84f02441220c394e12a739798c30dcfe81dc2709b7a81779e7c219335da82847

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
Size 1.3MB
Sample260713-2kqhssh13l
SHA256 84f02441220c394e12a739798c30dcfe81dc2709b7a81779e7c219335da82847
MD5 45f51177a6307c1b8d83c76cfe0f9b0c
SHA1 2049fd4c415153191848bd282c99d165e87a5085
SHA512 349eccb348ff068828936f0bf3c50f7b3aebd27cb90453875584f367f40a67d4a5d143a5aa79886b533d69e483ee3a516b98f62a0de46769355008b7cc4d7ba7
SSDEEP 24576:vR6X7yy8BoMXFtZnQ/tbw/2Mkjy6Fr7g0o:vYGhB1PZQ/lFTjN4
TLSH
T10655C012A64A90ACD95DC07597478632B93278CE17306AFF23E46B353D6AED22F3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4512	elevation_service.exe
1596	elevation_service.exe
5460	maintenanceservice.exe
4236	OSE.EXE
5664	PerceptionSimulationService.exe
3744	perfhost.exe
5148	ReFsDedupSvc.exe
4680	SensorDataService.exe
1128	ssh-agent.exe
2484	AgentService.exe
3968	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ea954ad3e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000128435681813dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ecd79671813dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052cc7e681813dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064f2c4671813dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000faea9e681813dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000426fd4a81813dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034ec63691813dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	2484	AgentService.exe
Token: 33	3968	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3968	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3968	SearchIndexer.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1840	2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
Token: SeDebugPrivilege	4512	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 5564	3968	SearchIndexer.exe	100
PID 3968 wrote to memory of 5256	3968	SearchIndexer.exe	101
PID 3968 wrote to memory of 5760	3968	SearchIndexer.exe	102
PID 3968 wrote to memory of 5332	3968	SearchIndexer.exe	103
PID 3968 wrote to memory of 5348	3968	SearchIndexer.exe	105
PID 3968 wrote to memory of 3356	3968	SearchIndexer.exe	106
PID 3968 wrote to memory of 4964	3968	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_45f51177a6307c1b8d83c76cfe0f9b0c_akira_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1596

