8d2dfdf8cf74ce977167ea76369b317c5aca5f0b03b206526f0795040acffc1e

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Size 1.2MB
Sample261002-raz95sssas
SHA256 8d2dfdf8cf74ce977167ea76369b317c5aca5f0b03b206526f0795040acffc1e
MD5 5b1d71717d83985c3ad7659e7e332ac5
SHA1 a7d3a1078e5fcb2cfdd48336710bd0ae93ce9b56
SHA512 411b84fe3aff91a9b02c99c8217e58582b1f398cc56aaa62477ce43f3e5d91bb5d359bbef0be087e160618b5270cd8624dd26c8eab247a1309a69870064b198d
SSDEEP 24576:H4jAeYvQn652fOdW5DhB49vDWRo6z3UGSl:H4jAeYy9H5DhB49vCRXlSl
TLSH
T12F45D006FAC55EAAC41AD2744147D7327732B8895B23EFFB138497303D16AE16E38758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2388	elevation_service.exe
3240	elevation_service.exe
3400	maintenanceservice.exe
6096	OSE.EXE
3596	PerceptionSimulationService.exe
2412	perfhost.exe
2080	ReFsDedupSvc.exe
1484	SensorDataService.exe
4844	ssh-agent.exe
5916	AgentService.exe
468	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dc2f02fdb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055afc65e7652dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1368b5e7652dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbc40b5e7652dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	5916	AgentService.exe
Token: SeBackupPrivilege	2080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2080	ReFsDedupSvc.exe
Token: 33	468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeDebugPrivilege	4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	4056	2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
Token: SeDebugPrivilege	2388	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 992	468	SearchIndexer.exe	100
PID 468 wrote to memory of 4664	468	SearchIndexer.exe	101
PID 468 wrote to memory of 1968	468	SearchIndexer.exe	102
PID 468 wrote to memory of 5304	468	SearchIndexer.exe	103
PID 468 wrote to memory of 4532	468	SearchIndexer.exe	107
PID 468 wrote to memory of 2864	468	SearchIndexer.exe	108
PID 468 wrote to memory of 2896	468	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_5b1d71717d83985c3ad7659e7e332ac5_akira_cobalt-strike_satacom.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6096

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1484

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc04f4dd8b1c154b48274709753f01099fb5ffb9c5161e4e1102120a61edee1d
MD5 e72271c6081f65461e195015932b050b
SHA1 2ca21dc593e1b24a1a7c8b861bd17cc0c2d03385
SHA512 246b4be1a706921ae1b323f995c826864c91729c473da0cd5918526478f96dd179c5d95560c9dfb4dc387f0c129e5003d5ad25244e561dd6ee83c4c1ebd9479f
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnK5DhB49vCRXlSl:h3q6HjBnphB4YzS
TLSH
T1A2D58C03F29900E9E06AD178D7469533E9A2BC890B34B6DF0780B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 945145914fbf4ae03f9a2d07a70a1b475ef238f9c56395bd4397ce4add768917
MD5 d777239fef7288611a88a64e053ec0ba
SHA1 32291ac9164e11a89bb77a13c09621f61f509b9d
SHA512 f9bf6b99868bce048ff3c8db790c6cd0ac8644d32dd80e8db9f98661a26821f6a835e69ef2dbae17a415a39e0d4ab589f1721ee483b37fb2da45dd33eeb9aef4
SSDEEP 12288:R1XLsswWkxy2lRq2czA+uWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:fXYfDtczAL5DhB49vDWRo6z3UGSl
TLSH
T1DB65F12877E408F9ED67917CC8A2C551EA327C9547A0E3CB03D49A651F236D85E3FB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1a7d6e96ce8b981fce15b7fbc2aa8c996abdb981c91c010089e3aac7d7ff6c3a
MD5 a5351210efc80bdf4f8d8b3d6677a7f5
SHA1 2a3d2cb8f1d2e98f7fa8ef1cac0d881208dd464a
SHA512 64f62cdd59b4ebc90a9271ca3b263918b319ad0366769b00c9610ab6fcc00ef83a5580726d8df71245b594af37b6448ce122eadcc54607544e91312891c9c237
SSDEEP 24576:P0Le5ji0hmxirMC5DhB49vDWRo6z3UGSl:PPji0Act5DhB49vCRXlSl
TLSH
T1E2859D15F6788331D073C0B9C5D2A69EED7130865B308ACB4286D76C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0d6a13cbdcbe558e839b9729152083f4e549351f806958239bc1a236c31da37a
MD5 7e8ada0b50d4287b02eec96d66b5c062
SHA1 2352b9bac728ccd119cfce2ec1d6861eaea73a9a
SHA512 4e27232dbcfc6862235640e670274b35e2c02088890acd41f34b9e61da8bf4db2825f636afbc77df5ad34d1cd2c6914b8dcf276897e244efba9da920fb7fa051
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyu45DhB49vDWRo6z3UGSl:j/ezSC6vUzPvxHjyR5DhB49vCRXlSl
TLSH
T131755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 08364c3cd0ac71b4569a308b944edccf9128b70aca272bb535de958e1482644e
MD5 de371197a029fb04546a632a5ccc3e16
SHA1 2af455e7e012e303f5d4f63b9e94d8a4ef5fae34
