5495bb86bb7d8264011445b06bda3cbb5030e783a6ecf3b95e8eadeb84b51cd8

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
Size 1.2MB
Sample260708-m5p1faew2s
SHA256 5495bb86bb7d8264011445b06bda3cbb5030e783a6ecf3b95e8eadeb84b51cd8
MD5 eebc69236dc944b9ad7ee1d340b7ebad
SHA1 bf0f6d88853c19262a307efcd342c667210e4447
SHA512 cc167987fa3b3521f69b1f4ebc7f217edf8047b3590d46b5133088fb95cb9e6c4c94130a4900ada0fe469c216ab757d4ed8ea5d56f721a5f557340e9983adecb
SSDEEP 24576:hfjAeisQn652vOdJYcpXG1zT/CRaY5oMEvDnDF:hfjAeiz1QYcp2ZT/CJ5Gvt
TLSH
T1B145D106FAC55EAAD419C33442478732B732B88D5B23EFF7138492313D666E56E38798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4844	elevation_service.exe
4324	elevation_service.exe
1804	maintenanceservice.exe
2268	OSE.EXE
2276	PerceptionSimulationService.exe
1148	perfhost.exe
2448	ReFsDedupSvc.exe
4824	SensorDataService.exe
2052	ssh-agent.exe
3268	AgentService.exe
2084	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f5ac43e0c50b3491.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132250\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132250\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e6f63a66c90edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b735caa9c90edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000050bb64c90edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016f93565c90edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd732465c90edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4921daac90edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
4844	elevation_service.exe
4844	elevation_service.exe
4844	elevation_service.exe
4844	elevation_service.exe
4844	elevation_service.exe
4844	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	3268	AgentService.exe
Token: 33	2084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2084	SearchIndexer.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4768	2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4844	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1056	2084	SearchIndexer.exe	99
PID 2084 wrote to memory of 1132	2084	SearchIndexer.exe	100
PID 2084 wrote to memory of 5380	2084	SearchIndexer.exe	101
PID 2084 wrote to memory of 5612	2084	SearchIndexer.exe	102
PID 2084 wrote to memory of 4652	2084	SearchIndexer.exe	108
PID 2084 wrote to memory of 4204	2084	SearchIndexer.exe	109
PID 2084 wrote to memory of 5984	2084	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_eebc69236dc944b9ad7ee1d340b7ebad_akira_cobalt-strike_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1804

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2920 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2768 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2920 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2768 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc85fff82f3b903976e9f4b8709cb628820b190ba4c10ec6a5b09bc1e93bb505
MD5 2f0c08be6d1017359e314041ae78e798
SHA1 f08c95ea5f113338790c4b6053d216325cec0071
SHA512 c96e62d1edcb9068c3b2deaaa146afb78183f67241eda5ee7b5cef63a2f7355375187e6490567d8f10215de1a41bb49101265b2d327aeada47216ebe8307c1a7
SSDEEP 49152:Nb+632BuPkFKRrdE6ohQstBhuXjfS4LWxngp2ZT/CJ5Gvt:T3q6tjBR8/h
TLSH
T146D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 291aee424c987417f5be488209a07315d536d7f4a0c4cd019265bd5940975557
MD5 3f1af623f6a496f610acb03a683abdea
SHA1 a7e0567524a3ca743316005b15808d375e8d6df4
SHA512 4598fda227e1603c6ee7bf897d345297fea3950fdb4a4ff001f6e8a57958228ab1d32d9615679bc6d372d51fa1ecb85b9509a2c109819a17c738579b350fb883
SSDEEP 12288:l1XLsswWkxy2lRq2czADpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOf:rXYfDtczADpXG1zT/CRaY5oMEvDnDF
TLSH
T15585012863D408F9ED67823CCDA1C501E6737C9547A0E78B03A499261F337E89D7EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 fbde6bc036800f74a8ae44fc0847361d756b4b2e3396ea7a1721b90ece1abe24
MD5 5efd648bfefc145541b941a0baa6ca85
SHA1 bd7d5209acf403754ee2d0ae70f98f5389a6eb2c
SHA512 e09a5d8b2b85e5e51eac9fa535870d720455e0e46960498577b7573e31a54d42b5e467238cad7cd53df2c7b50f3511b4dcc121639f8da2028113e49d843314d1
SSDEEP 24576:C0Le5ji0hmxtrM4pXG1zT/CRaY5oMEvDnDF:CPji0A7Bp2ZT/CJ5Gvt
TLSH
T168959E16F6748731D073C0B9C5D2A68AE97230865B308ACB4286D77C7F67AE6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 421068dcdb73dbd7bef6335db21538dcf37a063d953738b87651dbc635a0eae2
MD5 2ea4d3dd6bd42f28db92d946c13e0b5f
