7d7c27bbb3c561f415917cf07fbc5d9b0052ff84cce25988e850ecc4de6f198e

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
Size 4.2MB
Sample260629-ts67hsbs4m
SHA256 7d7c27bbb3c561f415917cf07fbc5d9b0052ff84cce25988e850ecc4de6f198e
MD5 4a19dc0dc6a4a210b6934e9f64387272
SHA1 061d5b17f2b3e6395c35bf492e9202fc206a5651
SHA512 66c3bea580ab31b57dc9f06f43bd23f977c96dc3053ac15dbe72cb220f2afbe290083c791c85377cdf4cfe23e921a1214105b5615a0b768026dd0841b6789e34
SSDEEP 49152:fymYwWuCoHEt/iWpHbqhfm/5ijsfPhkOb5FONPkOL1GuhmNUiQ/lFTjN4:9uTN2hdw9bQUuhmNQLm
TLSH
T18C264B12E72251E9C825C17483265323B7E2F9AD433077E74E904733AE64ED05EBAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4824	elevation_service.exe
2944	elevation_service.exe
2664	maintenanceservice.exe
3268	OSE.EXE
2556	PerceptionSimulationService.exe
4112	perfhost.exe
2624	ReFsDedupSvc.exe
796	SensorDataService.exe
1768	ssh-agent.exe
1492	AgentService.exe
2996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\78ab67a480095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Control Panel\Desktop\FontSmoothing = "2"	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Control Panel\Desktop\FontSmoothingType = "2"	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062c9fc3be307dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dbc443ce307dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dceda3be307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002387633de307dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072a03486e307dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c0ecee3ce307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000363e1886e307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003112b86e307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
2944	elevation_service.exe
2944	elevation_service.exe
2944	elevation_service.exe
2944	elevation_service.exe
2944	elevation_service.exe
2944	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4840	2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
Token: SeBackupPrivilege	2624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2624	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1492	AgentService.exe
Token: 33	2996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2996	SearchIndexer.exe
Token: SeDebugPrivilege	4824	elevation_service.exe
Token: SeDebugPrivilege	2944	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4836	2996	SearchIndexer.exe	98
PID 2996 wrote to memory of 900	2996	SearchIndexer.exe	99
PID 2996 wrote to memory of 1908	2996	SearchIndexer.exe	100
PID 2996 wrote to memory of 4060	2996	SearchIndexer.exe	101
PID 2996 wrote to memory of 6060	2996	SearchIndexer.exe	104
PID 2996 wrote to memory of 472	2996	SearchIndexer.exe	105
PID 2996 wrote to memory of 712	2996	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_4a19dc0dc6a4a210b6934e9f64387272_akira_cobalt-strike_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2664