SHA512 141aa4bf937a086b51c3fa5bc01ff0888f1651322a89c1b2bbf9586cfd873034c9de664483f5969a05e8f81d002f2a0075f8ca38373c1f59c887f3bb355d3a49
SSDEEP 24576:hVbqPb88hv/l+635DhB49vDWRo6z3UGSl:hVO88hXl+25DhB49vCRXlSl
TLSH
T12855AE65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 db9bdc6ede3f6be433035a1da217b2f3845c7c11bbca978a7b284abee23f5d36
MD5 7c65699eb443d6cc45bbc290eeeca841
SHA1 1a4891a0ffa0305431183e581f7816dcffa84bd8
SHA512 9f1da9e26f706dd32c58738fe454b69718ef5a3aae57b8ed6a891f484708dc9a9627304a2b5eb7053730a462cb06c0328d36b3be4ce728553fae76aeaebe41d9
SSDEEP 12288:TRBuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:TRe5DhB49vDWRo6z3UGSl
TLSH
T1514523406B9C1412EB93397CB5E5C9D52920ADE8F8F0628F65C8FF865A3EC20D26F547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9bb1a2a0b8f17ab4833d386150df12570425c9faa8ae93dc930b9cce19d4de62
MD5 9379417633a246a48b90f1612cc30db0
SHA1 3ff819010422a78ad818174eb182539d70a7b3f8
SHA512 7372cc6cfaf0843b55cdaacd9ffd9e3a4aec60cc447bcca3646a7e850c3e810e454f3e911d802c1a27ed11bae5a82399a7d62c92810dddebc4536590d0344679
SSDEEP 12288:3eBNUbTVO86UKuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:3JIUP5DhB49vDWRo6z3UGSl
TLSH
T15865CF3BAE28FCD2C27A5DB85A91C640A77278704F61A3CBD165C30EDE235E05E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ed8b5b68fc949dd12fc12caf7138e36d1c716c0c422bac8be66f9afed19786f0
MD5 1e084e181534b0f2439114dc661751d6
SHA1 4460f703c0f788e382bb3192b89ba8105eeb9751
SHA512 b765951a1d0376d9789d000bcb3b20f02da26cfa3167a4df5c65f1ba1a00dbc24222d3c2697c6358dbe5ee7c155cfb34d6406e5c2dc3f0b8942076228e19fa94
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:TQvGAdlCEL8c/yRNw5CIphB4YzS
TLSH
T1C5267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 14b67db2dcb39ae78819ff92afaf38d841ae8fc5d66e83662e803cc0bf32270d
MD5 d375f63b76be422170105c47f0f5cab7
SHA1 4e979362b1897a0975e4d09553c768a614ef7f06
SHA512 d863fd682496dc7926228284c4ead8e409624b845f9b3725b02f0c9758e5e815492dbd3b578d134ee34734da8afdc00ad963a0ce50d03621876039329a74d7f1
SSDEEP 12288:uAwSfxL/2Dc34DLLmt0LDQewsAjsuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6nl:TdewsAj95DhB49vDWRo6z3UGSl
TLSH
T12B75E030FE74E032C7BB0DB62B75C716182C79604BA11AC7E3E89E8E59345D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ac2e97a766852c6045d19a702c9024527c2e5536de2cedb683628105010037fe
MD5 c3c57aa53c8fe5fb4c008da3d0e315a0
SHA1 bb278bce59796753dfb9d7e670b1e30ba86fdab9
SHA512 3c6061056ef58eec5a3558c70c1bc074bf1c2084f3b783b7bf4195b70fc2de95dac1d6d2b77ed48f9d93b19b706a4a2f8301709f01ce136fb425b54d00b936bd
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFp8I:YUEtQevvqc2W1cpV2EI32Fe
TLSH
T1C7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 22cc8db573d1762e7adb3b17ea1a146e312df76e1ac6329ca9350be40e22d0ed
MD5 f37a2772f5bac14fc4e4f88d54b83e30
SHA1 588b55f326084e5da3eeb8eaf48445db4ebc9439
SHA512 dd66c59900c47b3514d1091adb4f019dd7510526711c4ed7c56e26f82fb4eb690cca8b0257f43d910f0b3835b4fe9dd1c8528106eb0de24f75ade28fa956e72b
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/zd5DhB49vCRXlSl:hoq2Vjnm8phB4YzS
TLSH
T1CFD58D0976B8C1E4D1F6C77896A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b8d4b129d3be18634c7250c996f0c9280757d267323e4e489e60b5aaacb34ef5
MD5 84c91b9ee12501119f1adc8a3ee6c3c3
SHA1 39e245e4edb54c1b4db9892f4b02c20a0471a28f
SHA512 e5bf8813b49fb1229d218caa2bfa5b6c18365c87dccf8d548275637551370b3176769c0180db9c977bd7bee6a37dac160db12e92ffc9e4518c5806ab18803817
SSDEEP 24576:SAhGLJIFoiwtA5l7S53c5DhB49vDWRo6z3UGSl:SAMyFoiq5M5DhB49vCRXlSl
TLSH
T17D35AD80E7F945D4F5B3AAB899B68571EA76BCA95E31C20F2150D20F0E33E509D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 10dedd679dc4faf38e2b0a6853f63c21a92f6f66ffa893198ec78c78f275214d
MD5 2d770ee3adb654190f2e0be91881202a
SHA1 c6b66a0c24fdbe49e1b60e44729a7506a08a024a
SHA512 187a35a9a136af530d59324ab5256e9245efd397678aea8efe4efd5db2a1eb6aa90d710fab784fe6c5edac8fe27657068bb33a499f7af103d89ac96ad81c6924
SSDEEP 12288:fmw5HEjsChNVBFgl0WDm+CfuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:ewuoOWx5DhB49vDWRo6z3UGSl
TLSH
T16065F14536E80CF9EAA355388597C536F7B2BC512A61D71F17A0CB4B5F37220AE2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8d9283d4e85aea86f695cf681e0f44acf8239d3a8ad32686329b1e24968390a4
MD5 5e031c492efecd11722d5a36ee5b0979
SHA1 584fec4cf88cddc903a88c2f2c8312482a2f3846
