a7c185654ee2059687453446fb4f850966d878934c0cc10fabb29462a8435222

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
Size 1.2MB
Sample260720-dhbpvsdt3p
SHA256 a7c185654ee2059687453446fb4f850966d878934c0cc10fabb29462a8435222
MD5 72111b7929078594100b08a68edf2b6f
SHA1 e023b87704267a1cc1e5664b54d12976fb81e27f
SHA512 bdba37a04dfa138cdbf1f922435e2fc5173e23b1946fc579922d44ab902db4e47fe57c380a9250a94901cc386cac489196d0c8d0c736f2e618480dce6d0c0e19
SSDEEP 12288:/4jAem3xZ7WMXV5L2rn65hYfWiOdC+ntFNPAXruYyVHHaf4HJ1jwssawsUoN9PqI:/4jAeovQn652fOdZPiQnDJGaz9
TLSH
T18045D006FAC65EA5D019C3758247D7327732B8895B23EFFB1384A6313D266E12E38758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4216	elevation_service.exe
4384	elevation_service.exe
4240	maintenanceservice.exe
2800	OSE.EXE
4388	PerceptionSimulationService.exe
2936	perfhost.exe
240	ReFsDedupSvc.exe
5132	SensorDataService.exe
3384	ssh-agent.exe
1744	AgentService.exe
5628	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2798bdce8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d2f456ebf317dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b64080e9f317dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac0942eaf317dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af060bebf317dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006372acebf317dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1744	AgentService.exe
Token: 33	5628	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5628	SearchIndexer.exe
Token: SeDebugPrivilege	1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	1324	2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4216	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5628 wrote to memory of 1680	5628	SearchIndexer.exe	101
PID 5628 wrote to memory of 1308	5628	SearchIndexer.exe	102
PID 5628 wrote to memory of 2260	5628	SearchIndexer.exe	103
PID 5628 wrote to memory of 1636	5628	SearchIndexer.exe	104
PID 5628 wrote to memory of 5360	5628	SearchIndexer.exe	106
PID 5628 wrote to memory of 1072	5628	SearchIndexer.exe	107
PID 5628 wrote to memory of 5560	5628	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_72111b7929078594100b08a68edf2b6f_akira_cobalt-strike_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c1d36b06561d4ad111e816d59dbc90f894962b56af737487a521ce57249f578b
MD5 9da891aadaae34f1a827b751e8939cab
SHA1 a4cd121e65fbaa03f189f79fa6d85574e11ac8c9
SHA512 ca9c68831f6e31173ce3c72550a4ff81b5ffbcecb182c8955bfd0cd335905441da00e006e763e7a88b1a83cccacfb945341fde5d445c3f64b601c6b055b6faaf
SSDEEP 49152:xb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnKnDJJh:33q6tjBRDT
TLSH
T1B2D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 7dc969af6d50d5a8965879ea8bde12b68bbf757037dd6715f668cfb023b1776e
MD5 eda0d5ce8548ca323c095508275ef173
SHA1 b39105b996c29e79b4ae7dfa3c24bf2f32b98d09
SHA512 41e3b17ff6affc2f5495193f303f9f6c096700e63a6b09d6296815c0611298c81f0110e7bed9875a3c2332753ad0e3f8bd8c9929ff6a8ad7a6c9f413d2bb6a8f
SSDEEP 12288:61XLsswWkxy2lRq2czAtPAXruYyVHHaf4HJ1jwssawsUoN9PqI:QXYfDtczAtPiQnDJGaz9
TLSH
T131750129A7E508F9ED67823DC9A1C502E632BC5547A0E78B03E499761F333D41E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4efd5d1ea74d7131d9c9c29434474530b46b79fa1f97c90ac4d43b4d02c63a25
MD5 0cd335bed892eddab28eaeb6dd133af0
SHA1 0e45b481124f440a41d616b78b7931f3ff11961b
SHA512 bd30971fab5373cb1e9b0a268a908ea75548b0c761fd81e0deda8c896a0d474f118ec74401cfc90e5ed7ad7d4382c1155459c031773a29a0d7df1fd4b2f032a9
SSDEEP 12288:SXZNYVLeyUji0h90ZD0wxpbZIVuKrHsAPAXruYyVHHaf4HJ1jwssawsUoN9PqI:W0Le5ji0hmxCrMAPiQnDJGaz9
TLSH
T15A959E26F6788331D073C0B9C5D2A68EE97134865B3089CB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1438b0331faca5b735597b3cbc5bc499741461516bae41f15905c35a873f1f7b
MD5 7a8e3612ffbb314d4d320a13c51acde5
SHA1 dda9beca75ca02f3bcffd6f8d721126d41294cd5
SHA512 80959099ce26335834bb78ee8caad564e7eb658acf2b5f1795ba6c99af4c8c31cb777697a80b622e48bab38efc009036c68594370d1a8ed2dc1a9cd9527d61f0
SSDEEP 24576:Va7/ezSC6vUyDZaqgrvWx6q8wyu2PiQnDJGaz9:c/ezSC6vURPvMHjy3nDJJh
TLSH
T1CD756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c7a115c4a641de824062eadc04b896c44c68c131bfba5916eef59c06b753538b
MD5 e278c99a604d3882419de520d281d54c
SHA1 18533a4138b5391349294fa92671ab9191c96566