SHA1 6c5c02d5cc3f5b1fa94fa57ce98cbd58bb63e471
SHA512 817fd4f80747207bdcf5ba091afe2837a09f2c3a319f5a1760db577c8a5d88d3f79ee1d591c887eb1aa1195c3b086df80fe42cbf558980010d6415120387d38b
SSDEEP 24576:Ia7/ezSC6vUyDZaqgrvWx6q8wyuCpXG1zT/CRaY5oMEvDnDF:P/ezSC6vURPvMHjyFp2ZT/CJ5Gvt
TLSH
T1E5756D25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d3781ca2187a838d81593fcbff3225e5d46232830279920fe21badb32ac0c73f
MD5 e4b6144f74029c2ce1e7db76440fcd18
SHA1 7e13fbe9bd52c7f238ff8ce489a4121f50cd44dd
SHA512 819181746dc4b89a6ed1a770d8a74ea5336c1bf9d54417a6d4885930ef951b46ff3b9a5ab84dccbdde6ea5928f1a399d9e9e20c861ae8ece3dd0f10d7a64c670
SSDEEP 24576:sVbqPb88hv/lV7PpXG1zT/CRaY5oMEvDnDF:sVO88hXlVrp2ZT/CJ5Gvt
TLSH
T1E7559E66F5B48331D073C0BAC5D29A9AEE3234425B31CACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ac22adff42db7387ce518660c355c01ae07c35f480505f99c89b9b18779d8f6f
MD5 835d03f64a446ff39458e5962ac4444e
SHA1 19d1ef154edc91d51e056286c787bd7ae96bd700
SHA512 9532965e718fcf62e4a5bb625b6db5759d50ee2b1930405611f58670596ca4d4484a60a1552c0d3c25ab14c7b52a4aa5455ad592080fe3d8349e54d2c0f4b970
SSDEEP 12288:C0kpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOZ:C0kpXG1zT/CRaY5oMEvDnDF
TLSH
T1E76523E245C80CC6DFA647304EB9C684D6935DCDA882C5072626BA16877CE3CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 bccaf5fb876ec186fb5709304aa8033aea3f96dcaadd88b2d2b455768da9df3f
MD5 6a216fbb4eb4dfc0d159bdb1930d1a33
SHA1 2d9c309c6f7128192f5b9f47bce54b1576b70bc7
SHA512 3a913afd49d0549c87b87e90deef2d8eef3581db3062a8dbb6724b7bf5a20ce6abbd294ae015b1d839e95a6b1875ffdea334c83f659738c478b976c67da3c25b
SSDEEP 12288:YeBNUbTVO86UHpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOd:YJIUHpXG1zT/CRaY5oMEvDnDF
TLSH
T1CC85CF7BAE28FCD2C67A8D785B91C600D77278704F6293CBE165820EDE235E44D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f6187fdc6e8c9fe7c62b8453aed1d95297ce0ba45b127e37693933d3217df8ac
MD5 0b63a909d953b1303330530abb35fa13
SHA1 0be031d56d590fc3e722e39baabdf1550e3da08b
SHA512 0354c6e8bbbb8fa109a3c10e6376cadffc0dd4b7315e38e9314bb43676266f2ebbac12291960be21d7e3e22ae3d4aa16cb132029b7909137afefa31da97239e6
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THo:ZQvGAdlCEL8c/pRNw5CA8/h
TLSH
T175267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 a4059949697591f3d7c96f87a345396c1b1808e1c580c8e7bccfe3db491f84d4
MD5 f2feabe29645ba4453cad9ad66e3927b
SHA1 8554c99f5f7d4012e937ac24fa9541fa376bbffb
SHA512 2338734b56be1d5b0f0e832a6348aa54b1c6979c42a9f29b5fb39eb48c49473dcd09582350c1184e30efe9e03912e6e59357628277f7857a6f3fec8e4ff86fda
SSDEEP 12288:VAwSfxL/2Dc3DDLLmt0LDQewsAjRpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstFX:22ewsAjRpXG1zT/CRaY5oMEvDnDF
TLSH
T18685E031FE74D432C7BB0DB11B36C706546D79604B521AC3E3A88E9E5A342E26376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3b1bf2608dec1f32d315601f2e2e54f338217cd4e880bd2e959286f7735c8c34
MD5 22149e39f4acb6bdc15e12808c6c951b
SHA1 b63ed527dba9e437b572960023d73ed2687cc2b7
SHA512 1a5fa4503debf84c1bd8bd9f2580078533244ebb6912fc1a3b17cdf4aee5542ae6781caa19c1e6c62ef2679240de022a3507a6aa44270eb7422feafd757e35c9
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHr8/:8UEtQevvqc2W1cpV29I32r8
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2b914a56161315df3d805b503216846fc5d1ae9589fbf86e2dc0e99acb8d4dfd
MD5 fad4111f37033ded2482c70221a57a08
SHA1 8aa804de206e69994cb10c58538ca86672553171
SHA512 4876170ed8a978c4bc31782fe38454b157fdb0ee05bac56e54e581b255c2e875db11217f7a66ccb2fddb3a03a8f0cee9f78fcb24503a2b70aa28d61e70417936
SSDEEP 49152:aCbRquA/m2yL5zifFiV+XenmE3/zxp2ZT/CJ5Gvt:voqHVjnmU8/h
TLSH
T1DDD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c05aaa2177bd3a709aa147c5211b3a553c548b6a56d4205f44628d846ad086bf
MD5 bd17c64df00d7a5c8bff4f9d799bf21e
SHA1 ff2499a9267a8f17b751b3bb9e62eca226713d08
SHA512 a147b642c63f445f0f5c55bfb3335c6f728d0e143c804f25689c4b30844fe4c0bd8e890ae2275f9af91ed518f38aebc1bba21365e223b5d209ad60f6d9ad49d3
SSDEEP 24576:DAhGLmIFoiwtA5l7S53GpXG1zT/CRaY5oMEvDnDF:DAM1Foiq52p2ZT/CJ5Gvt
TLSH
T16B359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c8418a46bc590c0fab2b4c8d8ee3dec54b8a8adc536de03af3ef4040ffd9da71
MD5 1fdb9fe10fe34a01c81dfc057e1d7b76
SHA1 8bf3772a0ab24a673981fab07ee2eaec3a2a263d
SHA512 9aea3fe194cb3c63738988de5250cdeef2ccba82294aa3ebe1ad4c1b7cd0d96f9bf8c8d1409acc3f2c9a5c30ba69adbcaff02bb04c18c4b41b05daab0547d927
