104d1b3ac68d6b01cdb684
MD5 c56a35a326a21b8bfbba9aebfd4de266
SHA1 90478d6fe149a72c3646d7bcbf84c8eb6c7926ed
SHA512 ac040a3ea478ad4e25a253e633d139c60ce7b6dd957d1f153516969a6ed8f72d885a8b5ca16e0c1ad21a7662a21d9f1799e0e6e3d23f95f9bf2c43552949a3e2
SSDEEP 12288:Q1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:QVnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T18F5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5261d6db544b8c169ad05fff87e6ee880399fbd1b2ee969980a1c3da046070ca
MD5 86a18736a9861897652ef38542adf30b
SHA1 118477e204716a8fb3d55f9e09551a6fc69dd752
SHA512 d49f3396035d242d39ef94ff37e5f580d27358d9127060190003222e933863cd1b67256145325036e6e782d7a4d0658e729de905b7dc3fa06604c01206d9b5f5
SSDEEP 12288:eJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:eZnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1185523697964F98BFB1706F14C8281869B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 823ad84cc0511288e7063627ac91f536fd0dc84b3c17196add1740934c27034d
MD5 b7169b34792e3371df7f83641867569f
SHA1 4c912a3ea1d99bf628924709ccbf3ba78e7c2e7c
SHA512 0e4a957f33d5cb3bb9befaa3e74012152d79ba53e429e9f7d9fa5ef73325a34748c27494c27b16fdf60c2add4bc896eef01191b62122364758bec3dba91b0718
SSDEEP 12288:ZyPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:YzyMnQ/tbw/2Mkjy6Fr7g0of
TLSH
T10965021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b11586a922ac3c1d6faae612981c9ae1d0b73ab339c552c22e4e307ebbd0f0a6
MD5 0f974190212a58bb70f1ba9319b8896c
SHA1 b49f3936753a6da25e8abb0289bb6caf965daf71
SHA512 c7f500dd14d68afa90b28ac85f250b4eb673023def4edccc631e579c9274d3989d3f973088065ef02df22335c5eab3425bfbc153541e32b3c04232a8f4eea9fe
SSDEEP 12288:m1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:mVnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T17F5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 176257825c8edfda7db2c318ab18cdb1cf61af1881619e2b07572cf009ea847b
MD5 4fb8b84d0adf3f07405c7bef3791fb9d
SHA1 d0872f76217ac9615b8a67c635dfcc7dbbc66ad9
SHA512 aaeaa91b2ebe84def1deebc98c38b9ec30e64a2d83f12555fc0416123f40b3da47a3339ba287e63901ef9b20e48287831e7c7978c75603c35a689b551a29c6fd
SSDEEP 12288:81GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:8VnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T15B5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a623bcff38116baaac626e4cf8e22ddcd1cf51143e517e8ff684b447b4dcc8d5
MD5 e28c0fcb980cf87afc182f41d8301bf2
SHA1 14d1653733a04d93a7770597e52eda1d23693611
SHA512 79f012919af1959ff586d90477e85f05648901b597ec8fe48b6f37816ae30bd3056c5beca87f4ab1d557492bfc58b20a71501ec07e06f5d9e3ae8e7dda19a0a3
SSDEEP 12288:byPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:WzyMnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T13665021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 dfcf0d833f4acf54cea2ab2b7bd2ad37d2b4aac1efb60a0e2c23b7677540f46f
MD5 ff1688afb899ccc33ad869a00dd4853d
SHA1 899e67ceb662e81fd85a0b4415487e799f7416ad
SHA512 fa4ef39d98e0f8e8ece915a7810958170b689e64bbf7f37ac3573b2a461e0fe6b818f045a4d1509633fc6701fb3cad00c97c581731157b06610e9ef5e577701a
SSDEEP 24576:gT0aLl3z0zDKnQ/tbw/2Mkjy6Fr7g0o9:gTDLljHQ/lFTjN4
TLSH
T1E87501A4B35058F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 641b40ed5722ed89c3e3ad8dda319f058cb3c2104e5f28c0ae12a0db729d9b26
MD5 365b812895bf5835bd4b7e9ed3b0bec6
SHA1 1bdcea08703e5b79465788a9d62ab48488acf9a1
SHA512 0fc11c6e89f5b660bd928b2f2d21392e75ce3e3cf9cad241020bb1d8783f2ba82054b1b8cd5895c8dc99a494cde79e523041bf8343f179db91ad2a94dd5cb167
SSDEEP 24576:331d9CHKy7GZmnQ/tbw/2Mkjy6Fr7g0oN:H1d9CHKyaUQ/lFTjN4
TLSH
T10F85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8401224a1a8cf5d5dc28b20dbc616ce2b14950cf7cbfb57fc4bdc1e00a0709fb
MD5 21c5b97b7a16bcf7b7dde4850390dd02