SHA512 d211cb530ca62ecc6caa1a669853961c6f0ca123de03dee2af3cf62c7696687c0f05c35bb1afdd7a58d840db6f1b988f59f17db229a99bf46bc96794f47e1263
SSDEEP 12288:3VJjBq33vb5O8M+l1D0hwsEBoW/l84Zf0Im98xPAXruYyVHHaf4HJ1jwssawsUol:3VbqPb88hv/lV7xPiQnDJGaz9
TLSH
T16755AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 000d01cf0b6669fa12313f0322af80f1813a16d2df6356d8d9ec791b6ed6102c
MD5 fb0c153929c88ec4ccaa4d70c4964b13
SHA1 abeb5b2f792c7b1d06ebb4a1cb463eb12fc3f589
SHA512 f674bc29110d79a937a03f19b3f236aa1b2262e749588bbb8a28237c1ecb5d6af5c4038ab93d8a3cb7e623831445bf8abc8495a205368961e00d5166783b0ab2
SSDEEP 12288:oqkPAXruYyVHHaf4HJ1jwssawsUoN9PqI:oqkPiQnDJGaz9
TLSH
T178552367CBAF4051F34E6776A6C8F4073034BFA4ACD4A41728697E7B297463099A2923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 4fdf6c57901757e023af4543fe49af77f5df5109ae9198e6d0028ac26f2a9beb
MD5 6891fcca2ba1e0203537148db89929e6
SHA1 2d9b23b3c72f7d55226ced85df00e0e1684201ec
SHA512 c3cf6f367f51943f9ff8f89eba0def90be9d9202887caa29949c34c3fab7608ae17751373c73fd10b1d38d172fb7998eab96f8568943777ade3653da64ce5d09
SSDEEP 12288:SeBNUbTVO86UJPAXruYyVHHaf4HJ1jwssawsUoN9PqI:SJIUJPiQnDJGaz9
TLSH
T18C75CF3BEE28FCD2C27E9DB95691C600A77278704F61A3CBD165830E9E235E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 65d1e4f656f1f4420e88ba4ce86820225284034c06413077a1f35d57abec4d7a
MD5 1f12429fbe24f6f807c4401d56865683
SHA1 805512ed5e95c8047b537d04a840a9deddb6f698
SHA512 a3b1ba1e89c6a1e2932a074f2a9e84fc1bd9d24fb715b7b96a33c8c4d474f997d6026b49151b6877b4130b965777acc8f806aaa53b9c4077ceb32dba4bda7b36
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THj:GQvGAdlCEL8c/pRNw5CEDT
TLSH
T1FC267C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3acc7c7d7658dbb18c23a70d14c3785c911df9a275c81e23b1770cff7b198862
MD5 bc4de0b10180a4a43e063e782e054193
SHA1 87f05738a23318ae90ae9a23c18401b6b8125fd5
SHA512 0a56019dca8b589a392622fdfe9c261bf6124a91a0d249e9bab6688d429c877d9dfd1cac84eae4df2103c0120d73c3843fd4f77d75443866081e2bb057293db8
SSDEEP 12288:SAwSfxL/2Dc3dDLLmt0LDQewsAjPPAXruYyVHHaf4HJ1jwssawsUoN9PqI:XsewsAjPPiQnDJGaz9
TLSH
T1CA85DF31FA75E032D37B0DB61B65D706143CBE604FA129C3E3A89E9E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d22f6c6de22c2634249f89f2c2d83451031d8ab2b8e7f7f7798f3e04131fa5e1
MD5 82ed10da2aaa92307126fff244b914f3
SHA1 675b669645d37cba5a321c1bb1df9ab43458f676
SHA512 e3acb312814f25f2a78a141f49beb20ce0f467889c34007c1658cfd4e9a1df0704938072f092dd4a36b122f97c05b420bcd96b18c260347a3ad351c275ff5dc0
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHT:FUEtQevvqc2W1cpV29I32
TLSH
T11A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fa5d3b8358daedadc3baccd3a3eb4de59ac0b666abb5819172f0f4107486cb1e
MD5 1ffb5325529868a476cdf4d7c1fd1ae7
SHA1 8d586864bf6bde2fe70e1fa8d498d0b264b652e5
SHA512 0572f37ebe644826154515161734247545feb8428f35b775b44a70ce20ef9f7604f0e215a653ad127c67195a83662dd8b73b5f3e5585ad4d784e4beafc024fa5
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zbnDJJh:2oquVjnmwDT
TLSH
T169D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 74787bb03687a2f4a189d50c9d21cffbe648c195cf66370a1424a67b2c12d49e
MD5 37951e77ff0ec84d747acbfecff18ed1
SHA1 13b9bd5f86ccdf5f1a63cfb4ca7a7bca78add4cb
SHA512 5ecdff894fe6505a9a1f21f7a411183d6530b5305159d4589a94fba89024db8fb807b3a4adf4f1d40288bdfa4913d8a44f9a89781c6d1f944dfa2b65ce52607b
SSDEEP 12288:kAZ/GLmIFoiwtA5qy97S9uaYFLq3OVPAXruYyVHHaf4HJ1jwssawsUoN9PqI:kAhGLmIFoiwtA5l7S53CPiQnDJGaz9
TLSH
T1B235AD81EBF945D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 53e7f5acc724f981ca31301e2c5c3eeb8d0c3a7ee8c68b86f0de437b7875b8ca
MD5 9acb56c9f2c5cdcee5bd28fabc8ab399
SHA1 b82a9e85cf653bf4acd7f94d0ad6c0fa748ece3f
SHA512 9f6407b1b710db3744f5a87873a55e402b8d6f5871ecb6fb5e5cc8e18c989594dd2f7cdbca8f77ea3e301fa911e0437d2bb7fd2d4ed1caf1ef72dd8b0ee13afe
SSDEEP 12288:Wmw5HEjsChNyBFgl0WDm+CWPAXruYyVHHaf4HJ1jwssawsUoN9PqI:Pwu7OWbPiQnDJGaz9
TLSH
T13B75F14677E90CF9E6679239C687C136F7B2BC112A21D71F1760C65B6F332216D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 516fda356eacdabb9cb149fb881464aa861aa91bacafae6bb5c50b4585fe78ed
MD5 92d5ed4b257311863d66379b7ee984c9
SHA1 049f340959908fc5ea556584c35d19ecee538a67
SHA512 159efc68c1c79d19c5bbb2f7e54e418bb280c6e40058a1c92d57301b4cbd864bcab9d9b381531b0c2fef3f0db2c2bb3d9acbb4eaeea1a87dcfc22388d018e2fc