SSDEEP 12288:6mw5HEjsChNQBFgl0WDm+CipXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWN:TwulOWlpXG1zT/CRaY5oMEvDnDF
TLSH
T18485F14676E40CF9EAA782388A97C135E7F3BC452A21C71F1760C65B5F37321AD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 1a17fb404c88881c9d0d71a3cd298e18ac3ea5a1ae215f0ffcc364c0e677779e
MD5 3b6e6227e28001dca86aee8de8f934a3
SHA1 96d7158ec965b34295e02d7296582931fba5fd05
SHA512 eb59b4a782fd4646ebd803b7b4ec2368a670e87bb40286a2d01fd48d4ef5cb640bfdd6aa1a33ced737bae88cabd1cdb57505442a9d09dfe8375620065447dfc1
SSDEEP 12288:ldZ1IyhpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOh:PZuwpXG1zT/CRaY5oMEvDnDF
TLSH
T1BA75129A22D824F5DAA343388DF58644D3B33896677283CF1625432A5F36EF58C79723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 591eb2b1129a80fcea8dc6b27ac4723c5e7be7241f543882db83ad97a91b681b
MD5 235facf12a9310033af97ec7fc6b07c9
SHA1 f2ec76852504bc700aefb2139acea45e0b527a92
SHA512 0a786604ebe2040f7c4cea7d59330dc397610d380a772a685ceac8f71850fc9e82782fda362387ac5cbb87db1508711a9910f108b7367eba84a0ff728abc9956
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UU:yQRQyi36YOcPuLvw2gAf+PN3d8/h
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 caaca369cdd060c5bbb48bb0473b619c877e90a995f09a4be6314597a4243fc7
MD5 f344fd650add704426f7c7f367b9c657
SHA1 832b7443ddffa5fa0e14ab578e2f7f12369c26ae
SHA512 d40a8d259a71730595c67757b7eca0dd26714cab4f3f4f4159ab09a95f97a3c282fd62e10e52b2eae272e1ff19f549e84d86ca2f90f717faa29f4e74529c7d8b
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UU:iQRQyi36YOcPuLvw2gAf+PN3d8/h
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4ffeb9ce40e69a6351cd21657d52cc9374308f8750a2ad2fddbf9ba9f2b391c
MD5 ef243b1493d45d447442aa68ce898750
SHA1 66d3a7cc7f60ee15ca77498600cf1ae57c1cd4ba
SHA512 9545a77f94b532a6956be236db5f8459ad3895e14c2c0dead0f62ad01e989fa252202f5e44026a3589ae8710dd4b2dee0835361636fc30e5edf3eb6cbdcbf329
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0gpXG1zT/CRaY5oD:c68Qg55nhxeWu7PNU3/Bp2ZT/CJ5Gvt
TLSH
T1B5B55933B2F60099C44DE1769F4A872196D27C758FE1E3DB851172061BB2AE07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c39032311901e884766ba656ba61faf3afd58a5ec18396b4bdc6ca6d3bec4a10
MD5 0a61cb3ebe0bcb3c226bceff40146b64
SHA1 0715873ea9a8a08cf36cf167503ad8a49e399c9f
SHA512 2a0805f85a8509ab313c120a9d213e7eac361c68481ca28b2ee575059fb54f870715385f2c00c31604141245c8991ed8c16bb3c5a988ab01a317241eacfe66c9
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:7y5112gYy5azzVvD69nLKnhZK8/h
TLSH
T15A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a3c5eb9a6abfc4234aa020e4bc9f501494cf19d8ae914832d67322191d13729d
MD5 378ba593b9ab62e4b310f9b81001b617
SHA1 816e68674f542dcc1ace02bf9a5b70ba4108b699
SHA512 3630d8f3fa2a6153710cab29c66a1581b4491ef4f63cfce8eae31130e527fb3af9029a76354383814edf5805a9f8a7413667b734a52dce4e4429706d88498dfd
SSDEEP 49152:CB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glzp2ZT/CJ5Gvt:wu6JmQxd2dl8/h
TLSH
T17ED59D13F1D901E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5dad8a89e804d48b71a7b35653d3bebef56856bb6e8d748b9ec7ea1b2c48c834
MD5 dcfe0744fd488a1e2d8318f79e8e94a2
SHA1 a5a79b4eb981f1bd187d5d5817f87137a8ac983b
SHA512 e67818ca22bfa5f9b8ff28bf53f2868d9d02c62e600fc8241e4f7c6a6d4db41e3c6a24048246c765fd934eb9950895b3c2d3ec9b2ebbc466634463b7f08dd1dd
SSDEEP 49152:g1hpsNoJpF1A6yU44CwH7R4xnp2ZT/CJ5Gvt:gmifPVRU8/h
TLSH
T1DDB5BE13F2D900E8D06ED17887569232EA62BC460B31B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1bb460901950e3a0b5634b636cecfa9b85d3648917b8fad15c2906c72e7eb2e7
MD5 9a0e604129b58066da93b3adbcb66561
SHA1 d97000d42346a7797efe2298737f19ddd534e89d
SHA512 5132e96994bf80510a5e02263b69ddabb88b765a88911d75dc6cc49980896e026af2d9dcc2cdad8c4947f812e4f95999416eec5de824daab2e00b1adaa7fce1d
SSDEEP 49152:XSuZQIY0Be2KIRVtOnks6NMHqwp2ZT/CJ5Gvt:N5dKOi61G8/h
TLSH
T1FFC5BF13F2E940E8E0BED6748B659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 be7c7372d013f0cc1b5a17c2552d8dd24da25772b5f199bf5cbd5f7f0fc2eef2
MD5 10220885fb1def3647c95ab12801ca2b
SHA1 1108d259338e51e31093ceeef6b22b0046657af5
SHA512 8e0f46a75aab3de19564afb712a68f43f10b86def424d9f2f66549e3591b74f2f19d75fa83915ecb6caf80d7c1d336c8c4e2165d30d2afaf935b1366c45e1996
SSDEEP 49152:thtSn8EApI0figGgiDn0AP5wDp2ZT/CJ5Gvt:8X2i/phY8/h
TLSH
T1F995BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a6dda4fb081806e2bbac733655ab834d95fcbf1ce7c6ccf7359dca8c0a0f6781
MD5 bf5ad7d32e726c043e14d3a7640a26d8