SHA1 0ebed96f7f3cef8027c00dc424cf2993d67e8bb4
SHA512 9bc62fca2a837385ec4a83c04d49358e2ab5077d3e70aaddf7bc40a5555187ed3780b78080fa1ad950b8776cb4dd86789d25833a3db5a0ed7ba7445e2e35adbc
SSDEEP 12288:YaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:YanQ/tbw/2Mkjy6Fr7g0op
TLSH
T17D5523697965F98BFB1706F14C828182AB3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cd092650a4c5869296d164f3c469fbdfdf658d3699959ce8baeabf78238ac2ca
MD5 763a7413a28c514a21c6ee8acf1732cf
SHA1 f686bb1c83b55b58ba62d0314c01b811c4d0519a
SHA512 a863a0e856e73e6f81499d0669b5b467ca90c2a51d1e776b89946a65f69bffeccb4464afde6a2877201c5e4d57d85f3518012836e3f8069c55949a9f957f37da
SSDEEP 12288:TsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:TsnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1015523787964F99BFA2B06F14C8281829B3F0EC6BFD1938F7B481129967D39406D63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2aa3b42b9550733b7a3053bb8e1e15e71282103fca45370816d9f80918722f5a
MD5 9b5d6a268250da98fe64623dbfa67eb4
SHA1 6eb608473b157404f1165baaf1735c4e7959cd22
SHA512 2a853d83eb3ab17f6c53237bea41603eda2ba0aa9266646a18eb3556ce2d175635de59f667001442f8a1bc1207c8388a87a3ea5787d69198303b30a73132104d
SSDEEP 12288:ZfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:Z/nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1C35523697964F98BFB1706F14C8281829B3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 be9e93c4e07b53874381de7c24ee9477ba106b1ebd18a29a9f791dd0854ea5ba
MD5 1303ba6639b220d9b9c30f42a955d129
SHA1 b018bb8379eb53e36102e210a45ffa2040509485
SHA512 c12f2a4818433d645d84b1625b4d5024b23520b44283a3942ef4dffd10c59562d241b0b83a07bf5d51c876806274cf77ae4d23f2043ff7ca64f0889944eeaddf
SSDEEP 12288:s1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:sVnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1245523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bb76144ac7d4e57a718dc377b0a627fb4318ee797b8afe55d9b797b103274487
MD5 07f2f67ead80efcc69c6a344dd3bda23
SHA1 197ee937fb8dbff22d01b5a955817812ffda99ef
SHA512 c2564fdefa965b42351dfeabefc149e79730eb1154903744774a058d3a4f7f638ebc7b385b3cb57938ab134ea65a18bd8afdae161d0f66300013052d4e6d5533
SSDEEP 12288:3aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:3anQ/tbw/2Mkjy6Fr7g0o6
TLSH
T13D5523697925F98BFB1706F14C8281829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 55fc5f58ddafa7fadccc1a372d47cfe5811514cf7050693af729d2caa8fcfbfb
MD5 7031b0cfb019a91635a8d4f1fb7249a6
SHA1 f6741bc564e26e7728dd74a3175d983217c1c1c1
SHA512 2162aabdf59bde282d7ab92180deb9e079195267eb499faa5a33876a193b45256b48d6887b2c8f88ed804deeac4dbf43806e64e24cdaef4af0989eb6487bc2ec
SSDEEP 12288:lNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:ltnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1DF5523697964F98BFB1706F14CC281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3f946a358337a8ae9f7d9810493ca1262f511e7eab5cc91d2389656eb2660766
MD5 2285c296cca2619aa649c90191b7580c
SHA1 cc3997fdf8f9745d05e6cd6b7db8f9d374334c60
SHA512 646aeee0bcbe7d9c63a14014dceb1eb826956e1fd669c3829530afca73d44aa5f0ea5e673343c0631501e30767b997b972c30ad75b0e3c32489c3350eda62db6
SSDEEP 12288:wjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:wTnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1C45523697925F98BFB1706F14C838182AB3B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3ddc209923e3446ef8b3e2e0ebaa95310af42f7dede5d5cd360d40bf2d3422f2
MD5 f840706bfe3bfe94bf3ab81bf99e3aab
SHA1 1b4f5273712e62b3a42efebbed5b35d4f806b809
SHA512 eafe3e654cd51151b592390c5ba7ad6dc4b8efc842a5c9035f21bba1a22cf4415b11f9056f25ce311f7b3a9fa24f7f4c07d00b95e967114444a155c7fafef46e
SSDEEP 12288:wiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:winQ/tbw/2Mkjy6Fr7g0oe
TLSH