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 378ae524679f8e145001440d454feb5967a60d7ec1515106e822cc9360fb746a
MD5 b036208408d28e90c93aad7edbe97d88
SHA1 ffbf7575b8cefdfbd2f9f20e4efd29ae90063853
SHA512 2de9084dbc1afb539b318929121f9cf0c1a6d7370a95485729c9eb1900ea3b09302aa066278237e79b74e25e1457f439ebde3f6b58c23aa10e2ffb2deb85efaf
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOQ/lFTjN4:k3q6HjBuLm
TLSH
T164D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f994e4227f54d15be417bd630c750cf59a6974caa6dbdeba9c9b01881e41210e
MD5 33823c1bad9256df2130afcb823a441d
SHA1 63b1d53b4f4f51ec6b8ff41f54f0e73edcb97219
SHA512 cf095bc9d268288075aa9782afa28983833ecb0fee08d5ef6199cafe877326b828cfbfde8d147ce1038ebc6e258c13a9b774a4d174198d18d50e09c48a94c769
SSDEEP 12288:91XLsswWkxy2lRq2czAFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:zXYfDtczAlnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T12C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 da0e9becd4be78e682a110fb09e8900ee6747b5a479755af7f015ac4a210c3b8
MD5 84cbe95de9540ddceba46316847f7743
SHA1 98416c9fe864f79ca1ffae2b27d3a27f479ac7be
SHA512 3dc8a0160202dc864bceef9920df871a2ec3429d280d4c5a2a56bdda69326d27d63ceb449a95a11121c04abab1f30fb48b184863d96b9528e2070d319ae55392
SSDEEP 24576:S0Le5ji0hmxLrMGnQ/tbw/2Mkjy6Fr7g0ol:SPji0AlbQ/lFTjN4
TLSH
T1ED859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7bf2d6ef88595c2978444e8d7e2f6922e995da206e9cee7b3669ec7c53bfbb18
MD5 d0aa91283e83ea44394f0402f5c8025a
SHA1 7bbd9f3614c63bf1c5f68e74bc3eca567789bf87
SHA512 80ca3677c26581bac481e3fc4f11652b05e9e87d2f03c17d96e4c38f20f20df6dcd4f47473c0ab0bd4563d67ff2a0d0c0803cd5ebd623d3b9dc493e7801e18ca
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyuonQ/tbw/2Mkjy6Fr7g0ov:f/ezSC6vUzPvxHjynQ/lFTjN4
TLSH
T1A5755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1f4269b030e0d0fce4fcfbfd846d3da9b7c499885bbfe8ef15705c6aa833eff
MD5 55762a802a868a712a25abd79f48c80b
SHA1 1315abbe04c0bd3538b07e2b50969d21453152b1
SHA512 44ae33a4b59820c0b2c555d45779b9d953b47d9315cb487a0a26373211fdaede99d96775bfc2a10503f6af4ffe34c6f20e640483fc5c306e7bbe71dba103c394
SSDEEP 24576:6VbqPb88hv/l+6pnQ/tbw/2Mkjy6Fr7g0o8:6VO88hXl+CQ/lFTjN4
TLSH
T199559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 16028aa03a6380601cbfd077efb499edaf4c75f484814419aa51a5ce58765aca
MD5 2001529f54ecc760e3e391e356115fb4
SHA1 a7d870e48c5bc5cabf29644f5f7394808b124d65
SHA512 30ba3317a99635eb73e62658094a9d9cf74fead318ea241697f048402fc524724cdae9dc1f832bff70f339e1e6236b2d96eac98883ec606ae4d9373fc0943852
SSDEEP 12288:PzqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:PzqnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1CC5523796A24F897FF2B06B55CC284826B7B0EC1BFD4AB4E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f9fb69437f2d38abdb59401628ee730e06199bc753f72b9c8f24cdb6b2ce4e31
MD5 827202d20a92487ee327f2b99044ee5f
SHA1 35489f8b041f0cd00f46aa7dae12e6f1be94f5bb
SHA512 f64f9c831dd8f27c6c43b9af4914d9d1b9d4763b8159b8fdf73639be5295a7be05c4f09ef2a0f87b077f4d5753c8ca82d5d4039071782dee792002ea3d8a6ec8
SSDEEP 12288:TeBNUbTVO86URGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:TJIUhnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1E375CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9ad4a47b25027c4d5bd2aa095758df85b004e6716b30155f8db44bd8acf00b22
MD5 ff4f198f2d2cbecdb6dd6ba4d4d73f08
SHA1 73a9125d799893647afe8dbb96ab29206a01a5c1
SHA512 d8d48bd30141d6927df6689b71d98e7b461ee31e029f7825ff9609bdf7a84ba9f7f3133ed9f2356a55acd4e9d6d56406b4a1dbea2c89b99b24de961ec711a3b2
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:HQvGAdlCEL8c/yRNw5C7Lm
TLSH
T1AF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7458d646a6071ccb5bc09d22c72719c24534ceeba06165c99bd84b40d82930d4
MD5 5b0309fbece5f43377050a8add0bb1fc
SHA1 14f0675b980b6e1a8579805f34ce4f0fb09bbd5c
SHA512 956d259a1aa8844f44f4c6b0124ca02426fb319a2a0db828367b7efa47de31d59d207437f4915027f908c76f7c0e458caaa2f58bddc21e32176822473e873554
SSDEEP 12288:kAwSfxL/2Dc39DLLmt0LDQewsAjbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgc:5QewsAjLnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1A875E031FE74E436C77F0DB61B26C706183D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d982c39002d02003dae4a89a1a433b8b77b8d612817497735192c289dfc62f8d
MD5 45874e53e33c08b7ffeed3c62ba0087e
SHA1 15b11efeaff80a89a4bad077f64334fb0afea741
SHA512 2c348d152f610dcc8407b1831161026ca8782244f8bccbdb41eee3953322b1bee9425ca881ea47d9f24da9163711c439d91334616aed72ee0c10d5062a822b87
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4L:DUEtQevvqc2W1cpV2EI32
TLSH