SSDEEP 12288:8PZ1Iy/PAXruYyVHHaf4HJ1jwssawsUoN9PqI:QZu4PiQnDJGaz9
TLSH
T1876512AA23EA20F5F397533DC9D09506E3707CA26B7193CF1524566A2F32AE11D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c24682424a48b1f372f262a09aea5d41e76f58445cbef40326f5eb0b38d1ec6b
MD5 a18c68d8d56f2fd637fbecd48ef06d3a
SHA1 7302544adec367265d8b1430e48f3994b9156bfb
SHA512 499bb65b7418a42956c69cd2b8faefba8c3e969a46306062425c515bedf8a54615d18fceeeaccad2529f4064a823d62b5c1d2e67866f32d9d31788e909aea374
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UP:1QRQyi36YOcPuLvw2gAf+PN31DT
TLSH
T1D7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 52879e92ef4fb2bb0cac15d606505e1a448309df5c73fb1440a7eeeae31bb287
MD5 fe79ad37223df52918a4be9cd3cebe4e
SHA1 8f7efaf0a5ea6528606beb3054b054b8d22c74a6
SHA512 12edf18527d5c65e3ee9a9847f26d41e020db61b9e9a5ba601a975d5c4202d4845f68efcce59ee998a09fb2795df41629f1d451ab3409034067217962ab87a81
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UP:VQRQyi36YOcPuLvw2gAf+PN31DT
TLSH
T124667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9dcd355e8fc1d33cb41651f6c600f7fdadf8ec534a8cad90fb0ec9a06ec3df6e
MD5 b14d4c928aae85c361e4271f919f48ac
SHA1 ea68576263a2dfce80c720d351d3d69a722ec988
SHA512 43f537ccbf6da1e627f590e13fc6f8407733f7e1eac6548d76c96a1107fc856513461408913e0adaae7b7556ea2421232cb5745f17a43477e959bc4e8fe9e990
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0IPiQnDJGaz9:/68Qg55nhxeWu7PNU3/LnDJJh
TLSH
T100B55A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9d75222d0251ab79bc684a6145ad55d1ffc5b6786e817995d1f410002ba9301c
MD5 9b2714c926d51a63838947a51f3fedfc
SHA1 c37c114b126cb4214f1b227812b7c0268abbc1c7
SHA512 142d4657c9e9eeeee0f04522be493570cda9b7a3a8033dc09e7175684bbb2ac872b58b11e5ea2c5b096c5e99b220ba0882df0bcaaf35d8e89a4e934beb8e5fdf
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:Uy5112gYy5azzVvD69nLKnhZmDT
TLSH
T137167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 04268519574864ea19533080fd0773c03a1a2def53994eaf22b55ca355601f67
MD5 af0ed86780929788fc214900571f05a1
SHA1 15ef60aab444774e6b09368cd91c491de2252587
SHA512 213266a61a377b22ef4776f0bccf8d8a71b0258177b7457c8c711b3937dc16bac669d2b646f04342854f1f9fa8a48b07089002ca8c7f10e154e2f1cc42bae0d5
SSDEEP 49152:hB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gltnDJJh:3u6JmQxd2dtDT
TLSH
T1B8D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e7914b599bf59f258bbfaec1b0dec00f8ebdf466bb062c4036864da97a101da2
MD5 aee967e3e86d4b163f02f61706c193f7
SHA1 9d7d60d63e94faa8f9b6c307bdc0918a8f26de6e
SHA512 ad583cb5c5a0c7a00496539a966a8ae301e5c61a1b34ec76b9a81978f3f78db929b8221de26d3034ee6b8e2a690c4152ea1e1ddd9e9dcc0bc001601f2ea2dca1
SSDEEP 24576:Dhv8E1hps0+ogd2z615uCMVF1Agz65UQ1zNOgLLwH7ReaQXx3ZPiQnDJGaz9:J1hpsNoJpF1A6yU44CwH7R4x5nDJJh
TLSH
T19DB5BE13F2D900E8D05ED17887569232EA72BC460B34B6DF0A90B7962F7BAE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6da81d67e9778a1377b76d7d1f56f2e7f7df59e289e292530011decedc7a9377
MD5 aa22f5be7d654e385a7158f492a440ed
SHA1 28d868809b5a0a2ece68441cd9764d468ce042c3
SHA512 64311cdb5207397352c00b693cbb04988461dcedb890445bf73a9d6cddc0fb2305dff7e521898e65e1bf3b7f3b11b86e3e353af11a26ec44833f20118d3eb7fc
SSDEEP 24576:+4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnq4PiQnDJn:CSuZQIY0Be2KIRVtOnks6NMHq6nDJJh
TLSH
T1DCC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b1a73ef7fc73dfe3b73b93cddb2dbe66cce65f877a151ffe8f93ce7fffb0fcca
MD5 ed977fb3a4cfb368054eeea4dec50073
SHA1 a7a158dad3637e3e1e994b58ab8e48acd7f53a0a
SHA512 e8fca17d5645b232e457b9eabe223f7edf6bad34d52a951630d9526874f7b85b0c441f9695e014fb62ae292788dcd992caaa6491ac988bc6dd05c8d4a46d2fc3
SSDEEP 24576:dhiavrPSLT8EARn+FgyUgd0fJY6BGi3iy9CTn0AP5+2QLZPiQnDJGaz9:dhtSn8EApI0figGgiDn0AP5wdnDJJh
TLSH
T1E395BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 66a6479d66a8c6db599722d7b7068e3ac66627ec3bfae1063d0ffe4765b698df
MD5 b5690a6fafabb553ea15521b6b8c03df
SHA1 3e2bdb1b8142f379ef78f27635027f0d61fdab7a
SHA512 6c17ae61709c4e3ff3e9aadd2fbb44d5ccd0f8136adfe546cfbf3ed7f0c8a04d5e96dc5a6a6516cfdd659f38e953338bd7d933ab5633e0c03ea23d2f572f669f
SSDEEP 12288:9cPAXruYyVHHaf4HJ1jwssawsUoN9PqI:9cPiQnDJGaz9
TLSH