SHA1 f8ccba414a269a7bbdd54d0696429891ac0be067
SHA512 a81502b8f6acb534ea27ea52195d68c7eb9581d12112bf3673b5129adec748bf0a19007f782bbdc53476d7a874da1c9d5f8e8d7e51328f239702dd8105e66df2
SSDEEP 12288:F8pXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO/:F8pXG1zT/CRaY5oMEvDnDF
TLSH
T10D6523D658C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b5ddc48b4c3c3de5afccabcda80a93213fa95990ae7d58b0cef53c4532d26ab9
MD5 baf8e293afe1c91f1b2665fa0079ea48
SHA1 d0c6af0c910b91b42d1827622271aede6095db23
SHA512 a0dee63e2c213924d4af7ea7c6593c7f9362be2fbd62509425aad375898e91c43525d75cb1bc1d12eef689616c11aaf8bceb18d9be159f043d217ec0fc526978
SSDEEP 12288:qtpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO/:qtpXG1zT/CRaY5oMEvDnDF
TLSH
T1BA6523E618C90CC6DF5187304EA9C288D5971ECEF893810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 86fa1481d80cb9e65e05af49d8dcb09d24f1bbbd164614259235173a0b6d127f
MD5 9432a517a121c507d22030911a3cd5c3
SHA1 4218fce21803cc1b8ca2c065ba6f37d74e15dfed
SHA512 5e1ddb6b063930d94d0d6fe35dff66935f954e5cebea74461d799f24cb9cc49863db9fc707927e2c7628aeea193e96ffc110054f6e7f1260079dac37a98f3144
SSDEEP 12288:o/pXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSON:o/pXG1zT/CRaY5oMEvDnDF
TLSH
T12D6523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 fab8798cabb88e18f0c4ff7cf69121b52d0e65f3b57ca39c46416f5e3f763124
MD5 07cdc5449718ce475a370377cf96822d
SHA1 45f935b95284761cb479a37502bd4bab146a6bee
SHA512 47022b7f4cbfcb9b0f3afdc89528fc7501b5a63ea057de8b0d10c6176559b664d8d4ff98c16d08c4fe30d85efa9f2b7b49c04f5a1be47f42c0fb62a5f5ae5578
SSDEEP 12288:aVmpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOr:NpXG1zT/CRaY5oMEvDnDF
TLSH
T13565239616D908C6DEA2C3308EB5C244D2F37DC9F962824F271256164F74B78C8B5FDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8814c0dda8a024a13289a364bea88f44fc485e1ad3ff1d0ed522d054acdcfaab
MD5 060c8873df253ff1d69ca77fdf34764f
SHA1 131b659958c390e27708162b897615989eb49559
SHA512 b5c42c4e9a88a2188d1e3ff6df89540737e18abdefc528db989ba4fb0cbd095bc9451356ed242b25670515a9b701755b2ae9d3d640ba39472c5414a56946bd34
SSDEEP 12288:KupXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOt:KupXG1zT/CRaY5oMEvDnDF
TLSH
T1BE6523D658C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1af1b3ba814f64eae7f8a84ab28c06cc9bae6e330eef98fa648f3650c7c6700b
MD5 b8ce407b8d7a6a27e92bcac7bf3e5c8c
SHA1 162a98d94130f0d283f7bd7857f933ec3acf3b9d
SHA512 d14831d34acd37f5b7d3b51331e0a656982d1b90e45e6d0185701c0b18f44c086b8a29331b8489fb5bd4daeb7e6e7f6313c60da09a18c2b33c1d8f98daa0f3c2
SSDEEP 12288:sJpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOK:sJpXG1zT/CRaY5oMEvDnDF
TLSH
T1FE6523E558C90CC6DF5187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a285f8883c5464101c134fd8243d947c8056bfcbce39795ee2912e0e937f56db
MD5 de46fe51b71456625634380777be06fc
SHA1 6c9de2727744081353384c68fac7cf10c5bb7ec3
SHA512 c6cd001e013437bab300068d81d193f8adf712a83180fc13b1f5fc4ea905cf4e20529d47511a1ee2fb787931783801304ba0bf11c6073c1ba25ce612c024af0a
SSDEEP 12288:dVpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOy:dVpXG1zT/CRaY5oMEvDnDF
TLSH
T1586523E558C90CC6DF5187304EA9C288D5971ECEF893810B371AA6169778E3CC4D6AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 837842bd3cf2c5a80a856e8f0947c6d7b4ec1c94e936c2ac706f8c33712c9f6f
MD5 68c5a3b8f4d5876b6a2d250215d472e9
SHA1 c7429b175a2d26fc10c2bde70c80150fde8fd87b
SHA512 36682acebbbe1b637ac6af91c51e94f350476bba181835301e4a05a1154ac57550f8432d3c0dd9e7338018fbf77541fc99ae2ab7103bf2355c705c0d996d1e10
SSDEEP 12288:jiZwbPzzFEoS2cPvyNpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO6:OZM7zFVSONpXG1zT/CRaY5oMEvDnDF
TLSH
T1BB8501A573900CF8ED63823DCD658905D6B27C5A5A60C60F13A436275F337B14C7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2994858b5389cc6b028f28bfb6147c3fb2d2822896c6923f3e771cac2f8ff5c8
MD5 b27c628f8499c3d7b92be4433b99bced
SHA1 8060d9fbc2f91d9914ff5829e711734e51f8ff71
SHA512 016994806bba22b64f11486ab227ce0b5137311a8631795b6d622def8a9fdbca8b27b1eeb1770eb8dd0f23935cb0ff668ab34aa9704ff90fbb826fc3a810ce2c
SSDEEP 12288:hApXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOQ:hApXG1zT/CRaY5oMEvDnDF
TLSH
T1716523D654C90CC6DF9187304EA9C288C5971ECEF8838107371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a6a41b05b69840524695ac9917f1e31a7fb519aff0590de188cb262f6a67b641
MD5 e3fc2de8637c3660aaed8144f2e37fb2