SHA512 8ec5bd7497bc26161a4c7ac3662d4fe0e5b2726f0434e303a9621b37e7103883ded418db966c7184fc3798c207329ba9da3a6cf90821912515e9b47f100e46db
SSDEEP 12288:DBZ1Iy8uWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:tZua5DhB49vDWRo6z3UGSl
TLSH
T1BE55128433E820B5E693667CD9E18A8597317CA667B143CF16848B861F37ED05E3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e8599d41e9e1fc7a8a9fa34d958b2656847793af526aa4e63b870e3efa66f082
MD5 9e636b49eb3523c5913dc4e6e61b7c96
SHA1 f5ab37c5086c600fef0addf5a4bfe5f6d5579798
SHA512 36386f9e79f582a9ec83feb0314d5e30da54e2a06ab5bfadc87668592673159dccfa819393b9ff9c8f353f6ca868e68c2bcf5649946c61be7d6276caf4c1f553
SSDEEP 98304:XQRQyi36YOcPQLvw2gAf+PN3DphB4YzS:GQyiKayX+PNzp8I
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4ba42d24f0babacad6292771bc60d3bb3a8b143a8ac6712627f6ff242e4cb4d
MD5 1fac0565e1cc77700a9bc00f7099af94
SHA1 249dee2aa506f8de98d730edd8ab17a3d387006c
SHA512 79c008b5663cb4f8cf6f1cdfac8671c5ae7af5cdaf3ebc685e616dfbda48cae342a10bf1a495cea16bc18b6758b2cf37860f81d54f58b38db75216c76c1042bb
SSDEEP 98304:RQRQyi36YOcPQLvw2gAf+PN3DphB4YzS:IQyiKayX+PNzp8I
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f3ce6218e2c27b390c8c72fd658a6372bcff8bff4243aa4006e32833608937fa
MD5 4fda22b7c7a0787cdac48debf65bbb6e
SHA1 8d90302f1413685584e86983c1e0d11fd0e69c66
SHA512 6933d35463de35ba7afb88cd7b17de819d48dbb5cca968e4a30495e2c79e655e283d59d80cdb1bb42018796fc33479079af75e5ecf0fe7048403c25323d7076c
SSDEEP 49152:O68Qg55nhheWu7PNU3/t5DhB49vCRXlSl:cthWRc/tphB4YzS
TLSH
T106B54933B2F600A9C44DE1769F4A872196D17C75CFE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5125df546708989942fe4dbf93ecb9f95aa27da2f1ef0071f347f8a5783dbde5
MD5 302b0bc7663b4ec02f82a9fdb0a60c4c
SHA1 55e9dcf2a51f701ce49e944ad62f195252addf6b
SHA512 2f031bae30a698fa7706402cf43eacecb54f5be6e6cbee3fdade5eef340cd9b31e3ab3e46d1730b5158550c244e0e1cea39b33ed514d06a77e32e7276b092d69
SSDEEP 98304:xy5112gYy5azzVvL69nLKnhZephB4YzS:MLIHmWhkp8I
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cba29b0935fd80eb1583e01838090b4bbacdfb46a84fc50ea456ba5f500cd3cd
MD5 70eb20388346d16a28f2240f888ee305
SHA1 19fa5820c41295ea15def4913a937460f97365b9
SHA512 6b63a7472d7b196989c3074c592c15db23030badd6fc940ab1356bf097845011f54de8a8b48a9dd8af69cbbbc1ab943d5cb2ca82997186e3bc211f48f2a1ab6f
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl75DhB49vCRXlSl:Ju6JmVxd2d7phB4YzS
TLSH
T1A7D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8778bc6a29f9c731605b9251c1f4f155d10a4070864f235e35847703865c681e
MD5 9549f0f559b11e402e32b4d50c1d0408
SHA1 2dfeb925cb38dd5f92106555c72c05e8e12d50c3
SHA512 6363fa5a57ee9150a212a1a0e3ba1cba0d24a160780e6e7661008fb41773c9011b1e36db96c38e95f29276dc450100e34d798ab38b0c8078619f6a644310d088
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4xv5DhB49vCRXlSl:xmifPbR8phB4YzS
TLSH
T150B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bb1737d8dbd22c347d3704f9760fffc11dee807833a1e50f05cbaae8630ca4c2
MD5 c686e7df1adc78c57fe8004f94406f53
SHA1 bb6d8f0d3bdb7cb2e17791b2ed5b27b5c9fc16ab
SHA512 6b613e9e00fa6b5da0fdb86c8a5f17436110e3a1dc76ad8a73920edede6ec14e26ac2bd9e41c03fca3e331c44fa3785645bc4a5431806b3f487455396a755fb1
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqa5DhB49vCRXlSl:Y5dKTi61aphB4YzS
TLSH
T1A4C5BF03F2E940E8E0BEE67887659632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ff51145f2e5367e6111da4e54c20588bf87962564b322645df6a97ee836a24f5
MD5 5476a2baa25b5f04aa6639b7fa044cbc
SHA1 1e639276ac78889d3ef506b73137a54eb3a2d87b
SHA512 0ef8363d4848bd54a03b9bdf8d8af23f389db5ba42ce1f405316410f547dabeb27ffe5bcf968f7724631aac7ff3d112e8d3d2b7948b9cd93a1e065dbb36ae356
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wL5DhB49vCRXlSl:cX2iyphQphB4YzS
TLSH
T1D495BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4136aa195aa416c2a8e40a463ac83addcf29ebf858b2aec2b2435974f271bd58
MD5 229a86964d71867140cf347ee178676a
SHA1 c5faa80d0b35d2079c46e335d5ead491e0266f7f
SHA512 174c40b5cfc3d4a386aae81cad693f547e787474b03a17293fafb9ebcaa8007cb1ce3e3e5a84d0344b3c1b4c421d05c47544bf24f0aff8e88ff309f12b37368b
SSDEEP 12288:IJuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:I25DhB49vDWRo6z3UGSl
TLSH
T1694523407AED0412EB4239BCB5A5C9D928246DDDF9F122CF66CCEF425B3EC20526F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2f418d5175e8053e8b60be6346e55127054f20dcc1f94cd16934c28c67ef5d3b
MD5 34b36c45539204014469ca63c29a5602