T1E3552367DAEF4152F3099776D6C4E0073038BFAAFCD1A057396D7A373A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 4d1dfafd2d986231299f387fd3ecd61d894a63cb4f35dfd16c902b5f13bd1006
MD5 1749737fe9859d1ae255a9bcd7742987
SHA1 b399d8e6b72e82155e746974b18711f9f7fc9853
SHA512 5087c854459c6e1d1cf883e3ed36b31032c8cb88dcf76b075ec57bdea5923b14beb7f3cb703465b49940462dc2226475d54572fbce14ddde6ab38e4984b8350b
SSDEEP 12288:ZDPAXruYyVHHaf4HJ1jwssawsUoN9PqI:ZDPiQnDJGaz9
TLSH
T196552367DAEF4152F309A776D6C4E0063038BFAAFCD1A057396D79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 24aaa4a3f735700e3e246570059b3464e8872e4f054c6665567712cfa2fcb481
MD5 2b9b74e9f966cef1e726fdeb7bf9996f
SHA1 d6749829c6e6c84cf48cdffc8b5e50d6e2a53106
SHA512 02eae902d2bc3f349bb657b4c9f63a2819e94fe19f95f133a83a66c965ec984cb03fb239081c8d47b5362d712931ea24c0c42ed654b37bf1e498d66073ba9abc
SSDEEP 12288:dBPAXruYyVHHaf4HJ1jwssawsUoN9PqI:dBPiQnDJGaz9
TLSH
T1FD552367DAEF4052F30D6776D684E0067038BFEAFCD1A057296D79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a2bc7a1c57846b7697952a5b72f7e196bcbc270dd4c63300149646bb85b8d43f
MD5 44cc268a1d676ed98aa81ffee2ae0ead
SHA1 5b992e0c4fa0237fb1ffad8dd0d8cc7537b6f912
SHA512 7a9d338164e6c8371dd6bf0c45eba7897a4da4d909f5c5e233f1686936d14fceb503679d47f1b7e21119bac0840df721cbe59a358cac0cb6bdd20fcda8ef08b6
SSDEEP 12288:tViPAXruYyVHHaf4HJ1jwssawsUoN9PqI:qPiQnDJGaz9
TLSH
T18A5523675BAF00D1F30AD379C685E006B174BEE5FD71A29F2A14296B2E707302D71E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 972d6e81020f1738c09905163a162dfeb70720d450cc30d485b8c62dd3e6a1e6
MD5 ab0a3f9aed61578a4877c18399ce8fb8
SHA1 ecb4745111137cda95a1b6ad06012d6565d2eda4
SHA512 cb1e60331e69e4eade8d721475f0f2ba9ec56eda1026c04cc9318112e9cb8620521b2a2d507de59d1ba38c0e132c7fa4a643f1d06b6a404a8fe47c3f85c69dbf
SSDEEP 12288:KKPAXruYyVHHaf4HJ1jwssawsUoN9PqI:KKPiQnDJGaz9
TLSH
T1E2552367DAEF4151F30D6776D684E0063038BFEABCD1A05B296D79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 9c63fc8a77f85a7d7dfad30fa3ea351e98892b08eaa5a98d91cc8b5c9d2ca433
MD5 551610ce7a5651a5ff1034207761073f
SHA1 490e673e35f4ab416af6c8345de8636efe74bb59
SHA512 45604693426ba1edfd13b885285bcee7c969049f230ada386b825e0679ce87d96e8b89c11b0385536acc6a0ee0e9967c33c430461f683d635b156b8c7816fa1d
SSDEEP 12288:cnPAXruYyVHHaf4HJ1jwssawsUoN9PqI:cnPiQnDJGaz9
TLSH
T12D552367DAEF4152F30DA776D6C4E0067038BFAAFCD1A057296D79373A70A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 42f2472aa81766fd6c25636ce63e6e08d8415f0cde668d4390d9fbcf8d1a0cfb
MD5 5c7e2c3c1e4d0487514677271c877667
SHA1 c5294dd13937d3655330986e814c78d9f6262e63
SHA512 81b23edd510e053b4fc73686dd7452bb7e98cf1fd6f0225a63960ed2c3347539dce31678e0910096d85e31fcf5896411c0de6bb9a41fdf64ec6d994bb9dd1ff6
SSDEEP 12288:IrPAXruYyVHHaf4HJ1jwssawsUoN9PqI:IrPiQnDJGaz9
TLSH
T1F4552367DEEF4152F30D5776D684E0062038BFEAFCD5A01B396D79373A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b5699bf5ee96006269e9ccdf499b56077ff4e45e42f3738ff1190d7c3db7bad6
MD5 bbf8178381f4ed5db977e4bebeccbd45
SHA1 2f418af5c3d7658ea22eea3990220452434be7e8
SHA512 f8506ee25ad8fb63c9c0331ced43ac66e7350a68871809f135b61c1c2ef3e65ae604b05448452b8fa3f6a87f88d0929baaf6b51e1500cdc42ad9171c65d530b9
SSDEEP 12288:jiZwbJzzFEoS2cPvyjPAXruYyVHHaf4HJ1jwssawsUoN9PqI:OZMNzFVSOjPiQnDJGaz9
TLSH
T17B7502A5B3A508F4ED67823EC9559906D2B17C5A1AB0C61F13B836271F333611C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 f0d72c728951213cfe5ed3f24c215939568cd1f9481ea3f3dd1ff3fb84e3a1a1
MD5 fa08ce976d5dec104bbae7cb0334d1bd
SHA1 c87250063fb502b72920aa54de8d309e92bb7c4f
SHA512 00f07315d046e71fa3a58a51e216f0a4f67a551a46117dfd445589ae21f999c986c91570dc864c46a64979b504b80b7b677321b9cb524e5461e7e87ed58703ee
SSDEEP 12288:eoPAXruYyVHHaf4HJ1jwssawsUoN9PqI:eoPiQnDJGaz9
TLSH
T1BE552367DAEF4051F30D577AD684E1062038BFEAFCD1B057296D793B3A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 770bab91c7994bce1296e7664c90a470204ba310ca4c6b804cdffdb5caac9054
MD5 c3d735c88c8728101e1733a0318f5d6e
SHA1 ad36eb01c20ddce6485b5e3f7d1d8740beba5670
SHA512 9c0a7946d7bea4424a55ff90228b93e045b03a4731283b0abd09d9f63edde2ac9ee03a8610c9013b69a39eb9a2d5e5d7d07a99dd696bc73e4481c6dc89f53004
SSDEEP 12288:0UPAXruYyVHHaf4HJ1jwssawsUoN9PqI:0UPiQnDJGaz9
TLSH
T1E4552367DAEF4151F309577AD6C4E0062038BFAAFCD1B057296D7A3B3A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 91e80a51f56f51293cba37a11cd2387fde2a297c1f35d98a6d7176de37cfc149