SHA1 502a802c40ee49b20ad7ac5e2b5a377afcd810dc
SHA512 f4f263b4d5a569945382ea5ade1413c91582ef85c31052a666404db199505b4207d41479ffc272e4bc3f0a5dfc6ddd66e62fda117cfc267415ecbd5ee0a6a5ab
SSDEEP 12288:40pXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOz:40pXG1zT/CRaY5oMEvDnDF
TLSH
T1876523E654C90CC6DF5187304EA9C288D5971ECEF89381073B1AA6169778E3CC4D6AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 241716302e9b512a1313bfc09c2d898bfa47c8480d505b4d1bf3cbd001eb22f6
MD5 f8b3d16a15f657562971a145dbdf7ad5
SHA1 67ef26bbdb9ea3d602902519326c0b115d0218db
SHA512 512ed9311883822820c0374c2bd28f1482bb0a6be584cbf7d27a03d63082e0d50f851df6eb651fd8291afc7bc4d25db18d976a202247bfa02806c5bdd7b599a3
SSDEEP 12288:7yPz5L8hpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO1:2zyhpXG1zT/CRaY5oMEvDnDF
TLSH
T14E75125732E520F9D6768234CDA24A01F3B27C765B218A9F236447362F376B0CD7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 45fb9185381a71c0c1145ad4580ab6869ea0d9de0da6de2c7cf80e8163e25cbb
MD5 209ccd2958ddc574f2d05b1817aac70e
SHA1 2003711d14c4558fd61c5c149fc05dc038d20e33
SHA512 0de8b9a9e33f9fc1242cb7ab674d323fefd06e91ad9d2a4ee1a6139e6c8df2769e711ac0bf02d697b13ef35eed2995c78aa337810c1d69936df20bae1d2af2f6
SSDEEP 12288:WApXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOv:WApXG1zT/CRaY5oMEvDnDF
TLSH
T14F6523E654C90CC6DF9187304EA9C288C5971ECEF893810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6e3c3b26934f624cf5f78336ed58df64f24c906ca2ab85feffc8bdb34e85be16
MD5 533889aafb564b962e8d91fa88fa9876
SHA1 eccf101a4fbc99d8db3f4aff478d2fed3dd7f3bf
SHA512 3800240987eb263fb894238e82b602f47b96de78dafcc412cd99e756fe815a62449fd03c06a864b432b14992a0a1a5abc10daef6ea5bfb74d341b3443df0be40
SSDEEP 12288:DApXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOS:DApXG1zT/CRaY5oMEvDnDF
TLSH
T1C56523E654C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 7b1f1f679f3726c29e94721760aeb3333cd3292dddfe27a66ee83f23b8011579
MD5 14e8471e8b144b7ee93387772b884f70
SHA1 397703b553591fb1f842225f5534a57c3ec95227
SHA512 a132ab614012960484d8363fa48c2e18e2540a8cf323b2772247a0e3d55f379688aa1e6b218a9153ed1d23158a7da50f77032d3c76084b4dd91438045b5267f0
SSDEEP 12288:cyPz5L8hpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOU:FzyhpXG1zT/CRaY5oMEvDnDF
TLSH
T1C075125732E520F9D6768234CDA24A01F3B27C765B218A9F236447362F376B0CD7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 b5bcacc3db1a7ee85852bf3db4519490f78b2fe02ade27a4bc778d7864bdb36a
MD5 6c871408ff9d15545e8627340128af5f
SHA1 04e8e19236c8378574395c7813a0aceb4afceff9
SHA512 fd356ae2c4cf1f5ec5082da0e0b0fd3d2b139e23dbe31e47275204aacf918ec8fcafd7e7cc48e4401b240516283f973ed2b080d166b1574b63218a8d9730e789
SSDEEP 24576:/TQaLl3z0zDvpXG1zT/CRaY5oMEvDnDF:/T3LljCp2ZT/CJ5Gvt
TLSH
T1148501A5B3901CF8DD67823DCD658906D2B27C5A4A60C61F13A836275F333B05C7EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 1ecfa2d46990596d40d0e3bdee3dc3475596f7e936b4fd85801046671aed7321
MD5 6bc0618a9831857f5ad0c58abe48d98a
SHA1 c74134a06c2d201ecab7829a7a945f426379cbf3
SHA512 440ca64af98420d9f0eb890311d8e94b43d91d0e469917b95015e1023294e1d43fdd15ea16b30fce323177360c151b54717275480237e14da431e6a051b50e0e
SSDEEP 24576:n3/d9CHKy7GZ7pXG1zT/CRaY5oMEvDnDF:3/d9CHKyaZp2ZT/CJ5Gvt
TLSH
T11595C090F3E414E4F1B78A358D768501DAB67C995B71CA8F03A4661A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7cf174c0435e8cee3e28a9c9a5a526cdd72d7b6dad38002b87cbff0025d18401
MD5 2024a48e0da30882a851fd3ecdcf777a
SHA1 d57ba73cbbd41977fe2651a6e8dfe6155438726a
SHA512 be7ad158712afb159650c50227110067d0d66c61e00104990cf1899ba2f40c16f8de8dd285c655791e76171358bdfbc0a7fe4bc8c2ccd37c63d0d8f385df1587
SSDEEP 12288:/fpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOa:/fpXG1zT/CRaY5oMEvDnDF
TLSH
T1656523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6b7de7a51bd2f6816739ac8b12520716d5e7339bedbc8744a240e95030be4a65
MD5 ee077ea9a05941668318d7f2c0fcc64e
SHA1 ce190f617c528d975d86922f86030b7f982bd816
SHA512 5ec0e12bab4612575a26fa50661baa0ddf22e1abf738244703385f11f75eefa4465ccf3dd9782c4a88a6159860ec525ab46d16f80f794c4cb9bcfac3026c64ee
SSDEEP 12288:zBpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOH:zBpXG1zT/CRaY5oMEvDnDF
TLSH
T19B6523E518C90CC6DF9583304EA9C284D6971ECEF8938107371AA6169778E3CC4D6AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 b89f4f888b337883a723237ff00b5e618be255fc197b194db52f544c5721d957
MD5 d3ac672ed11724d61f8c41b39940045e