T162474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 59af12fde5f0920ce9e0feb9699e8102da2e22af6fe21b382f27c23bb25fcebc
MD5 792ea35058ba9ce3ff4a6d1d0af25d60
SHA1 fdd4001e7016406b9cf5dfffc604b5f472ff12df
SHA512 c01c3c119682dac61e92759c21be7df3a9a5a2d9d787bac6cae1b003040cbb5486d41248d376f6db4d8a3e83f53effaccc74dd3f95f1f3f37e0cf570e3cf319f
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zrQ/lFTjN4:xoqtVjnmnLm
TLSH
T195D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 472eeaa3e1be1b3cff2f2bc3c115032a00c6b1f613567c9890fa17a80b62df56
MD5 3ed69f2c9ac9c6760af59a0916e682b9
SHA1 7b734e530b5833d6ac7234da7b295f69bf2ae6a1
SHA512 3c9b38bb47fa0b4d64d604c142808b1a67577a99217dd36cdd3b3447b1951c13a8b309a233365ac292762da010f30a16cfbf37bb7da40584360bb0f0b86cdfb0
SSDEEP 24576:qAhGLJIFoiwtA5l7S53UnQ/tbw/2Mkjy6Fr7g0og:qAMyFoiq5kQ/lFTjN4
TLSH
T1A535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d44d91ea8f25181e3eed071ece4d3eb429f0cd807dc3e20491fc246cd9aa0146
MD5 7cad2461e8a45bac4cb0a6bb87759398
SHA1 d306ca7bb08adab48fc5c2e0ababeec67931b474
SHA512 9c3c50ccc3974cd3545bf7dd69f347d390d1dc4adaba3c345fd860e82641615d8413f9acc7ffb1c138c5f01dc46a3142df2b99ae7aad1e0f2171237b059f8b11
SSDEEP 12288:9mw5HEjsChN2BFgl0WDm+CIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMP:4wuHOWHnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T11565F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8bfd9896007aaa417f09bc9549fd0b5abda809c213884778f2eeef1e0d79b0a3
MD5 055a63730ca41d95aa9042aa77a2105b
SHA1 c2af26bc90c438b18bfdb31c61ec96967959a6e5
SHA512 09144cafbb30bb14c9d2d00ebcbda7290b6e6f94f89b73bb4b2707fe0d6a5980f089be3ba0fc801b4ab35f1cd9bfaf6b9cb511bd27e2a647db304a2179a58eb8
SSDEEP 12288:KXZ1IyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:CZu+nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1AD55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5efa12e37125dd296f01775e33c7365d1cce6becf76e51e30cd55a0d7296a10e
MD5 5c3cabd45030351db5bdf3989c2fa842
SHA1 abbf92dc1c2fffbaa4b25cdb45a3cd1efb8dd7db
SHA512 dbc24bb199034eec2086ee1f046be82b86ed2cf1ae0c5990d851408496d566b8cc7273fa3bbd0c618bf4194351655284e73221520213283cadbc7560bc757a37
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:0QRQyi36YOcPQLvw2gAf+PN3yLm
TLSH
T1CC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3a9229c93e491593badb250da9b9d0bff67433d9917692cb8df93e546495ec42
MD5 bc57594192f25be063a688b60e25a772
SHA1 444f147d76330b4525b08fd62be7dcd35e94e0e8
SHA512 084589f8a20f27d362e907b62670bc6afaf51ebd53ed27b8f8685b73e271ed66931fb48e77d43f6150706ab89996e136c442a3213a92b35a9cf5567cb573ffb4
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:uQRQyi36YOcPQLvw2gAf+PN3yLm
TLSH
T15D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 624cb3b3b25e9738f145bd14613456dafe758d02e57125a27ff16a4e6cb60661
MD5 109d634f4c7a8823367838cf92c45a63
SHA1 1dfbbfa9cc18df281cdc2bb2a1f2c64a074afc48
SHA512 e7343151003fe16a7cb297b62c933376d58f63f2090f807f02dcf61e527f1af70795103e634420ddfa53805d4cd3f5ecbcdde62f28ea617f9cef4711bbbde991
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0OnQ/tbw/2Mkjy6N:+68Qg55nhheWu7PNU3/bQ/lFTjN4
TLSH
T172B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76e9705d0a74d9fb55fe57cc2b7317f6b3b6f4a9e40127f70b49656f4c5288ac
MD5 b38bd87d93b111eccce567c0cbc0ce9e
SHA1 60dc4be88db7367947c3d17adfe0117a094ffd2b
SHA512 f09761d0fb06399eb7d8c9e8a1defee44a2db92681e59c904ded75578f82485e98a6b55a607717ca05a6372955f04363bf33edd66029a9556e347e079e6f4111
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99j:Vy5112gYy5azzVvL69nLKnhZlLm
TLSH
T173167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfdb76b08e6b506943cad49f25a8379255f07ad832764395c4c55e77ffb9f13a
MD5 4f10a47c2fdf14ec43375f6d8f7a183f
SHA1 673f01da4c742b9634bbe739c85120d06b5fe648
SHA512 08af73be5ffeab232bf072591a274041c06a58c9528046910392a681d46d8862dc3c54744b6a7f3ee93cd50fe377b0c593b6548b705a15dd67e9f2bdbb1b2d51
SSDEEP 49152:dB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1Q/lFTjN4:Du6JmVxd2daLm
TLSH
T111D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7496f3049946c4bca0e550647d5bccb9526b05c144a1c9cb096a4a3abe8ead3b
MD5 d40f617cb8cab2453e85a1e18f0cef3b
SHA1 67d79b49e3cf169c083910801c23c079a216dc59
SHA512 8611457e4682f270a239ed76e27f8eb5659a006d1e8da3b4982492420f6eb4ed7e513e4aff89b5b72e9815c5fc16ecc9c12737e14cb1aba263f2f3292c889e8b
SSDEEP 49152:51hpsNoJpF1A6UU44CwH7R4xBQ/lFTjN4:5mifPbRnLm
TLSH
T12FB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e6e789719d5b13b4123b99ba7b6cfd4f5d88fd0ad8b83be188c17ceebd3c5ca7
MD5 8b588cdca5794e3d5f1832acb1a06e8b
SHA1 8c873a4a2955442b473dfe6bc53809121c3a0488