MD5 1c6b36837e0b1e166ec97c3495432c09
SHA1 38362152852dce8a7dff3e70c4312139f4791e02
SHA512 8addafd3a9efd808f4bfda7057896cf2d7e6ce59de538ff488869219835cb3be90418a8556df6e8bb219656d19ade7e8fb524f1ba3228a942393cce94fc35afb
SSDEEP 12288:/yPz5L8/PAXruYyVHHaf4HJ1jwssawsUoN9PqI:yzy/PiQnDJGaz9
TLSH
T1AB65121777A630F9E2269339C8915902F370BC725B609AAF17A417772F336A05D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 adbf33475291d37a0f35c2ed689e87bf137adc2643b2d89a313c7a25d992e0ad
MD5 7806d6b1eeb8743dd8194e3bd49e7828
SHA1 93ef8c41a047a1c9fcd68d8033be9cf484c2c109
SHA512 b802ecc3c35a265f92c5da76b45b067d440e6f1c39df6fd8efe59bdad23ebf6d37290d018f9ea8358086507118d51ad4c5ce33c456fee854d7327efed7d79624
SSDEEP 12288:aoPAXruYyVHHaf4HJ1jwssawsUoN9PqI:aoPiQnDJGaz9
TLSH
T1C6552367DAEF4051F30D577AD684E0066038BFEAFCD1B057296D7A3B3A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 def9bcbe51ef8399c600983f4d4e8e738526046f070d0741f6ce59a63054cd6c
MD5 6f1f7945c82de18e66e08b0995000cb7
SHA1 b99adfba80d6e3412df4e0558416a21771e217ee
SHA512 c826c3b8682549abfa003025c96aac0dbfb263e6809bb25a70b390816e46b4c1522d7d20c19e2b7e3e2bbdd806b448abf7280b482c80bf731656c028ae8279fb
SSDEEP 12288:SoPAXruYyVHHaf4HJ1jwssawsUoN9PqI:SoPiQnDJGaz9
TLSH
T171552367DAEF4051F30D577AD684E00A2038BFEAFCD1B057296D793B3A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 af9d1c8325f62cb78ca9ef6c210cef42a5f2180f74b1d76513130c8f40ebbdcc
MD5 13d9901bf6a1ad96248d62ffb40e5dee
SHA1 bb58d7e7d26322d94d1cca4e467185eeec8104a3
SHA512 d7b45054585244387867bc6e6b27f47175f2bd0f230c843c9e031e5a1c7ba46efabb3b2b09e1df119227fc318779cafde6c0dc1446d981015f31483c4d9e3b2e
SSDEEP 12288:dyPz5L8/PAXruYyVHHaf4HJ1jwssawsUoN9PqI:Uzy/PiQnDJGaz9
TLSH
T1EF65121777A630F9E2279239C9915902F370BC325B609AAF17A417772F336A05D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 10eaa1711a05bd402369f7eaa7b71724b834d51cd978776c41b8b4764dd9284d
MD5 c3d43c14905180f9f7d465016cbd7ab4
SHA1 ed1d5a1d2acf66540678e6170e47ac702ad22618
SHA512 84be9060f1d26de5f29385c482349b5cd13ee0934010b55060d78a4154edfd646799a1f5de23704316d5c9826edc8d2a712f2ebe2b03f624a0ae68d7ffada686
SSDEEP 12288:wCd9TWYoaLHF3z0z04PDvhRPAXruYyVHHaf4HJ1jwssawsUoN9PqI:pTiaLl3z0zDRPiQnDJGaz9
TLSH
T1FA7502A5B3A518F4ED67823EC9558906D2B17C6A0B70C61F13A8366B1F333611C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 32af15250df932cd9f50f50deb9bdcccff802d89186c019b347cd949978c0a07
MD5 fc9d31e8e3912292cc8a525deb4bbff0
SHA1 10b07010b12d333d32d48eb33b53d426955922cf
SHA512 8af6967c09f50b1019b400863fd52a0f366760c55814b901fb89260c354a51438629f77b0e0b0794d88578a04cd277510681659690f8a4306b9cedab11609a0a
SSDEEP 12288:li4e7ARdTfgwCHKy7GLbbdIvePAXruYyVHHaf4HJ1jwssawsUoN9PqI:l3ld9CHKy7GZlPiQnDJGaz9
TLSH
T1AB85CF90F3E810E4F1B79A35C9769502DA767C591B71DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 24f2c244c9e8a6cc037fb676f8011193607899e209bb08de6e55ef905a7d925e
MD5 2eeca51d021f6de5dd772bd223cbe36b
SHA1 df91a587e89043fc12caa1ebce5d9c84d784ddcb
SHA512 f422150a89d2efbe1154121f95cd07a8e152f7e64c4166004e3f606de34d23bc5fc19b53f3ba1d7c77b405bcee6d15dccbe656b38277ed907c9249422bd49c5f
SSDEEP 12288:ohPAXruYyVHHaf4HJ1jwssawsUoN9PqI:ohPiQnDJGaz9
TLSH
T184552367DAEF4051F30D6776D684E0067038BFEABCD1A05B296D79373A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 73321b45b74cce2f51856557b6ca9a5f8b50edb89481013bb6e52bc1028f0946
MD5 de46fd8f300b5aaf36507d5cb517b101
SHA1 fd7f5db8869bc97d8d2276f6d3d7ea395816892c
SHA512 0572228d21b3891d4436ca31c4d764c872256673fc543be2157f31a29be2aacec32260b358058bb96a2dad0e54006a2391e0871b3009c966687a2bbff08e9dac
SSDEEP 12288:ZfPAXruYyVHHaf4HJ1jwssawsUoN9PqI:ZfPiQnDJGaz9
TLSH
T1535523679AFF4052F30D5776D6C8E1063038BFAAFCE1A057296D79372A74A301D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 3102a3e0b66764180bacba435d445f669f89ad17a01de1441bc70b6419192f32
MD5 621335f8c95b23c1eb1c2e34f2bdf0ee
SHA1 4fa0807f377ccbd37474692e2beba53899dc4a9a
SHA512 ec880e1d19d4f6ce7ce0a54f3949d753f58e8d75953a1c74040d7b66ee24a18219b46e5dd128db2dfa07686a80036b66d1aa02c2378b021f004e333c086b5f2d
SSDEEP 12288:sePAXruYyVHHaf4HJ1jwssawsUoN9PqI:sePiQnDJGaz9
TLSH