SHA1 712187050afef0d961ff88e6dc343d838d454b3e
SHA512 465e0d1767ef8bcf8624815ba78a074ef09db0a58702b433048223867ba5308a8d75b2fe49609e282c02f87c89897087eec3e3bfda92e5471b5a0ab9fbd6798a
SSDEEP 12288:FKpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOD:FKpXG1zT/CRaY5oMEvDnDF
TLSH
T15A6523E654C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c3c86dd649a81e4f6b49d169701bb279a2b06b25d5fc6c9ccff26103a739032e
MD5 5a4d41e6bfb091e1f2eb7c3d08515a92
SHA1 16b4f62b0c1b59546233d07843e0561b84767ad4
SHA512 8bdcff18267b967b11f5085f4ed1ea98303b9cd14abcc694a75889d119f04f25962cdc9c2d2fb45cbffe3bf94531857f506ebb82aafd40d52a4335f6e4e1d547
SSDEEP 12288:XApXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOR:XApXG1zT/CRaY5oMEvDnDF
TLSH
T1456523E654C90CC6DF9187304EA9C288C5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6d5d4da852a87eb40def24e703dc4e612dd75bfd62890ff1dd7fba62666ade5e
MD5 83aa823cf9e2d6ae019d7ded6d9c88c0
SHA1 d446174d6e816c1672ad5755721d41f62e63865d
SHA512 5f4d8a47d69e3ac7c42a707cbcacc3e2a12aed788aecf4d59cd93bea3e5bc276e6d07f55a9afd3d88cf5f7b4db79dd0eff481b27ffe6336fb0278323fb73dd87
SSDEEP 12288:ufpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOV:ufpXG1zT/CRaY5oMEvDnDF
TLSH
T1126523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 3f4b35d7a7b4fec4cb4dc7b366f19ae36c2c51ae57b288b8eb2e2305292fc32e
MD5 f16ec8dc754167e165d4816069d63a08
SHA1 0a5dd63957144a9ad6dc9f36844a6e51f34e4264
SHA512 26b5d39355e85d60030bd62014123c01d80653bb15ce1e5c5a0f2dbb3e026ad1d00a0ceefc4b26795e9002acad05e1f4bc4c69b4195a19cc227aa4a223529569
SSDEEP 12288:+opXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOx:+opXG1zT/CRaY5oMEvDnDF
TLSH
T1DC6523E558C90CC6DF9187304EA9C284D5971ECEF883810B3B1AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 b340f5e338c5aff990cc81c956f159e43151dd4ceb03959bd2a910f6c9b7a653
MD5 8c62924e5b46403d4405a49c76158b44
SHA1 f8ca393a10ff7b834c745c9c1a1c829e60782536
SHA512 54c0fae6c6b025d7b65d7b49a45739c716ac5850fc02464cac28557bbcba127099bb833cbd8cb906f8d64bf4c07a08c6e70204d7744d885727f8a2e802298d19
SSDEEP 12288:6upXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSON:6upXG1zT/CRaY5oMEvDnDF
TLSH
T1E46523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 4e588dce9f52b1619660cd0d640f9740957d807aaa06805c027effa4d65ca0fb
MD5 5841c8ffb76b412c56d46f091fd6e89e
SHA1 bee11b95d9cbbf7c5b4db0e12af8c756cb119715
SHA512 c270affe3c2136dce2ee22971d732c643ac4d9e0aff0396ed194c6b3c08336d25591f5e891ee2b7111694d0eccd76cfa744f177a82abc154f164b5113f016bc8
SSDEEP 24576:PfwvUk9RX6wkyAIEpXG1zT/CRaY5oMEvDnDF:RMnYIEp2ZT/CJ5Gvt
TLSH
T14795CF29EBDC08D5E1B7923C89B7460AF2B178591B31C2CF125A536D0E37EE49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2c14613fd388613ec8a86e054ec7f3c11f294234fcafd77dde764006d21f6b13
MD5 d15eed275585148fca9a173813211e90
SHA1 9d2cbdc3fedd336cb5b71c2bb2672d0c7ec56c36
SHA512 faeb07a4734800b9d602d44ed2c3d1578fd4b4674a6da9527810119296e18d99b9846ff68622ee8326d199a82df8df7171c91c31a0e095c61ea9be1942088c12
SSDEEP 49152:lYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jp2ZT/CJ5Gvt:LySzP98/h
TLSH
T1F7067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7889880133aba1de11cd5a04c8fb865f5e26bdb44c8e94e5c9154de3a080c558
MD5 5bffcb576d26ac8016daa888b7f09911
SHA1 194c8c6b6ea30e3b7653adaa538cc9ce2b8beaa3
SHA512 fc572dd136c21203a6165ed8d77ae93ab1defe9a23cbe306c189c3e44782407fc85a1cbd9c5d7fb2dbab3b429e3f96a50e5540ca0c11d96091e68c5696bfd9cc
SSDEEP 24576:k47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYdpXG1zT/CRaY5oMEvDnDF:k47JUQjairIhCnDHUPfF/zp2ZT/CJ5GF
TLSH
T18265AE1DA3EC01D5E1BA927885158A5AEA71742E1F31CACF2270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6fa34264efeb1126205c03260b0b927dd77f2139639eadf12c1d5a4a1e3b88b5
MD5 d81a8ac478d2dc2272f86cbe1a8381a9
SHA1 b480afe8b19fefa668f7e65c86cd9777a40d8ba4
SHA512 38885c2b6570ca134aef4f5dcfda3421a14f30ab343065a256544d9cd3b7032c5ac3222f2f184856e623398812cad3dfebfc0cf1cb64e2a460e8035e06df2b1a
SSDEEP 12288:2qsfwpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOu:KwpXG1zT/CRaY5oMEvDnDF
TLSH
T1EE75F05AD29801D8C56E5234CB558640F3633CA997E2D3CB23D0F53E1F79AA49CEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8896b2180a100037e8780ba7a74d200b144ae40adc9e450925b012e7903c75b6
MD5 a7783abab63248374e3b17dc1085c441
SHA1 656ca628cc2b5449031f80955af93365bde2ff13