T15E5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 77e83525a18ef5f38eeed0c66cb0cc1946167ede2e9a42bf9b68243d71563e17
MD5 f4a7dbb179993237a710998d8d28eb5a
SHA1 b33f5887127d5ec3a156fe40cdb01da62e36201f
SHA512 d2127b9a21a31e61e81e152d5eb4d7f104a9ba83195b291e2ad5781219e53746f230992a722b5719eeea6a1153ce8ba7d446283641e326ccd36f4a76f06a03fa
SSDEEP 12288:qjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:qTnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1665523697965F98BFB1706F14C838182AB3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 8a15c8c7dd4546ba12f9e74a3b494938a2e3768d04805e6119e623dea880808c
MD5 4a6cae0db931eaf7fe1465ef09eb5acf
SHA1 c3ddcea59717704865f734975635cdf41a1cac75
SHA512 9c644046aac5910eef802bcd2ed8b2e04a7c02c91071fc6d589aadf0d678c4165e93aac016250c588ad0a8ee04ca8dde2be0aa239f7c21f696fdc635952b09bf
SSDEEP 24576:afwv/k9RX6wkyAIJnQ/tbw/2Mkjy6Fr7g0oQ:xMnYIJQ/lFTjN4
TLSH
T18D85CF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f3b62b0722e4d95a6e04478e1755a682e49019b4b069efff4f8aa13c72595a22
MD5 39415213dac0c34ffd3850bec1aca7db
SHA1 608874d2f7e4de020416a8a294736ee3bb64b030
SHA512 e932cf93721ffbc6bfe84e31b195eb102579e1943aff8176f29a545f967ddf3e5f36450808a858c3fc484ef71252c134026e588a71e577a35c9b52fceca95d82
SSDEEP 49152:0YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eQ/lFTjN4:6ySzPxLm
TLSH
T1C6066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d460e4006eea971393df55cb2fc397694e7386ff36e28165d83c1e551c0cde1c
MD5 0ffe27b37dac5fe315de1b5506f85c3d
SHA1 f8c391058f27004dd8816593ddebae82c966d159
SHA512 1fb4d6c610d0654e83b51fb35add4e9f767f8e5ed7f1c3bf7c1dfe664054ea5dd0a58ef00eff74fc94460ff7db4bd0229d6f7720ecba8753a7769a01ed4f2130
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4nQ/tbw/2Mkjy6Fr7g0oD:147JUQj1irIhCnDHUPfF/OQ/lFTjN4
TLSH
T1E465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3e2079dab112d4b2dcf860334f23981b85616b3aa041a0fa2dcb0bb26a0b06f6
MD5 f8b5af97f4949e0df2660ea8ff660025
SHA1 998dd2179ca10e20afc9d4072f611db6a55d85a9
SHA512 2bd03e3162a56a8259fbc2532b3cdbd38ed46ba0ad1970ea50ed85b519cc69a8e16ef60e26bb2c9d95af630a806db9dcbb87254aa45ed8a922db0daed99ab22d
SSDEEP 12288:dssfFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:tlnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T10365F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 acab19817dfefa5715f25b16163bbe4e6c897a62370adc999d0066cbe0af896f
MD5 b59072ca130b95b1faab85d3e9f909d0
SHA1 44cb453d9d6ac9b77abc0e193485fcbc0f06ed82
SHA512 cfd1e9721622119c92d2fe61d9dd64cdc7f64558e5c44323f7b433db16ee102cb2c882194e4c04ebb9bd34450729f07f55a03f281e5b7c193e26d95d1e84bca5
SSDEEP 6144:zesBC2naiLDbal3//CMQ1otMxE8oVU3fvkVNfXu38LlYQbhQIyOmRX8uVAcku6Ev:zrHalXJU3fJQhcsBc6EZwm+nnw8
TLSH
T15F2517007666DB4FC6A944321E33C6CCAB707D41EE04AB0772C9873FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3745ba2aabac5bf86d8c9a318b776de650d04fd4a7f0c99fd01d65b9f8f28b47
MD5 6b147a6bce2dc65fc1c469715eff0b3d
SHA1 625317dd9171e8b654dbdef395ae9ba067ce0f3e
SHA512 5673243613db683d3daafe74774c2823a22de19f4b665d7a5f25e00ff56c3c9c892a67abad400b4e4c5c4b7bef16b36d373d680b12acc7c46784f0a9d1fb9c0b
SSDEEP 6144:dDnKy73Oj9RCi6tx5K6Srg9ECniI7cQytMx4dYpQytMxV2e21VJCStjdUJ43oYHo:dDn57uLKxIg9wI7eStjdUJtgo
TLSH
T18865F8806136A78FD1F76032072A5B8C67A4EC07B7056F27B3C9457AD86AB05A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c5a497f7fd968f239e216065738e4c014a8b0fcf946580225441e659deea5e5c
MD5 62060e67dd0cb37daba1e6dbd4805670
SHA1 0d3f7c82f679d401ceadbf0ad932e676c160ebdc
SHA512 ef3af6fccbba2702617a39b209caa2959b81eb59e180985291b098fec05d1e10a3055877a68abb22eb97a497610fc47236a204d7429efca396bc7895f358f67b
SSDEEP 12288:H67dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:O9nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1425523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9a703ca687a2554ce48fb4c34f08e1d214c29bb43a77a95e2be5e52257d86823