T13E552367DAEF4051F30D577AD684E0062038BFEAFCD1B057396D7A3B3A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 a7c90a954fc8c8dfe74106bbc4bca4a47b78120dc8c46d677228530148d56c8f
MD5 b9e4cf564e80b469c0cf887b8c5c0f69
SHA1 c4f3d11adcb71295629ae3ded030b319c9b64426
SHA512 1326ebd8c4770dfeb1afa8f0261465475410d36150b9d82f743877d8962d445c48ed10907d910fd2bb3ae4ff4782e5d0bfb5c081aa32cea687028ad61a18bd47
SSDEEP 12288:6oPAXruYyVHHaf4HJ1jwssawsUoN9PqI:6oPiQnDJGaz9
TLSH
T1AC552367DAEF4051F30D577AD684E1062038BFEAFCD1B057396D7A3B3A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 25fd526bd02e33aa796e47a2ab6b1155ad21940c9ffdc5ddb86884cc7f010a14
MD5 449e87884ff91c908d014934bcfa3c66
SHA1 371c5bb5000c7d4b7f892c8c2763bd892e1f17c8
SHA512 795e04588b4d12d4b49667d588efbc29d36a0a27cbd4326e5bbfa75a00d48787988b75c2d03ea4eaea38457c3fc747e387f164c852df15e363f6f15e818727e2
SSDEEP 12288:yhPAXruYyVHHaf4HJ1jwssawsUoN9PqI:yhPiQnDJGaz9
TLSH
T1FB552367DAEF4052F30D5776D684E0063038BFEABCD1A05B296D793B3A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 1766d82461953239057929600f1ad29e69c306ede09c47476d716ac6c4216778
MD5 b67c4f1b6ada0c83d257f12523921a1e
SHA1 a9225ac7f18d24cf0c5b98709eea550b7ad6bbcc
SHA512 e78f36c50971b54869298f762d1b809dade70ac73cfb458ee8d4f5e99c6aa66c9b2fa4e3617748675beeeeb5e69589bbe33fe4c66db6c7a3f3c18eea83cf5be4
SSDEEP 12288:EQPAXruYyVHHaf4HJ1jwssawsUoN9PqI:EQPiQnDJGaz9
TLSH
T109552367DEEF4151F3099776D6C4E0072038BFEAFCD1A057296D7A3B3A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 7a841b60b19432ff2cefa7ef3b041d6b8d936f3ee587a1b6e6db093eb6db71da
MD5 dfdddbaa360e349f4be2051aabb51f0a
SHA1 4dcfa61ebbef08a5db7acca92323d7522f743209
SHA512 f3c2ec56cf16132cfc36937f6ebda88a59aab5a2ea53f6d4c2e4ff7fa72b0048f49760dcf0134e920d2cdefc837c0ab371f59c2fb9518519ed41d6117e0d461e
SSDEEP 12288:LKPAXruYyVHHaf4HJ1jwssawsUoN9PqI:LKPiQnDJGaz9
TLSH
T1C7552367DAEF4152F3096776D684E0063038BFAABCD1B05B296D79373A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 8bb4a9ca963141fd2fca6624f28f9688b5cb8ff8553af612bdaa022a8fed12dd
MD5 5984d148237ac3c442d48a06fc16d4ea
SHA1 1908de11837c249188becf62944423a9ac255901
SHA512 7dd6a2c71ed357a3502d7125284559fc3ad3627e02fb208b9220721b9d75a54cd79c529f373a9f6cd4180bb44868dfc4a659eb30fc6e663a13d04c52d3ebbe8a
SSDEEP 12288:LfwvD5uG64Lk3tRX69qkyAI5mPAXruYyVHHaf4HJ1jwssawsUoN9PqI:LfwvRk9RX6wkyAIEPiQnDJGaz9
TLSH
T1CF85D029EBDC44E5E177923C99A7860AF2B17C691B31C2CF125A536E0E33EE05D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 184f084e0a6ae34abe6c75d07d85f35a6c3e1db6afa47b1cf5231f78ec4e2869
MD5 1f42e940a457ff2b8cae281d8ab0c98f
SHA1 aea915b11a1cf13855eac16d54542d2b78a97a49
SHA512 809d614f1bea81f75f458e8cdb1569db157b4917e13db502734b6947798d376eeb546953e4357b67aa84f153f7d6e5d33651c7b3eaf56512cd416540e4e3418f
SSDEEP 49152:ZYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09nDJJh:XySzPVDT
TLSH
T1CA066C97A1A801D5C1B9C1B98B0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a8e84aed4a7a16ed18103b2d184d5277bb55bec7f3195639591ac40be76e9c93
MD5 2f419e41af0d04c1857ac8035cbbd721
SHA1 617fa7e12fa530a2078829cded00af33affbcca2
SHA512 ba67d883e632de6033a7a63ebee64a118f4cc9cd91e6d42f75cab2f053ae09d8c19096d1e6e7f7c3a845e37b96f581b08c45194be3c3abb54e97aac584e0a959
SSDEEP 24576:m47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYTPiQnDJGaz9:m47JUQjairIhCnDHUPfF/tnDJJh
TLSH
T1B165AE1EA3EC01E5E1BA927885158A1AEA71782D1F31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3fde7afff2d15273833fe95e960ee64ff0a3600ac8c5c08f7594c4e29f28951a
MD5 247b1ebdd8769c8ba6eb376604c6f06e
SHA1 61e6313043f40bd1d81e995d28b615f2247539aa
SHA512 1990b1c271fddbbeaf2b944f300a1bab10091d3e857bcb267ff3bd197536265e2024c1085733ca4f22ce5b415a665c379a8e6996ca9e338d5a80e3a9917deeb8
SSDEEP 12288:8Asf4PAXruYyVHHaf4HJ1jwssawsUoN9PqI:C4PiQnDJGaz9
TLSH
T10765011AD39902E8D15E6239C7859601B3337C659BE1E3CB26D0F93E1F356A05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 920KB
SHA256 2c110d2e36c6989391773a81cd678ff0e63eacf7185d8fc33815776703798e26
MD5 eed8fb0be210a69f948ac2e0ad91f63c
SHA1 75c82e9e222e1a6a7fe8f151ccd31752e39e761c
SHA512 6e12ef22be70fdfbf99e02e0518f1cb3f20a5d808ef3a7aac56ae5b842c06ece066756055469375bdf58282fa9393678d7dc3cbec4a22f8fbc7a2421afcad909
SSDEEP 12288:Dv0NU3f7qBeQDI/noeATnvV3SWToLSiMJ/VWQh:Dv0UPGVlSCoWiKtW
TLSH