SHA512 6ca82c2d995b63bb0344778a8a2e434be5f2ae8cc744b33a08c2865b77c46163ac7df07f520b0697bf41f9e422ff9a56fb1068dff51df99ba43fa89752e465c7
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHq+Q/lFTjN4:r5dKTi61ZLm
TLSH
T10DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 30efd88eb780c23f876c820faf8ee8219d147c8db1e331d7fa18b63c01f9504d
MD5 bcb09205d602be2c32706036316c9af4
SHA1 5c2f0385936bd126fc02c80ccc57e9c922a4746f
SHA512 bf4c14f7b5064d71b08f992620ec92a4b16bcae5b357aca4ff7cd1da31140e2394a02bd7da8efb91335620a001b58adace5cbd66bee2715482b4e803729675a8
SSDEEP 49152:bhtSn8EApI0figngiDn0AP5wlQ/lFTjN4:6X2iyphTLm
TLSH
T1EE95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2eda5c9f84eb08ed70bfc3c6823a01b190844289e2a700218eaf770ea49c732f
MD5 5532ea318601d8b96e6cf1f6e27b1ef7
SHA1 f6f2ac1c15403d4593c7cab80c86f47a28c7402a
SHA512 85fdf8c97eae3010955aee4256c68e09ed66f7bf85f5b36c5bb529cb34a51504d4eabb4941d60f224808d955a4981b1a46b73da020ddd210d50fa1a2fb14d88c
SSDEEP 12288:mCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:mCnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1935523697965F98BFB1706F18C828182973F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 460b19438bfb9e85d51b6bd7567c3390157042505dcb611c7aa3282d69b5a55f
MD5 14927504448bfdb199cff711c8758d6c
SHA1 d5a46949f60820d71d51a3c193ce0b868ad8473f
SHA512 d539ab799fb338de7802fa0624c9fb5a05524200f6e6f4f773c5573ea43a13f997785755d3c2d2a5856eca3a66966df0d07252f47cc145d89b305f0d66680f02
SSDEEP 12288:yvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:yPnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1635523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 54e3f2c7980a873053d72a7475fcbd070f83fcff471a754ef294033e460ec4b4
MD5 e1c676f669e3beff245c162db4f46ddf
SHA1 d181f333bea64c447216c012c15639cc8ef9609a
SHA512 928c9a53757ed86d17f4c04845c1444a390cccbc2dfc9d08c80924725463348460064950e3b2da673c008316c5bc797c7d6813b2ef88ec93232599ac0296fdfb
SSDEEP 12288:kpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:k5nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1665523697965F98BFB1706F54C838182973B0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c5bb499834102d7b67cc63967d22a12bb1419bccc336ac8a76433a782110bac8
MD5 83576a6f2864afcdfbac31e84eb8a690
SHA1 e84b767d2b4a301b69010667396851831ca5ce5e
SHA512 4d2a9365f365019295110d9f5e34c6645f1be99fc3cefdc43c09225da60346846466a5ba3f2e493cd1b07dd7f526fa0c3a9131d985778fe67f9237a5f6805264
SSDEEP 12288:cVUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:FnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1CC5523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9f523cf286cb32151d4a9326665368b4260c8cefe1f20e184c4f9de943448b7c
MD5 f6cf475e493d41a50611bf5e4e29d264
SHA1 84c796bbe17dfafa3d96d59fad26503740cd96bd
SHA512 cc3cb5daaf65626446d19a27266138c49c5a9d724b700fe782882320a65781f6327f2f6b6903e0c0c02fee5e8d000bd69c4142380e14e751e6cceb441994ae76
SSDEEP 12288:IcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:IcnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1475523697965F98BFB1706F14C838182973B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e21101f592709dad6c97daad7b6de1244431464925e68f195d43e44fb3629204
MD5 0d75bed9a83e83ed48494a0e6445605e
SHA1 66c9a2d480438d9f54b7026aa8a4c494664be4be
SHA512 d8e0634deba35f7e2aae839c08b3a01a96c8946ebb1bca81705cb8f09b1d43314b72380bb16690a9bfedb82c4e4a63f0dab1a0b7619fce9deb29f58ea41f4396
SSDEEP 12288:XTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:XDnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T16F5523697965F98BFB1706F14C828182973F0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2706711c14268663e4ee38b61835cdda53a0d3aa731508f830c3486e7ffab456
MD5 f40f45d528e13ab1bcd35ea0d178fa22
SHA1 243910e06292bb47d15b5cc838301ae7c72dcabe
SHA512 8bec2a13c3c28baada594903c3b88e83d168c481c4919a8e0572a108a5242f183d861467a66e6d7873b01d086a1cc89f1c6b7203a49f48f107cd7a7cd4476a17
SSDEEP 12288:b3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:bXnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1F05523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2b55060f0645f50b79030149bec0bb651d5cfda6e6964282a6e037e20c69b9a7
MD5 895b5948fb23bba585b50982983f4f6a
SHA1 4808f8387206a8a34ec76a581d283e17b555c58c
SHA512 17e6e32e2235cbf310426d61d21f59307b413d963009d16363164147817f2f31c99e12a9da4c3bcb6d734ea4defb637720f0624280859932208d006893091c77
SSDEEP 12288:eiZwbDzzFEoS2cPvyPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:BZM3zFVSOvnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1367501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ef77ceb02eab9db638c90bc502670d989820a41c74205be9a662a77929db1289