SHA1 ad42e4b93156f5cdf166762821b0c0373202a39e
SHA512 9e02cdfc39f28b3a70621bb271f601df4e40e2845d2857fc4e22d96c2cea0b65f68219e92e6cb33086b47190048d08697aa3d5eb272aac2d5919d437ee35c542
SSDEEP 12288:BguWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:BZ5DhB49vDWRo6z3UGSl
TLSH
T16A4523407AED0412EB4239BCB5A5C9D918206DEDF9F122CF6ACCDF425B3ED20526F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bd13ddd7983ccfd2dc977b5ca9752e858c8cdd090fbfc5f56a42cae572bff33a
MD5 0a86ec964ea24572cf2d898fb479bb7e
SHA1 58f3d41f5ed86f269b4430800ae1d028920b18d1
SHA512 5001f7e873c32b7ba54086a4995ef107c186873153133aa90ed5ba98d16f38252a99f859141c0e41f9811373821d45c3176fe13e4f121c65638bf2b060efe65c
SSDEEP 12288:0yuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:0n5DhB49vDWRo6z3UGSl
TLSH
T1534523407AED0412EB4239BCB5A5C9D918206DDDF9F122CF6ACDEF425B3EC20526F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 18ceb2b48024c3097275046b62071e56e49872c8b5082e28ef06924faf72b10d
MD5 7d47d4d8c5d996ee38e7dc09ef275a18
SHA1 2c202423598d4164dbc7185cc6fc49fc44392555
SHA512 23d240b4087c578c2eef1e3452c4de7140089ce571856c4369a27956ee2d4c2753de416f7d3a0d87d2572b65c1227378836e0d629cd8f8c936717f5fe7b701ad
SSDEEP 12288:/V7uWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:+5DhB49vDWRo6z3UGSl
TLSH
T1C34523403BED0052DA53B57CE5B1C5D56630BCE8FAB163CF6A848F460F36A60963FA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f6819c2a468789afe9ed426dfdadc9fcfe89afa826af6e7eab25ce9049aacd0d
MD5 1b7dc96436b9c4072590654d81228095
SHA1 0faf51459d7c47f65f0350c67b211262147ac402
SHA512 3435a9a33786cdd9cbba8feeee72f8e2a164125ab18dd3acf65e99a4a9d412cf867f4293181571a0c99474b6bd7d0141aaa1ced9c851eceb2fa348e61df31559
SSDEEP 12288:aTuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:aE5DhB49vDWRo6z3UGSl
TLSH
T1784523407AED0412EB4239BCB5A5C9D918206DDDF9F122CF6ACCEF425B3ED20526F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a2cc0b57bef54f50d27cfa95154d1d3d1d555dc55eea566a8c9710848d669c63
MD5 781053839798788805bae001c13885d5
SHA1 e030bc7f2c5d41bb67ac73932fecfe5d27214099
SHA512 17bbc8ccd27be9f06d555b10509bd6fb29783f0436d4c8c7ed0d1576d8cde5811690b77c415df726f7b16ef4af8ea498a628dc3e66cdc1db2756d9134c56ee13
SSDEEP 12288:XUuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:XV5DhB49vDWRo6z3UGSl
TLSH
T19C4523407AED0412EB4239BCB5A1C9D919206DEDF9F122CF6ACCDF425B3ED20526F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f12e01aa5b1431db499706338956061757fa6f5cfacb791cadf4edd071b0017a
MD5 25f421ff59359773bcdfd8ef7c303b6f
SHA1 6bfffae9391ec3e301fee2a247a9731f93ab8481
SHA512 98dd5eb9db161a195c7d5f065905b1cea6facaaee20eceebfe3170de5a3fafd436a61d8bf4935463f0aa5ad11006ab539c000be4e3e1a6a79631af3379b7e797
SSDEEP 12288:N4uWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:Nh5DhB49vDWRo6z3UGSl
TLSH
T1494523407AED0412EB4239BCB5A5C9D919246DEDF8F1628F6ACCDF425B3EC20522F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7884b5284c73032d326003950d1fd2da8a20cade03fc4fd342d1597dfcf6953b
MD5 cadc96d64cf52c0c84344d8821ed5d39
SHA1 fee2aa43fa9ca62b09bbe7fec4bc6f17e9a48bae
SHA512 f23369e14200375fe8bd5ad76689fdb6a4580c57c528654f729890fc9d9c73e48388f62b96402829d9904ea53a54c4e2e9dace9fe2871bb7157b650e2b2e85da
SSDEEP 12288:giZwb6zzFEoS2cPvyAuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:jZMSzFVSO55DhB49vDWRo6z3UGSl
TLSH
T1D7650194B39408F4ED63813EC9658946D6B27C5A5AB0C24F13E83B175F337A01D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bc5fc5a17cd7db4f0082df4b9c60ca954afdd06e2384fc5e10f3a9d2538e4dd4
MD5 ef1c65d7a233cf161bc6a3360b2e3962
SHA1 1252d243397d283783c562a62ecd427311c683c0
SHA512 1873997d9631572f3af80ed7f808e4a43cd198979dfcbfacf0de19e1855a21b73a0abc8a475c2cc31f45fea9ab356e9d5a1e9e8be2d12048824550017caedec1
SSDEEP 12288:1FuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:1q5DhB49vDWRo6z3UGSl
TLSH
T1674523447AED0412EB4239BCB5A5CAD918246DEDF8F122CF6ACDDF425B3EC20522F546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9b4082ddb1e4d43099b2c29d5a7e47a7a234d918540699dc16da829ef4b39c56
MD5 3e539042a51108c390b0d3d780cab4cf
SHA1 35bfb95f4a104d51fa9c905025d34382c1dc08fe
SHA512 2e924ef22311209992a57006669c0194a9a8c641fab8eaa89b41349146523bbb91005178411b29eef384aad83943d8b5fd5bdc27cd1fb1fe94701f265ee15133
SSDEEP 12288:IRuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:Iu5DhB49vDWRo6z3UGSl