T1DB1507007626D74FC66D40321E36D1CCABB07D41EE45AB0372C88B3FD576A59BAF2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aecc3c32c1e73586a82dd942a23fd69a2c92f05d6a745ac6c9bf24aaf0537384
MD5 c8a767ef531cd774a097b9a1d87d81d4
SHA1 360cffd5eb1c2a9ebb7c75cc9f96211605949057
SHA512 6f279707727dc32977f0f5a75564b43f8b8cb01a8b4592bae90b445c76f7291d9157f13c85197a8559698b7cfa7ed18a54c51b3d4655ca1121409bc882595036
SSDEEP 6144:tXCIJOPk6rmYALFoxM1IV7qUSqtMxff30SSqtMxeuhlgeiQK741fnJSUTzN9Zb5I:tXCDPxoFoZGfmiQ0IMUfNP5eJ
TLSH
T11D65E7409537A38FD1FB2032472A9B4CA7A4EC06B7456F26B3C4453AD86AB15B1F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 e1cb8ade888062a1db77d6a8f9858d3817278dd845cf71799717afe88ae622e9
MD5 845a8491d25959d2d390dc88fe092cb1
SHA1 c5ede23087dfca4f368509b6171e5e13e86438db
SHA512 f37a2c754668cba21110dfd581b94b9c08f0d15a31b9c397104dd3901826ba6e8365e30a351d004224cb31570122703d5d3f62d236dbb2cec01c8c8c828198e2
SSDEEP 12288:wI7gPAXruYyVHHaf4HJ1jwssawsUoN9PqI:pgPiQnDJGaz9
TLSH
T176552367DBEF4401F32D67759689E0063138BEB5AF90E0D778197A6B2930A701DB2A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d0124f0d32e380ef79599f50dfd112c432eff479a6774d4d7da073e037626ef8
MD5 8ccd809964bc2b63f0bd9b57592448b0
SHA1 34727b6f0ed09e50b8587759a2459aecc7bc6d8a
SHA512 2b9f6d6991cdc25edec16c21ddb63a5eefbbd1aa2f4d97848bc47fb57e901174ad30ef7272fd9cfad8283d141d9d883ce66858182b29a670c3a7e967224d27d9
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bY2PiQnDJGaz9:0gb4mBIBhGFvnDJJh
TLSH
T1B565AE1E22EC02F5E1F9E2B8DDAA4417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7c3df416b1a89b8f215d65e1b6c652814163172d64c5ee8be738fc207faf6d7c
MD5 eb7fe986e9ce5d9e83981faecab93a49
SHA1 c829e773567d958bcd638649007d60d4bf99f2ee
SHA512 f417826c66ed7fb62d1a7243cce06263badd19e259d2d131cf605d62cb3343f386dedd77eceec0991b2e291dd2f35d92ec01e8cb7c2f3e5b6c85fb49085bd7a6
SSDEEP 12288:MGn88u8FpJqH1mmqQyizr9wA5hUo7WCmjPAXruYyVHHaf4HJ1jwssawsUoN9PqI:MG88u8FpJqH1Lzria7/mjPiQnDJGaz9
TLSH
T14795F16577E501F0D47BD1388A868653F6B1B8251364EBDF06AC8B561F33AE00B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 26a5d6f807ef688a74702ffdfb841e69c6a2ec8b4df1d23c4ee0c044ac018a47
MD5 026cf8e029927e52cdd26acc1f759cc4
SHA1 075ca5bd6babc2fe569efbff353d1147467d6d82
SHA512 bd3b2380d1b823160cc8210772a47b8f96f6fd3f52775a4790840119f38bf4c3059359fd16c53f6ca0107e0a77d48ec3f9b3fc67cf373a07acbe0352d7584374
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTnDJJh:CG05lO43bODT
TLSH
T164D5CF6A62EC11F5D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 34155e685609029890c8ae04b77dacafa4695ebf1aa6d32039473d02e76d6aa4
MD5 ea5f0f5dfb6f17b834be9179962577d4
SHA1 6cff77326800d43e573058cbee7f74534d25bd60
SHA512 e91f4932b470d05de240dc2cd4970fd5cb8e6a54807523a21953d53254d6a4e9640dad1885357fbf8281ec90dec2950f1fa5f939f6c27601b5714288bc799237
SSDEEP 24576:9fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnNPiQnDJGaz9:Na5POZ3hJt2pasx2+mLnDJJh
TLSH
T1DC65AF5EA6FD01D5E179D17DC583860AF5B1382553319ACB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a6bf6dce9a65ca1c76a3c06540284e387d278b5d1df65f86408a54e1c4d4ea6
MD5 8375fe490e7746b8dfade438e883671d
SHA1 dcbd07e441bf66a7bcc4f2605de26b18aa95cad7
SHA512 8d4f0a1edb7194ec4e85a2a581ffddc30be6984fe105bf998e32a7854719c707ccf07787173d33a4d340305856451737712855145408c572cf5b86bd10201173
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7Fk7PiQnDJGaz9:jNc/zEOVHFcnDJJh
TLSH
T158858B2623E901E4F1BBE1BE89679546FA717869173086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 252407fa3c2cd8be88f94a65a3dcf0b373ab5223e42bf33ff32e298c7364f210
MD5 beb822fd13ef8e51a64af408b037d8db
SHA1 c4d69e3dcb6a69c22dcd46e0423618f8528012b3
SHA512 df64c17ab707495271c42f7625431ac62193c6326d0e36699cc0f19786e864fb060b933ee8060ce777867bfafaa9bcd7d52226335b1ac72417fcd45f1d66f676
SSDEEP 12288:jkFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17nPAXruYyVHHaf4/:j3kNvNnaFeYhJNtmZBm5PiQnDJGaz9
TLSH
T1C855AF2EBAF845E4E1FEC6B5CD238512E6727861173292CB5290C13F0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 dd827a433be81dd430dd392c9c3f13fe3dbddc3884fa9627f0ee5471713abb81
MD5 509754da9e6ad8441cb67c49f6554002
SHA1 669fa90eb2ea7567eedc9f51a1ca966d02376421
SHA512 2263807eaa559391ccf867d64d7ad07af1022c6e3dba33c6a0c1cc721ab1688f4e8668e0954d7d55439ad25cd56bbb18aa6ee61cf3b904f2dbc8e67ad49a0bbb