MD5 3c1ec5b7abe00bb1633cde1f9a66f156
SHA1 b39f7cb68be3cb46921578922162a3e2c0d055bb
SHA512 cdad0085ab29c30338b84523c90174ea2731b5601c57205f26cae11342ab96a9ea81c25c6e7464556a06fc46376e9e899acf996edd60f36797e77e6d44fad021
SSDEEP 12288:AuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:AunQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1A85523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4240cf2498a3f5f193f9e3eb5b8d0cb3fd7ad6bd204cb3348f84339f66769f97
MD5 f869b4a33b291f83ec955c9c1e3fa984
SHA1 8edf1b4f8cd27062780c2cd0f41ca67d33f0529e
SHA512 0d80bd1e508495c68a1e8fca4a1ed9230459e7b519abe713e81a4fb8c86de51013ffe3bfb57af88ac4f208299858dbbfe1454bd5ba18f92e4f90eb5c535d8e38
SSDEEP 12288:paGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:panQ/tbw/2Mkjy6Fr7g0oF
TLSH
T16A5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c7e463a42f0aad1bf9b2cc1bbb33d61ec3d915b72881abefa7a1055e0179eb0d
MD5 b00863c871a0dbefbc844290a41c368b
SHA1 c7a3718bded8984355d6d402408bf5bbdee5114a
SHA512 b013001b2e623c5073cc3afc555f47b155913d5fe3180a900086fa5e4c8b77b036566bc959340b766ec83a4f5c375695dde850721d7d46177dd180f9bdbede7a
SSDEEP 12288:jyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:Ozy7nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1EE65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 78a5014f44d45538e874e2db28d7fdad583a48bb2a6c7fe6e6bfe1d91f5ede41
MD5 0836745e5193c54fe80ffb2fca3d72aa
SHA1 b6fa995e9c3ef9a2e869dd50405990db486d8111
SHA512 79c1eeeacfe84066b8d4966e59ae884f4d555b12b7b7d8cfbb306453952c013b9a012720ae2622b2dd48dece6957fd6548f6c8ea30b64f77c23e01415316350e
SSDEEP 12288:0uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:0unQ/tbw/2Mkjy6Fr7g0os
TLSH
T1D55523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8db8cfa0d9e6dcb6b18eddaba61f1b5e0361758e19b63489a66b2ad4c9d77e9c
MD5 e9fdb839b7df0f2b64af704daba64113
SHA1 61e7130fb9f9ec8053f6cb30c06028e5f4af0c44
SHA512 3a7cb028762be3cbc4dceaf32d14d9e41346a390c240176c24a282515c157904d2b864a90eb8e075b5f3981b9e9fcdfc2d66d8168fa0c9804e51093c6602af13
SSDEEP 12288:ruGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:runQ/tbw/2Mkjy6Fr7g0oC
TLSH
T19A5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 eb765f41fdc24e8db641f9f9b49a84e57870cea4348737685fa4099eabe4fa24
MD5 6fdd2cbf900ff20920571ff26987c9b5
SHA1 f36dc9c2f221d6b14d8a278d0afe4a3a045813ec
SHA512 e3d901ccd4dd216bcc6a02b88b711600fed29f980119d4131e5f82fd7914817a5bd300bd0dc224d2bf255fb4a651caa5e55412a631c8c703704a0c9da6cc7ba6
SSDEEP 12288:oyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:pzy7nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T14765021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 af88ce4a758260862ee1c019b5cfe7e555fdd4bdb5281b4b2e9a6131d44ad8e7
MD5 27e2e47cab25b8290226db44570311ce
SHA1 114acbb5ffed645b4ceee5e478b2e112edd6d97d
SHA512 639761fabc4bcdbdffdc9e79d49f0f41329991c73a726df209022af137794152c9d8127e9e64759ded8e9fbaf781e5ac0726c3317d9e7c42faa0cf2bcd4a098d
SSDEEP 24576:VT0aLl3z0zDJnQ/tbw/2Mkjy6Fr7g0od:VTDLljoQ/lFTjN4
TLSH
T1387501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 c1647e7195c942672a5de66d189bb9aafa0582815399db13b4088e477f85c319
MD5 fa751f1fd45c33cde48041e59fbafcc3
SHA1 1eb685b830f4e322b83e308cc163fe93b542823a
SHA512 e90a2b7680be9e109d8cc7e41b910cad979d36865c4eecda77107b014cef990825063ff638cd82b552d9c6ac3ad52105eddd0a81b86cd7456898a5d69e825e6b
SSDEEP 24576:331d9CHKy7GZdnQ/tbw/2Mkjy6Fr7g0oT:H1d9CHKyazQ/lFTjN4
TLSH
T18185CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5b78bbde75be8933d75ffc75f7886590e2bf869d69155a44bea0ed8ad0d8b018
MD5 ee9db18cc4e0342834141df935e98b8e
SHA1 654d42aef1a48acc757c1af81a25ab8c437a8d94
SHA512 f3585bdbcc9a401ddfb0b84643eb477ea37dc5a56b0a37ec5ef2c644cf63fbcc8421125d3e7ec31ae69387378514f4fa0f5b326a98c176a8f3420e0a4a11ee1c
SSDEEP 12288:NJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:NZnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1815523697925F98BFA1706F54C828182973B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 13f1607fad938e7d5d5d263687d123212bab1a31db7e03e4f527f3d01a075de7
MD5 417912d10f3392de160e8ebda4d8cd94
SHA1 26a2fedc07a18ba51f5dedb20dd8ccb0e9af81e4
SHA512 f71b7d941dfa7eff5fd7a403522771ac1005e58e2bae9923f09a04cf6328b6248d235675a45a96c6088da7409a5f0077e4db2d59c1205feebac4e193f21402cd
SSDEEP 12288:prGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:pbnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1EF5523787964F99BFA2B06F54C838182973B0EC6BFD1938F7B481129967D39406DA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3e3a49dda0ee134b80d86844848a05fe104b4bbee8141389e3ea9fd4e61fd52b