SHA512 d720bdf5e84bbe9bbbc9a463f605407fc109233a7f2f56fe4b7569d91f9c4ad391f14da3e27973b659c38e618d5ae0b5e14cb6949012bbb7e54604a6a972c589
SSDEEP 12288:TeTiB3NP4LHySQuzB2H1rt9XZc+kIKf9OsNfb:TeTedP4LHySIVrvJvkhf9dfb
TLSH
T1D05528007666C75FC6A940325E73D6CCAB707D41EE45AB0373C88B3FC576659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 73e3906e6175b5f2d48fb518a50951f9f72caf383dfe68da28603fbabd6058bc
MD5 306263751aeac061857107c178345809
SHA1 74a59c8100fc2bbc2487242478a16c886bde356b
SHA512 ad4995bc7233cadf062a852f39fd46082e4fa64c38d4060d9983503db8d2b18c8bd7e7054ac7fd4b8929749c2b3731536abaceb684b940e29d38dcf40a1fdc9e
SSDEEP 6144:NIRJo/3u36EQEZ1vpCuMDgfLNpOy9qbpkLBQFDdPDBIr+/tMxeK1tMxeKnSouGm0:41zfLNpOy2DdPDSqYn1bS
TLSH
T1D965D9816137A38FD2BA607207265A4DB774EC577709AF2273CD053AD82AB15A1FD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 98d7aed5b6a576b4f922d601612ceec20d50b1a48014da92b40b786fd7c65085
MD5 0645052e5307ffc675f8c7695109c790
SHA1 ea718dfaee3a7b206974ada61bb52c957e3feb65
SHA512 23fa05512f1b61bbf39e0da981e64a5a4bf0de2dfa310fe428a82c25e85b38d5488cde55b670b998bd5a05e20c9f0f816a634c527b0de1d9878b66cfc164d988
SSDEEP 12288:8N7YpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOB:cYpXG1zT/CRaY5oMEvDnDF
TLSH
T1B26523A245CC0C86EEB547300EADC204D65B6EDDAF41C1877606A2169778EF8CCF5A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 19547afdc922786def94d0498c6e772d97397446c7dec2c29f1c369d66352fdc
MD5 212dbfb3e9b49a917703d5fdfa456197
SHA1 92dd49d4f902c57de6c429798cab1b4e3fb15477
SHA512 d42f4de1e648c3dddd5cbb0c59e97133293971830068dba5d8c1db514504e3896291bc716654c860bff15712c13d83e48e63d2c68e46739b16d360ba58c104c0
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYCpXG1zT/CRaY5oMEvDnDF:zgb4mBIBhGFdp2ZT/CJ5Gvt
TLSH
T17265AE1E22EC01F5E1F6D2B88DAA4417D6B378161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 c98c1150439258e1d52284ea2093ba61b596c93a04a69889b5a65312dcd3b80c
MD5 be881d5d4a6931c3d2d981d265a28e44
SHA1 e24dfe0a398ae94ffdbfe29972f43858c7e2d65c
SHA512 43eda14505197ad07b7b646fb744e716a09b434b3cbf548bb208f2bcd9d21fe0e77ffe0fd7bfcf7f0ed8f50f2f069265d1793fccbf76828fbc73d1fb14be15f2
SSDEEP 24576:sG88u8FpJqH1pzria7/mNpXG1zT/CRaY5oMEvDnDF:P7ZFPqVga7/qp2ZT/CJ5Gvt
TLSH
T1B095F16576E101F1D477D1388A868663F6B2B8251360EBDF07A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8c0c58a647585d0442f6230063eaadb384aa72df20d56d9223cff8037a6fe3b2
MD5 125f09bcaa26dac03ec19748a88a3a03
SHA1 559df3a5cd0fe39a71c7653cb2a1a304723733d7
SHA512 9f22dd71205876194b7320fbfaa0ad5e06730c43b019dcf3af0cb755f57d1858e132e34b3fad9b1a3b6c76cc0311569d64971b40a05c325ab6339a506d480aeb
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJp2ZT/CJ5Gvt:oG05lO43bi8/h
TLSH
T172D5C06A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 473c9cd49d0a4c4ace9ba6c9c28272f393161b5ee304181efd0d1a37ad3b394e
MD5 7d164a93f4c8a986ce035bcead5c3f1b
SHA1 676100882d98d98e53b8cad935f3f8628022428f
SHA512 92486bcddd4b43ee120c62ab56a7c8f9ccf740cb9f0895717e3466d1553f884d36c9df8c4b5f90926c10a2b41325f15a6abf69646e250e5a438dd44c04d1d265
SSDEEP 24576:4fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnjpXG1zT/CRaY5oMEvDnDF:Aa5POZ3hJt2pasx2+mBp2ZT/CJ5Gvt
TLSH
T1D965AF5EA6FC00D5D5B9D17CC583860AE5B1346653329BCB122182BE3F27EF89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01e4cf56ced93b7e106b17bf67104b252fbab1c387581da9c154a5237dcda5bc
MD5 d47ddd68979e89d25f51b90a0a6385ac
SHA1 329340b924e95d66af8285a866d7d21299898435
SHA512 43b3ee692917d462c2b98a6a0f107e18b38c7ae3a85fce68ddf24e5ee90dfb80c05f4a4491bd5e6f24eb4c5c75963569d305613485a1418b7bcab379ede172b3
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkFpXG1zT/CRaY5oMEvDnDF:qNc/zEOVHFKp2ZT/CJ5Gvt
TLSH
T153858B5622E901E4F5BBE1BE89779546FAB17869133086CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a6be348578f7dfd0d9c88e7e5d64306242ffcd205d6ac857f76d2b949d558bb6
MD5 ace538a2a8c01c98d77bb69c811a57f5
SHA1 2dcdbe19b868bf0daddefec23cf1916e5a8d8d11
SHA512 6a909f493a5a4b88b67563c6698c71c98febd0d31930f95a547f9f590ac2786d417772fc455cbd0aa11eba945e58ab3747514154c7f107012625ae09321fe410
SSDEEP 24576:E3kNvNnaFeYhJNtmZBmXpXG1zT/CRaY5oMEvDnDF:E3MwBtOmXp2ZT/CJ5Gvt
TLSH
T1EA55AF6EBAF805E4D1FAC6B48D238512E6727861173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3ba6880dd145abcb8907037edc6c5ab1bbfd53561f831b4787a1275979d13232
MD5 7f139c9f8a0dfa492048eaeadea2e9f5
SHA1 5d57023352c5f02ee2eea4f531e601d388492234