TLSH
T1584523407AED0412EB4239BCB5A5C9D918246EEDF9F122CF6ACCDF425B3EC20522F546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2ed41f5fe86bd11f251cf1703b8f9830fd8b60fc639788e4acb075f2b14c77e3
MD5 829f122291a6094bc19edd5da88ffac4
SHA1 f01ffcee3767178c6c9fc99b2ab0f8cefc623ca4
SHA512 b0ee79366f840f495bba030ca590bfb450aa87c7ef5bf577d6e3bbfd16e46d54831990d818b82339ec981d8cea6065f7d777b5ec93961f19038247f56e625644
SSDEEP 12288:eyPz5L88uWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:DzyN5DhB49vDWRo6z3UGSl
TLSH
T15C55120673A520F9D2635238C8A24A82F7717C765B7086DF17944B762F376A09E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 de9cd4980190bb0b075abf064cb6cfd34bc2a666b51c0a1b2732c31f04294635
MD5 591c0218f00e70911ad1ec28f7ed60e7
SHA1 85657588bc69c2836b6dabb62e0626c404f25bc7
SHA512 be937fb668cb38683c9270f8968512554592af8b5496867fb65506c608b22de1e22043f539098e073ecd4f2e74caf06959ade779a6652bb05cadc56ac51b80f1
SSDEEP 12288:3FuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:3q5DhB49vDWRo6z3UGSl
TLSH
T1D14523447AED0412EB4239BCB5A5CAD918246DEDF9F122CF6ACCDF425B3EC20522F546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1d69a21692384ed38bdde9ecbbe7f80eec8c456346f50b372dcf223e310e03bd
MD5 89401023a25c57b198cf5f095a05ed8f
SHA1 b8023aab6454fd74592dbfc17e31985b78839700
SHA512 c2c8511c4d086d4219b126af6ebb806dab5b0de92680f486cb8b373f3122046279a5cc833721346c3ce728e0260ba24fc40d3f1a6a0a68e597ac0424404e875e
SSDEEP 12288:5FuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:5q5DhB49vDWRo6z3UGSl
TLSH
T1494523447AED0412EB4239BCB5A5CAD918246DEDF8F122CF6ACCDF425B3EC20522F546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0fa8339ffba682a01fd321f2abad0f75d42843deb45e3461024def5182ade238
MD5 71daa1de149b6c197b8d5704f961534d
SHA1 87a62c0a0c0cc70165997bce0c69f3bdf57e98c2
SHA512 839c217cbf7caf42083fdbfd1eed6cb05a024eab6aed27a83ad95ea35f735c3dff35843b9e257ff8cf50f9aa7b6f12ecc321746f44fab8de6ae9a89c8e54addf
SSDEEP 12288:QyPz5L88uWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:hzyN5DhB49vDWRo6z3UGSl
TLSH
T17455120673A520F9D2635238C8A24A82B7717C765B7086DF17944B762F376A09E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 05b334219d2b47e8a39371399f60ada4c7bcaeee3736a87fe4192a670145df38
MD5 7e265379d2ebe2c0bfb20b28af9a3645
SHA1 941ca570f6b2eac94855a85dea7902bf79e79e33
SHA512 6585f5a0de9befb952517bf5cd435a468ab4051fd721a4e51056c4c86704741189a5b033acf7c803dcd36428ffea9c9897ee8cd3090e2c1f58278a3913569b7c
SSDEEP 12288:9Cd9eWYoaLHF3z0z04PDvhiuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:oTHaLl3z0zDX5DhB49vDWRo6z3UGSl
TLSH
T169650194B39018F4ED63813EC9658946D6B27C9A4BB0C25F03E83B565F337601D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 443683492ee048c90a10b573f5123de18f3b9b30dbbd184d8839d66ae4d4be29
MD5 b15d6cb795f80ec40bdd5fbc3799d2c8
SHA1 3dfab5327c84cb1772545bc5f8460014ea6dce22
SHA512 999a959d8cd54694dd52c27cdde4a97c5f5a0ed16d54a98db8148ba0555374e7029d7d094d6ae4ef528c74c0d06896ee62960a53b54d26acdcc827ab78232c2c
SSDEEP 12288:8i4e7+RdTfgwCHKy7GLbbdIvXuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:837d9CHKy7GZj5DhB49vDWRo6z3UGSl
TLSH
T1D975DF90F3E810E4F1B39A35CD728511DA767C9A5B71DA8F0398661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0712dfe42c4b00f9acba51eb9e904438193da7b55307ee0394bade4fa9894e7f
MD5 e218b51220c48609d90a1241ced3feae
SHA1 9546d4f577d8c71dfe5f11ef7b819459b13ab39c
SHA512 16cbbf40fa69971dbe486c661e06b81eafabf7ea60a2349d01a005bf7257ab47d16482ab52f78e7bdda0f2c9034005e182807dc3953230a8f938e52bdd5be876
SSDEEP 12288:pSuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:pH5DhB49vDWRo6z3UGSl
TLSH
T1E34523407AED0412EB4239BCB5A5C9D918246DEDF9F122CF6ACCDF425B3EC20526F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8b9d79e1ee974836c7daa8bc52b4165690df83a57dee6709d4ffa9085e45c86c
MD5 8e9e02e61d617b25eb692035ea8bc6df
SHA1 a58462f7720aa53d69a9c57252d892fa23f5f588
SHA512 9235bc84749ca501aef0d438d783271b9f6fbc5818dad3643053cb0e19eea659b9f47bc4b93a4cd1812170d0558267d2b140991f19d0009cb168d47cd916e7a5
SSDEEP 12288:7cuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:7t5DhB49vDWRo6z3UGSl
TLSH
T15B4523407AED0422EB4239BDB5A5CAD519246DDDF8F122CF6AC8DF425B3EC20522F547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a568daff24316b08bac78471a07e81756033c5290ced9358a729710c36cb6078
MD5 962e57d618d8d3d15cc08d823b720917