MD5 adcd8ddaff4692b7faa77ce881707b06
SHA1 cc51b8e8768d99d093c97dd3ecb0870146112ce4
SHA512 b1673913c7a03ce1f7b4e084f59745533f4ee41af08362045760a25c21224e2281e815a8e1eaa3040f8242864b299cb376911223c668e78b2601de1a2d9859b3
SSDEEP 12288:3QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:3wnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1945523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1f8313db1f2ecbfe71b5dff22b764b4558ebeb714789a19a460633a31f5c8ddf
MD5 ca9cd8c64f2e718c80012f35c4073c66
SHA1 9b3a3a82f1d1f2b63749d84e576689792d93d5a5
SHA512 d9ae97547dd86065ffe181bb00611f4c16c69851abec1c1ce2f41b0006d171b6d8fc7ddf01d5e3f30220db29e084ee2c285fa8454ff9b993d28f88525ae16c9c
SSDEEP 12288:AuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:AunQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1A15523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d81e58afece0c9b4fb162508fb6e17e13615295ac674104c1b241ff7654b6480
MD5 4be541e06af6c483b1343a2e9c4c8551
SHA1 867ebb35b0f9c98502ea529cc40f06f10dde8051
SHA512 a27eeab7b01d6c65bd9356349aa8ba890684947cf00fe4d2979621acc883d834d6d08721436031fa229fe126332eccecba2c59ff80b23d3ce953974dbe9e3a44
SSDEEP 12288:wJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:wZnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1B25523697925F98BFB1706F54C828182973B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7fef80988c7a777c8c3053e7a46b8ccec88f6a253811b15dafd2a11210f42f5b
MD5 0a3b349b04346fd8a8e2be6cbddc883c
SHA1 78ae308c96e36cbb2a998eed3ac53c56d52e688a
SHA512 014d6736145f63ec70e29649fe8946100dfa373d962a5e1892799832dd2e9bc170b7a36ba36684380d9f6ffd15ee79e7ce4923049f8959788f55db83568e3cfd
SSDEEP 12288:Y2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:YWnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1845523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481119967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c3ed6803d49644ca6b6ce3cec9f0cc3ecf681d38d52b93d878c81583bdbc1aff
MD5 047130cabae370d22650ebf60abceaf4
SHA1 06bf51fd84e8f6ae4f1eb827172f6dea6b4ab932
SHA512 91d8ec5ea294afab700fed1806e5ba8f26ae17c78e7d14997793290084f2c314808046459787eb8787c6a3d86340e1e9e7285745b0370845d601c76536f44792
SSDEEP 12288:acGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:acnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1955523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 88ae9a05707f54b1fa018e4711da8f1d865f8485c632ccf0a4e9ae36e38b85eb
MD5 b1e69f55633ca0260e81cbf935842cd3
SHA1 b11c5eff1a05fda94e65a56968ad1b3bcdf8e2be
SHA512 56d69e36fc529b8ba5f24f24abf12a76f2c08e3d4e610019a5eea489fe5430a0e1867a80ca77df2b8a4a559660cfd64a3b82aa4a4e4d754e99a7b038b6ea05d2
SSDEEP 12288:3BGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:3RnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1B15523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 b953f0753d9db08a0e47b0670b1a31351a1bd34ef81b54d476d35e3244c13787
MD5 2de0607788fd9ce8712e0593256c6157
SHA1 23eca3d1926652e3d4214f8d7d996aee194f4c1c
SHA512 376b59ccfd9b6f24ebe1df98759c8feed6b75f963b229c357004fdea797495d5e4d0ee0a204245aa573dced363ee848b8c36d7c312b9fdcaa630b70dd6f2c5ba
SSDEEP 12288:tcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:tcnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1AF5523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 78586cc020d34c4ac7b0491b7527f7e339ba89053262961511ecc67990de63b4
MD5 516a36047db2d8e9f0df0cda46fbc9a2
SHA1 1c0709bde769d3e0552041c8a817e872febee7c2
SHA512 b124835e9f4fcc372e77af0dfab13ddc9612a1d3059eb430fd0defc253d0847e535739aa59e8730a5563210011f2a78b4ce4cd725c78b4693daf7d2de1efba3f
SSDEEP 24576:3fwv/k9RX6wkyAIKnQ/tbw/2Mkjy6Fr7g0o6:mMnYIKQ/lFTjN4
TLSH
T12885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eec19f0fbc0252bdcd359115acd00d3723131e81039ba2816e6bd0977fca6852
MD5 39894e3323e7f9a469096eb363ec783f
SHA1 e37e3997fb72a4d133c069acc0ca7ae71b393b15
SHA512 f7e70e53f145973b9bb618521030f49a1e396a3cc9922f690dae64423d9a58f5509f33aa2d784e4c5632c2bef66226012c10b06b19ee789d2d4ca235d1232ac6
SSDEEP 49152:tYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FQ/lFTjN4:tySzPSLm
TLSH
T1E0066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fe0f1a07ac90784c9180c4b18bd8347e3dba6a400498a27f2c79a94fbdddace9
MD5 a6a9603b5d1d986c7daa754fe215d2f4
SHA1 eb0dc6f4981bd4e56f86f2a21e46071c4c5791af
SHA512 5db5db44c877aaab143aed28920fb7a8b7bb3ac3a936321dbc72669a1c18bef2a931fa6d3844a145d41adb9803c437b4300a6ac11073828192e3339f2e74afa6
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYfnQ/tbw/2Mkjy6Fr7g0ol:o47JUQj1irIhCnDHUPfF/1Q/lFTjN4
TLSH