SSDEEP 12288:IHvUrBFrEjwaQXPAXruYyVHHaf4HJ1jwssawsUoN9PqI:IPUr+NQXPiQnDJGaz9
TLSH
T18375E12F66ED18E5F67AA17D85828609F371B8621711D2CF02A0817E1F73EE87D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 e781843bdd6c29e7e4ecaaa40650d367acbe176e689c91c542c01759d5adb8e6
MD5 b995e8b89d9e4497d6fc2ab3a2895a21
SHA1 ce8fb23ef877550818c7f0268133be794421f6ee
SHA512 ae9dcf7d0932d52bd3634fe6563dac5aeb5177051f3af17ff4629fd468f241a1538ff8051a7d937f89cb7e1bd87d53d3f267adbf8c95c10c464d3d3bb569ce75
SSDEEP 12288:iQcMxWDXN1Dp/fshBItT1IQgA8PAXruYyVHHaf4HJ1jwssawsUoN9PqI:gD3FHshBIYQgA8PiQnDJGaz9
TLSH
T11E85E17EEB9D04E4E57BD2BCD6538506E2713CA9072265CB02D481BA1F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-323-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/240-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-90-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/240-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1324-9-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/1324-0-0x0000000140000000-0x000000014012E000-memory.dmp

Download

memory/1324-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/1324-78-0x0000000140000000-0x000000014012E000-memory.dmp

Download

memory/1636-401-0x000001787AFD0000-0x000001787B153000-memory.dmp

Download

memory/1636-322-0x000001787AFD0000-0x000001787B153000-memory.dmp

Download

memory/1744-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1744-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1744-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1744-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1744-122-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2800-270-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2800-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2800-55-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2800-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2936-302-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2936-79-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3384-110-0x0000000000F30000-0x0000000000F90000-memory.dmp

Download

memory/3384-411-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/3384-309-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/3384-305-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3384-326-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/3384-117-0x0000000000F30000-0x0000000000F90000-memory.dmp

Download

memory/3384-108-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4216-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4216-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4216-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4216-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4240-46-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/4240-40-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/4240-39-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4240-47-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/4240-51-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/4240-53-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4384-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4384-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4384-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4384-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4384-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4388-68-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4388-66-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4388-74-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4388-287-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/5132-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-96-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5132-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5132-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-306-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5132-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5628-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5628-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5628-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5628-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download