SHA1 77017aaeae55a889b50a53fe494e471e00e00896
SHA512 c0d1c51b8e452e2b5473e3c8837508ba102f4e1584c647c445e2db2fbd239fdd038ad4852109ed62b374c92f718713e6b36c1d9ea26b6e3cc314487c7c8ad1f0
SSDEEP 12288:tXuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:tg5DhB49vDWRo6z3UGSl
TLSH
T1F24523407AED0412EB4239BCB5A5CAD918246DDDF9F122CF6ACDDF425B3EC20522F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 977a4e6f9c79e63a8fc49fc1372b0bacd5a1c625e2f69e2ff7daa59ec36c90f4
MD5 b07a40de79f89369be6813e8c83e8c73
SHA1 f18879144942ddd94eb48c08ac00cdd87bf1cf43
SHA512 20995d98c94da5d37c00571b6deb464d76724d232ec7c2f3c44370732ab5273643967fdfa2a0016fc8af8e04bca4a30a0ea0c5e067dacf28b495ebde5f931107
SSDEEP 12288:BFuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:Bq5DhB49vDWRo6z3UGSl
TLSH
T1D14523407AED0412EB4239BCB5A5C9D918246DDDF9F122CFAACDDF425B3EC20522F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5df30c8fa805618c981677a745f4d34ef5eefbc2d4d43ac023947601b75b00b3
MD5 016f0c0cc8365cb3a805bfa217a40b39
SHA1 2b3b6da43af6d249266af8e77edbaeba0e346c9c
SHA512 53e0b6e842c04447c3e06fdab5744459f484ebfaa875ca84423dd08d07685b8263ccf14ccb716d2b4cdcc0aeb55791d207ef62d0221875765543342a792f1f77
SSDEEP 12288:RSuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:RH5DhB49vDWRo6z3UGSl
TLSH
T1024523407AED0412EB4239BCB5A5C9D918206DDDF9F122CF6ACDDF425B3EC20526F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 12ebe2dee1ee5c186f3677653e93f5af4fe5a6332e5e681578aade30a84070d1
MD5 2133f8487ba7c6392742a7dc49d72c06
SHA1 9947d7320039b1addfb7de3710b38b03d947e78d
SHA512 b7ebd83d56aaeb2a9c7d272f57dbc4d36469671d391a699539e2dfa1ca084f70f32d06a4babe2549f2503929539460fba1874efff99bb36bd3a4ca8fd00f632f
SSDEEP 12288:9duWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:9y5DhB49vDWRo6z3UGSl
TLSH
T1FF4523407AED0412EB4239BDB5A5C9D518246DEDF8F122CF6ACDDF425B3EC20522F94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9b65fd06bd70c63de1a507b9b1076643faca1286ec08927dd1c60939999109f3
MD5 0a773036d2e122d1e82295c4678d803f
SHA1 d4401edcc4f7cce6c1355f33727d51d08c71043f
SHA512 1577783b20cf90b5704325980d11d247ed5e1bb1a4c9e5d5cbac183c308750f92b1827742885af1db087dd072b524b481e8b5a26c3db39eaa467f73e580c0db5
SSDEEP 12288:5TuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:5E5DhB49vDWRo6z3UGSl
TLSH
T14A4523407AED0012EB4239BCB5A5C9D918246DEDF9F122CF6ACDDF425B3EC20526F946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 85ec44a41d1b6abdb2f5fa83b8098c7434e22400a01d0eb84e17bb61031c8be1
MD5 f1152799bcc7bc469d3d12ef9f380f59
SHA1 98fd2110281970f36f46b99490b5c16cb8c3f60f
SHA512 f52fd6c615466047be6df246aab66a0c979754c1b89922b2f6b47d343e9353e1f9047f60a9faf44da1681d39f88743e19cc7879f67716388ef3077cf3565d266
SSDEEP 24576:4fwvok9RX6wkyAI+5DhB49vDWRo6z3UGSl:gMnYI+5DhB49vCRXlSl
TLSH
T10185D029EBDC04E1E1B7913C99B3464AF6B178691B31C2CF129A53AD0E37ED05E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 344b900d8cfdc612c5ea55ba97ef61ec30f7f7c884e8ae543444fad229007baf
MD5 e8dc591dbfa948dc64bf1f831840a453
SHA1 d7ac9de73a1f0d9f0e553a2187752d1ebfb64c20
SHA512 d786285f7a1fa17fa92446bd65e18aab4e7be6865ecb5ac8f57332a1644d6872f14d39c7420b2f10506eb32e1e08e30f667bbac50a9bebef564a8ffe0b75ebbd
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0r5DhB49vCRXlS:/ySzPjphB4YzS
TLSH
T150066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556835F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c9fc511fe04c8697f03afc1b351f21881fe42a4ef7482cf38642a3a03cf98aed
MD5 ec7b2dfc9de060f2e8f6f8667c1df923
SHA1 88d5b21fc456847a9e1870a9c1e09c4cc891bbf8
SHA512 ee8176c1685938bab8d806bc061d63b9801d8ad217c01cd76a8eafa969c1dcdfd9d9849bb022a66724f58fd8c92b888ebd50cc37ca55e40f5b5c046bd2186243
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYJ5DhB49vDWRo6z3UGSl:h47JUQj1irIhCnDHUPfF/75DhB49vCRQ
TLSH
T1F865AE1DA3EC01E5E1BA927885158A5AEA71782D1F31C6CF12B0837D6F23ED45F36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 686e151397812f6d467abf4e34b67cc0524d2ef79ce6ec56ad231ee881b292e9
MD5 30a04c3e5100e25d582cb670ab679053
SHA1 dbeff052234d6bdb9a25856ff93af599c5b9b65d
SHA512 0d282ff1d78b519f69c3eae768ed1d026633bc3aab113116c56eee9a41b7d238288f425d4b095727c3933ce394f3ffe9bea76e962cd2b581b7de824e47b4ec6b
SSDEEP 12288:rNsf1uWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:oa5DhB49vDWRo6z3UGSl
TLSH