T14865AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a74fbbc7cd82f3fe86c4d4139d095d0da13ce1a7db7f50a54872c7cc5288cca5
MD5 631f1ce50ea560d66331a57c36509f48
SHA1 aef994273f53aa19e7e3862ab227be2744fc66b1
SHA512 12b6f195d4996a572c8118e5b6b22fe411f0f788abbb07472078b763048f5d5d125daf200e9398b9b4c23673f5a643d21dcf2d7feadb7b30955e2441607891d3
SSDEEP 12288:issf+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:U+nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T18865F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b199913ff5e3921de69f85ab9720d11c95d0331920899dacff458b789011ce14
MD5 d0f5efbc9ba0f7ff8dd90995be2a0e00
SHA1 883f6c13c9eb6953fe80f5a5cb001645233ac231
SHA512 cb40f8cdb2cb7a7d294bc1b45bb4dbf64ba69eccca9a80e8271ad052ee298028418f0f44f2d7c6f0bed7db8a81e08acecdd2ee9be8ce574a6c0073310b76273a
SSDEEP 12288:AZpIEYU3fTS3Mw2RAv68xL0j9TXNkziO2b1uaRhJN7Bjbced0tH:AXI5UPYf0j92iDb1uaRhv7Bjbce+tH
TLSH
T106451701B626D78FC66940325E76D6CCAB707C41EE44AF0373C9873F9476658BAB6382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 baa4ea1d5dd05f178acc7d72234d1de68e690a9028ee10642a21070d21875d5e
MD5 cbde9a261b48887a5aad8db78bb63b90
SHA1 e1db666a28b849c41ea4b36455bb9cfea1121602
SHA512 eba4e401f4f9ff1b648318edb61551dbe7a42025e880c60e805b84df004d3ea04c44abe77711d707d87151b07d56c24fbc6f776f40f8e23b575590285422de8b
SSDEEP 12288:aSuB5aRRTYvKXQDnjTnTSp4N15BZ2V2o2nmMOA/iiPRTaDD+Boy:aj3QNMRN+UODy2y
TLSH
T125651900D5B7E34FC96D90375232C6CDAB785C06BB453F05738889389866B6EB6E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 adfd0de608300532988d67697ab08daaff5d6d17c7e641d9e0073da85c176bd1
MD5 6bb7b1c0e4d66b8ab5ccdcedfb821a86
SHA1 2a45d724b2a87236f7693f0d48899d7aa52873cb
SHA512 507482fcd386e945104dd1b4fe25244dad2cf18c3a24150ea1c442bafd4ba01ff7a615460081ec15d3b0b7edf2643be0b4dc875188b36eceea61a202da3b4b23
SSDEEP 12288:167GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:8mnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1EE5523756668F94BFA3B06B448828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fb7c3fd7fd6bcb1a5ed40e784357f173a5568fd0224332060e048395e9944948
MD5 e1c22e8fadc8a9917bfa80808180e293
SHA1 d570e5ba33a68dd3709c6440be1ca8b3e04e0973
SHA512 be0c8ae5ead78942605cef3693d6debcda905bb4e0bae7efca9a2c9997a57a1ec7fe030bd2b2fbc7e854c34841225308f359bde1c749544313e2bb0d7d685adf
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYonQ/tbw/2Mkjy6Fr7g0oQ:lgb4mBIBhGFfQ/lFTjN4
TLSH
T13865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7e907aedba40c77ddbed348b898b157fe374625e4e0eee2e978e5b9278baa004
MD5 e91724f1089db2ef51b3b14cc5dda2f7
SHA1 67f0ecdc825a587a2a601cdbe1d4e2bcbba70738
SHA512 98a1b821814c946332dc48a0ec8ad5ab5ffc82118b70c6794033a75a36a267a7454a397f90e52bdbd9a7454add5a1b5b944aee32e8d3d92bde651ea1f8624cee
SSDEEP 24576:9G88u8FpJqH1Qzria7/mvnQ/tbw/2Mkjy6Fr7g0oJ:Q7ZFPqVva7/QQ/lFTjN4
TLSH
T16785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f00d156bf977bd67a5b3833fa15f564d230dac0c755d2ff4fe274d615e914529
MD5 d748de1e5bcc19e627300d3c2cd5deef
SHA1 fbca7f71712685d66ad2c01114f979c8bf7ad249
SHA512 7f5cdf5cb7104c546f0f8867f60f12bb32a019afc7e9ad7d6cb7e8bde35db4f3abc0e889a5037a5eaef1f2c3746bcfd01c82653e1e7eb81b5bbb541daae95e20
SSDEEP 12288:CHvUrBFrEjwaQDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:CPUr+NQznQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1C065E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8a19e9426a0fa051adc9bfb6e3f5fb6fe3ef1a4d84504e2f04c5db19c8b0ecfa
MD5 4d5cda5fcaf49bcc5fe2409c1a7749b7
SHA1 5fb4e9fce4e94d41ae66a1c95c3b58eb82913ad6
SHA512 7ba13720d8d87b2b3f294a92cf5498e880a33bf693d372a2addc610cdc0ed2d19ad7d0a5602f79b31d306b6ebac3a6bfccc89b2c795a6d0d86b8e8f0e22af39e
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDQ/lFTjN4:HG05lO43b9Lm
TLSH
T1CAD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 474f4cd2836986404401d455cefab34235c46d76570452f6f08850f9cd77e455
MD5 ffbc6ffde92f6c3e1d97b544f50df276
SHA1 8cd3e4b927a6e3a0374881fb07255da6a013b36e
SHA512 2fe1b83898d970e177d0a7c157c3105474fa1fdb821e5b96e95fb9afb4eb99c659fa008b1306d71824b4994fa6c92a4f3828727142d264b75cd0e6fce884475a
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFnQ/tbw/2Mkjy6Fr7g0o+:Qa5POZ3+Jt2pasx2+mbQ/lFTjN4
TLSH
T1C165AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8f812e00a2ac71a739cd65c1aab2abddad47cd48f144e567a0d5d320b2995d8a
MD5 c2adc5596f9a0b1439f6b41250b463a9
SHA1 7758e24a2ca9e9a02e3bc0a3a77111c8336ece1a
SHA512 af1d553ddfdfee4bd47fb9ab236806534e91a1102c070fb4bdedea5610ddc66a66118b78f858d6ec5e39e271f0f85d3bbd26dd9e65f8a70549ee30ea6b88c435
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FknnQ/tbw/2Mkjy6Fr7g0oY:SNc/zEOVHFwQ/lFTjN4