MD5 8824d16a183056f5b19f37dbe1246bbb
SHA1 2a3ee0e2edebe9e7dc2d3c7e9524337ea747fdd1
SHA512 000a07a1b2eb54046b96b5bf06d7ef059901bc203748ef1ddf4157ad28bd62d403187b21ba598519c2189fe55c59b66942f214cd7a95c49d1b1df45d1161d91a
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYHnQ/tbw/2Mkjy6Fr7g0o7:Ygb4mBIBhGF4Q/lFTjN4
TLSH
T17B65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4d1ac4a152fadbb60949a9e188068ac2d2fc07e88e031c1b270633e8b826e500
MD5 492f8d1f1db8e168808551f3875b1d9a
SHA1 6f8d11b8dc7d958090b24d84953207dcc5975cea
SHA512 590730c16ee8d397266254be44dd20c786f4589345eb11363c09e73adcaae437941c0c55f0f8b6ddae2c86f52f94ccee94cd75da4ba3155eeaea9fa19a764864
SSDEEP 24576:fG88u8FpJqH1Qzria7/mInQ/tbw/2Mkjy6Fr7g0o/:u7ZFPqVva7/fQ/lFTjN4
TLSH
T1E485F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 66561e4eacb0978f64746c05d76c5416bea0be4ca3752d2c497795b5acdc8ead
MD5 21d5b2d1ab008125444fb4c06196a56e
SHA1 5cb2f1302c855801c40da147e20d0fb44ff731c4
SHA512 2f7766658663956d3c40fa28ac2a34692495a17f02365c67d063cd89eb090df14f8da5bad72e8298cef9d6020966fe1d64e6d951961e587d4d5bec4fc6274941
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkQ/lFTjN4:hG05lO43bGLm
TLSH
T127D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd862f96f9e461e77b2e11b794c0864695b1c95fa62330524a55c325f315f61d
MD5 efd2bf043b3d7e93e36b6d3d7068b48f
SHA1 4a04bebb10c70189619ec21e526824a08d3a7e09
SHA512 2391a4b572b34f1faa669c540eec6eb776f09ac5aa82fd9d76f0b26b8d7dce254c917506a705de2ea7ae0c545a896beda38b00df8b71b5adcaedcc3975f479a9
SSDEEP 24576:tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnenQ/tbw/2Mkjy6Fr7g0os:da5POZ3+Jt2pasx2+msQ/lFTjN4
TLSH
T13A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b4e61d54440b5ee74f3c505ff05756bbecee556167e6fe0aa390fe78f10df30c
MD5 dcc098dcef7cc4c3f2b1ac9d504e9fbd
SHA1 e9409ba2e996602d9a05d04ee3303572192cd80b
SHA512 7a86bae44ccc08990769776d0de3d7c6e1056ce6fd8f77565b17e3ef0ccd24b5dc6288b13e9a9fc5e2da40e3dfca8ab6f3a597622fb1f6089bf75714b36aaecc
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkwnQ/tbw/2Mkjy6Fr7g0oO:9Nc/zEOVHF/Q/lFTjN4
TLSH
T160858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fc0db17c3546e9b9f3ce48e75cc68adb281aa87a3eb9207ced6a1ccd824a2a52
MD5 5d444413cd3eda36737ed5a1930d8a70
SHA1 4d9fe254fd721b6d26737e05344431f7aa407bae
SHA512 2a46dfe993243edea103c06dabf2fcd013e0d6fb25d8c097a5b21bb3f065c56b57437eed5ae5351da7e48ddfeff7d78904236eb9089350a85dd687e7b916b645
SSDEEP 24576:88kNvNnaFeYhJNtmZBminQ/tbw/2Mkjy6Fr7g0oZ:88MwBtOmiQ/lFTjN4
TLSH
T1F255AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 322097ee44a261ff5f4fc42f927bf641af1e45b0750d964a5027d89ed226005e
MD5 8c433ecc02a40126a80af99a65ae30b4
SHA1 0bbbc66219396d03c45211eeef06960fd4dac76c
SHA512 2ae774c65913e5746049849aee02daa5ab1c782841d0233c29b64f598f8febdb860ea1b62ec35fe2a8a83147af4f755d4cbb822779abe039a4915acf0ff4f8f0
SSDEEP 12288:YHvUrBFrEjwaQ0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:YPUr+NQUnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T15265E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 326652912f55c8fd09750a05ecc5dba1e17033b72a743f142a774d5e54579bd3
MD5 722fb18651dd65f26e9c269a2f564678
SHA1 220bacc7d50a2e61f0daea442817f4ff686e4b79
SHA512 e7b2e7e7976b2e60aa394b1ac4b4c19558628599515d5c9556d6ed700980413a5ff099e6be1961056e2e9cc5a33c71dd27094d5529c1552a43924d714561262f
SSDEEP 24576:5D3FHshBIYQgARnQ/tbw/2Mkjy6Fr7g0og:5DVHeBIAARQ/lFTjN4
TLSH
T14475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-31-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/108-49-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/108-51-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/108-47-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/108-41-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/968-316-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/968-67-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/968-66-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/968-73-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1164-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1164-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1164-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1164-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1164-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1672-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1672-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1672-0-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1672-9-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1672-327-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1672-323-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1672-77-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2084-397-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2084-395-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2084-108-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2084-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2084-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2084-102-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2388-381-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2388-126-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2388-128-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2388-134-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3040-146-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3040-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3040-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3040-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3040-151-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3044-114-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3044-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3044-378-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3044-120-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3044-380-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3728-382-0x00000216AAD50000-0x00000216AAF1A000-memory.dmp

Download

memory/4260-86-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4260-320-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4260-79-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4260-85-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4404-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4404-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4404-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4404-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4404-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4752-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4752-40-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4752-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4752-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4752-64-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5440-155-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5440-156-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5440-162-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5440-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6132-90-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6132-96-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/6132-91-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/6132-321-0x0000000000400000-0x0000000000542000-memory.dmp

Download