T16555F108E29801E4C16E6179D7558A81B7337CA597F1D3CB56C0FA3E1F3A9905EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 718621ccce6f8d8d5b4c83722ab2fa91fd3885ab296c4b32e7a0069589686ebd
MD5 3fa7b8bdad36345bc9b336ec9f2e87db
SHA1 3aaaf34f136d081ac8483e1f52d34ef587348226
SHA512 d60dc61ab52503c6561f8d0076cd11763bd21d3cd0b6b0b1b915d1a4f71c724897857dc036be99a85471aaf0c44bbdfe6696fd92377060151313c60d83347491
SSDEEP 12288:3RwMYAlyuk70S9K+z9SJRz4PBZr0h8PMSEhwjrf:3gAlxk4Ss+z9SJRzMfr0SPMZh
TLSH
T13C3528107666CB4FC6A940326E73C1CCAB707D41EE45AF0772C9873FD576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 587KB
SHA256 5e3f6686e2334754114d9dd034cff185f65b1b429e855b123fbbee7572ed3f3b
MD5 06bd7cee22f27eb0d8a3aeed04505b28
SHA1 b69a90fe2ccdfff18e265d9ef2e3350303b6b1a1
SHA512 841fbe40d3503820140ee7f99592e2a2025f3b24d38d9eb84f0a425902c0a630e44d2ee6dff2699712dc57202580d3ef12684dfe4ffe79f238059d12476abd2d
SSDEEP 3072:0jejPrszziD6i+eN2HVhj6jWPtP1G1ygcIgM6:GzziD6BeNIHPtP1G1ygcIgM6
TLSH
T184D419419936E78FC5BA403306365BCCA778AC23BB452F0773884979C876265B5FA7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dac7c0a5b5798c70c7cb9c3a3a85146aa88423fa2c54fc870a3c1e0420a8310d
MD5 656d42b88ff1b5353b571b6fa92d4fff
SHA1 65417b3a8628f35f0a38f67265b8f8b24367a651
SHA512 123f484bc271332826fb4b43e7b15472884a2772cc333dd69304d4da086037dc63d5710245d12f4c9f815ce0d0a342219414cbdcc3b4de41a4fecf75a5cc6866
SSDEEP 12288:7F7NuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:Ri5DhB49vDWRo6z3UGSl
TLSH
T17945234067DC0412EB6239B875A5C5E529247DE8FFF051CFB5889F865A3AC908E3F60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6a0dbd286ba50c6331e13d91cf42c41d5abd947002844267c8dee4c145cc3b8b
MD5 6d833863bef3d2c1481790d3cc06d4de
SHA1 66e169be081ade023c37a53395943d4958e7e063
SHA512 d37d851e8dff6a38401c51d291858f55e2cc13517005eeb7978a8db2f6ee9e86421f54c2731beb68a48bfb9b20f7eb8e90bf3a2eb2557b13d534901f2253d9d9
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bY45DhB49vDWRo6z3UGSl:igb4mBIBhGFJ5DhB49vCRXlSl
TLSH
T1B665AF1E22EC02F5E0F6E2B8DDA64417D6B278161731D2DF1151422D2F3BEE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 542f4b0db54254f19e11a7805dbc1de2993c23c4a9d17977470a1f10fe455734
MD5 c25998998e5c502e595b9d1fa9eebae0
SHA1 eaae5e83bd3a42f5d071f44ba4916651498b572d
SHA512 f84e8a2d58c2566154794b6301b9ed402a3125c0dbf53aa26567f6303ec70aea850977005bb8cab85780324ca02d34ec4c9236a65c25427500e4b9b5b137d883
SSDEEP 24576:BG88u8FpJqH1bzria7/m55DhB49vDWRo6z3UGSl:E7ZFPqVea7/A5DhB49vCRXlSl
TLSH
T1D585F16477E501F1D477E1388A8286A3F6B1B8251374EBDF06988B511F23AE04B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 81c99c07c073e957bee256f9db5eb3b5c7c3e931c7ade9afac594cbc8d4abcf5
MD5 a1fcf57eea43a5e213a5568bb379e90d
SHA1 76b4a043eb1895b02e8b0c3f3cff896a86e680b9
SHA512 d3c0a738b9213a74ee7751c094c27a5ceffbb34c00ebbc4a576aac695803f8c5e986d88175e1a1475e8dd42f45740212598dfc324cbaed97c22a06d80139b64a
SSDEEP 12288:WHvUrBFrEjwaQkuWy28NVZ3B4zwaal1VcMMD4A0Ro6zieUG6n9j:WPUr+NQl5DhB49vDWRo6z3UGSl
TLSH
T1E665F11E36EC18E5E676A17C85828749F771B862175292CF02D0827E4F27DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4fb52dfbea90accf6297fb6259de0870ab11058cf76f72f75c914a4828c1c680
MD5 fff64a0abb3bd99f4ac17445c594879d
SHA1 d9d0177b07a8ebc8ea4d924e77e8d871ae877a89
SHA512 b5cc0cd4d8c77a569d0cb6ba41067b86d2e49d99980a6c3abd4ff24945ce9e12ce7f90e8b808d09c6841fb536a917b7e2b48e227a8a6ed7156e031e2f7044cc7
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjV5DhB49vCRXlSl:WG05lO43bGphB4YzS
TLSH
T187D5C06A62EC11F9D1BBD07CD9C68A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e16b27f11e3c39cb43c59dd18dfc7d529c44e79733f9c5ad43dad75cdb3df0cf
MD5 bf3512ea95365f680bad111970c799be
SHA1 5d34c902cf59bd3ededa75e7dba508c882770a88
SHA512 78870467883c1186acc50217a5a19141fe6231862a8163bdd4a1cd6c0b6fa42bc0f7ac867a82c61ad87a62c0e8baf0b0ef8ca062670f336af149beee31e83861
SSDEEP 24576:Bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnr5DhB49vDWRo6z3UGSl:Ba5POZ3+Jt2pasx2+mt5DhB49vCRXlSl
TLSH
T17E65AF5DA6FC00D5D5B9D17CC583861AE5B1346653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6890237c2ef9a5a200f1f370b9e4a1c24f81c3a62d1b2f8fc0f40b23053dccad
MD5 efaa8f3162ca32b1d0f23ee87fb0f285
SHA1 b6ab1c5c174766c44152b1f7881b72c54bfac150
SHA512 b6b137fc13c29f45ba2f664f0d9a2c7300ebf61dbd81cc33c3a61851a380db63fec12422d331a3f785d3283493dd8f6e3a17ce3fde95c98804949096d324d02f