TLSH
T110858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4c4af1067b4348516f83f5f685cc74ba69a2fb24eb15088e75d4a00a655cd3d8
MD5 05c61a10a51b653dbeb07c877abe131d
SHA1 61e94d51d5f49b0c4482f77a23ab093fb57e92bf
SHA512 3e0212cacb2e80a6d3cfc871a1485f83daf8434265a5caf7889078fb42e5b7b669e0dce83066801976c131647a2511a1a5946de533d66d0512dfc9a0571de452
SSDEEP 24576:08kNvNnaFeYhJNtmZBmRnQ/tbw/2Mkjy6Fr7g0oc:08MwBtOmRQ/lFTjN4
TLSH
T17C55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 414cb1cff5a0e8be59864b566904750bf2ab412426b4427b44fe6ced7af7861b
MD5 e4b1d4a27d97df5400af18bd11da50f5
SHA1 7a2df14cd6c71285b1ec674e0d0d232368e3b9e6
SHA512 9cfd56f68075849c57359da69730fa31edd4270f34c60d278f0df3174021cc11af90cc38466ade94d2a79a37d3cf551968e6ff0a9ac23f465024f35e5faf827b
SSDEEP 24576:ID3FHshBIYQgAinQ/tbw/2Mkjy6Fr7g0ox:IDVHeBIAAiQ/lFTjN4
TLSH
T17375E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/796-107-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/796-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/796-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/796-366-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1492-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1492-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1492-126-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1492-132-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1492-137-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1768-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1768-121-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1768-370-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1768-115-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2556-73-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2556-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2556-67-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2556-297-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2624-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2624-384-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2624-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2624-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2624-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2624-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2664-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2664-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2664-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2664-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2664-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2944-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2944-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2944-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2944-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2996-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2996-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2996-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2996-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3268-280-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3268-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3268-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3268-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4060-411-0x0000023EB08C0000-0x0000023EB0F40000-memory.dmp

Download

memory/4060-410-0x0000023EB06F0000-0x0000023EB08BA000-memory.dmp

Download

memory/4060-373-0x0000023EB08C0000-0x0000023EB0F40000-memory.dmp

Download

memory/4060-372-0x0000023EB06F0000-0x0000023EB08BA000-memory.dmp

Download

memory/4112-78-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/4112-83-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/4112-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4112-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4824-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4824-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4824-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4824-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4840-310-0x0000000002210000-0x0000000002270000-memory.dmp

Download

memory/4840-315-0x0000000140000000-0x0000000140443000-memory.dmp

Download

memory/4840-9-0x0000000002210000-0x0000000002270000-memory.dmp

Download

memory/4840-0-0x0000000140000000-0x0000000140443000-memory.dmp

Download

memory/4840-87-0x0000000140000000-0x0000000140443000-memory.dmp

Download

memory/4840-1-0x0000000002210000-0x0000000002270000-memory.dmp

Download

memory/4840-7-0x0000000002210000-0x0000000002270000-memory.dmp

Download