SHA512 35d8a3cf2be33cb3fd35428db0087e0d2803f59482a176aefcc5f19e67dba13671e504c0532e01d424e3df12fbeddf3030725b60dd2e068443fae535b9c316c5
SSDEEP 12288:FHvUrBFrEjwaQZpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOO:FPUr+NQZpXG1zT/CRaY5oMEvDnDF
TLSH
T12985E16F22DC1CD5E676E13C89868709E77278661712D2CF02A1813E4F77EE8AC39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 cb1c78c2770b6c33de56650858bf22a59e9c7e1fd2e04358d46d4f95c7ef2690
MD5 c362a5715f141399c77720b4d90d7ade
SHA1 3468251177b2bce66a71007ccf772e9bb16438c5
SHA512 5db7c88e09c89e7711ed4d6031f8b7c6dd5612d9cafa52d042a4be828711963c8047bfcdcd5614a3fece2417d9f1c5fd328791d8ac248a55be24d7cfea4dbbe2
SSDEEP 24576:UD3FHshBIYQgAcpXG1zT/CRaY5oMEvDnDF:UDVHeBIAAcp2ZT/CJ5Gvt
TLSH
T10D95E17EE69C04E4D57BC27CCA638606E77238AD032256CB1294C1B61F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-79-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1148-80-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1148-85-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1148-311-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1804-53-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1804-40-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/1804-48-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/1804-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1804-51-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/2052-115-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2052-122-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2052-116-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2052-314-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2084-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2084-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2084-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2084-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2268-56-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2268-62-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2268-295-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2268-55-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2276-66-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2276-68-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2276-74-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2276-310-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2448-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2448-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2448-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2448-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2448-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2448-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3268-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3268-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3268-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3268-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3268-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4324-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4324-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4324-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4324-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4324-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4768-78-0x0000000140000000-0x000000014012E000-memory.dmp

Download

memory/4768-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4768-8-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4768-0-0x0000000140000000-0x000000014012E000-memory.dmp

Download

memory/4768-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4824-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4824-315-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4824-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4824-107-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4824-101-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4824-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4844-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4844-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4844-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4844-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4844-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5612-329-0x0000016F88B50000-0x0000016F891D0000-memory.dmp

Download

memory/5612-399-0x0000016F88B50000-0x0000016F891D0000-memory.dmp

Download