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkR5DhB49vDWRo6z3UGSl:6Nc/zEOVHFg5DhB49vCRXlSl
TLSH
T194858B1623E901E4F5BBE1BE89779946FA717869533086CF0281851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3f520ae2a3e383326481d573e1f894d4f01cd572f143d198358ad62d5dee8e0c
MD5 6725d10893003465d30668b1ec828fd6
SHA1 c4a0060c1d0a5d9aefccb14689b307ec2aa80ae1
SHA512 dec7b285ed7b8e4a028c89f23c85506b05163b252ac67240db40d1979b1ef93b0287d6485237fd6d0d9dfa5ab21e0a9863243e845a11295576852f0e429e8e64
SSDEEP 24576:08kNvNnaFeYhJNtmZBmf5DhB49vDWRo6z3UGSl:08MwBtOmf5DhB49vCRXlSl
TLSH
T1B855AF6EBAF805E4D1FAC6B4DD238512E6727861173253CB5290C13F0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 16492ad5497d1ff65b31e5bb75290164fa38c8b82108ad5b3e7e231bde0ed944
MD5 988320e95cedb8546dd34b35ed6c2d67
SHA1 84004674eccbfeee57023b56231eb6d0c87dbef3
SHA512 0dd085f45ba9c89e838efa71eb83073d490278279c1a976fdf8c63614d4e5b4cc5010c3a7ac05bb2cfbe3f96289b9005f6f36dfd3c01d6835226686533467899
SSDEEP 24576:oD3FHshBIYQgAW5DhB49vDWRo6z3UGSl:oDVHeBIAAW5DhB49vCRXlSl
TLSH
T1AA75E17DE69C04E4E57BD1BCD6638A06E67138A9033166CB12D481B65F2BEE46D3EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/468-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/468-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/468-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1484-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1484-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1484-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1484-314-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1484-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2080-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2080-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2080-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2080-96-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2080-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2080-344-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2388-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2388-23-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2388-16-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2388-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2412-310-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2412-85-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/2412-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2412-80-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/3240-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3240-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3240-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3240-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3400-47-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/3400-46-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/3400-51-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/3400-40-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/3400-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3400-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3596-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3596-74-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3596-68-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3596-309-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4056-78-0x0000000140000000-0x000000014012E000-memory.dmp

Download

memory/4056-0-0x0000000140000000-0x000000014012E000-memory.dmp

Download

memory/4056-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4056-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4844-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4844-122-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4844-116-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4844-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5916-135-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5916-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5916-129-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5916-137-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5916-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6096-62-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6096-294-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6096-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6096-55-0x00000000007C0000-0x0000000000820000-memory.dmp

Download