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5460

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5664

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3744

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cd8aa2dce903ee4747208624942c40f8eba0a31b63e607b43fe075f5d5c463d6
MD5 c90a2c819dcc0145d1056eb06626675c
SHA1 b3848e1027e57b46ebe60c262ac40e1a1f5207f5
SHA512 de522afb1d8c409936d0c2f5d0f1112d6bfb5d775bda7bed52ae8ff54c8333f112c74055ee549e5b524302cf632d688a13d928187fb3d2d9835a98e319a5466b
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRQ/lFTjN4:e3q6HjBxLm
TLSH
T1AED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 fdd4f46dccaed5f92a8da804d7eb1262cc7f4419624ae74a79dee754a7ea3a33
MD5 5ca7c76eaaad973e8c90b3996d68944d
SHA1 944c8da7e1b7a364d19b82b1621bfeddc6169969
SHA512 0d2e33c8c5a876c901ba82b55063e16fed79b169fdf5e5fa734862118ecb363bbd8a9d287575ffbd3f0929d7b26dc5391f8b40ad6cae8e0bf558aed698376090
SSDEEP 12288:D1XLsswWkxy2lRq2czACGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ZXYfDtczACnQ/tbw/2Mkjy6Fr7g0o
TLSH
T13D75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 77d4b6017aea6a0d3fa329697dd28cd85310827d7289de8591004d836e6027b4
MD5 09263e97848be6165d0c6258fe1c84d3
SHA1 46189181a949d24f1f487778f31f8ee50f68fcc4
SHA512 ad60935af1309a724ecee13331bb16e2401e600484481aa6cfd1523367ae2302f9b526a54022f5d8d77be067586dfe878b7f914fa5b4b1e1287e8ea4d533e86d
SSDEEP 24576:u0Le5ji0hmxmrMZnQ/tbw/2Mkjy6Fr7g0o:uPji0AoIQ/lFTjN4
TLSH
T11B959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0affd306da65d80bdd8cb2de83399a69c8ac45eb48cecf6e023a52900f583eb3
MD5 056ef2e681fda59bd9d63efd191fc4b8
SHA1 c8c77b73d7060bb437abfc7a31e05de2981ad3a1
SHA512 72b5d69193529575b7f6c30bba2e3d3a251ad6ddea9eed76ba5685f2389e076844e7378c92dc5374126cbf44f16700b1271c17b6c98017fb82385c0e9abc105b
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyubnQ/tbw/2Mkjy6Fr7g0o:R/ezSC6vUzPvxHjyEQ/lFTjN4
TLSH
T168755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 71beafedc364ee78bece0948245da34e5f6c4914b6b43faa29389b2d0ff8f6ad
MD5 4fef10d87bb9c94e25ede1abf65d8b7f
SHA1 511d9c1a7796930fd660c6f267399e1bd250c53d
SHA512 168889009de5df0bfc9d50006600b861dd4faeb8627446adbde4399ab1bb5fcee3cf8bd61c60382453b97d8d48b614b327c5ed378f65ea3c02195969c636059b
SSDEEP 24576:UVbqPb88hv/l+6WnQ/tbw/2Mkjy6Fr7g0o:UVO88hXl+FQ/lFTjN4
TLSH
T1E1559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 e71cc835c872654bfa1a4a753b2498d0c3d9f33f9a4cbedb1a3fd420e0eab526
MD5 11ddb47ef661050589955a3e2d3f0763
SHA1 bbee49c35ccb8092779f9883b0bfd538dd780d3d
SHA512 54485516cb2c808b7560bc67d039e01075a23f765e5c140b5f48d98655b8d7b8105f42acf946a513e78eecc4504bce0c48355575078c1fca060e4f996d4352ca
SSDEEP 12288:/99GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/9dnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C25523696A24F887FB2B06F15CC385826B7B0DC1AFD0A74E6B44322DC57C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 303d0f22f2d92f283ca255f50e4c9992d73f98203cf2e8b469139eeb2040def5
MD5 43f02b1646555a97f723f6a6d51584e5
SHA1 ee9bcae7cdee6c75979192e85153547db16b82ce
SHA512 bc1e899514f3b44d1fb68c69ba6cc12e166f330a535879983006944d28883101f14763e02fd8c29d42e931d506a6f9ebd9fdb7c35e39f51ddf4e0cdd27d30ed5
SSDEEP 12288:AeBNUbTVO86UeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:AJIUenQ/tbw/2Mkjy6Fr7g0o
TLSH
T17875CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dc65aacca66888ba60de3c265105ce63aebf2ee948e7a465084bfd04741d3a15
MD5 4eaaefb2121882fd5a8cd254a7d87722
SHA1 cf58b59c1370b9dd81fd2251786e0d5d0e9fe74b
SHA512 d4b725b4421a7030f058c297ae6819783c4a5c4c0bb8ffbaa1cbb115b9d4200df618cbf9b768b3bb9f3c2378edd452666d7b000d576f881f2c58a23e5851751c
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:bQvGAdlCEL8c/yRNw5CALm
TLSH
T1DA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e248082603528626e9803c68f0fc042072d7a36d907a3094184d89c01dccc98d
MD5 a693c1318157af0b51525bb266c0da8b
SHA1 a0fcb2903531c44cd28d1ac2b37505ab7c64f299
SHA512 a7e773a5485713720aa5767e9effa8e8e6ae28481a54786d8c05554f230d375c05a0159f7519e421d59294a1e02c7a892eb2e6edf10704c7da9f6681861e0552
SSDEEP 12288:rAwSfxL/2Dc3kDLLmt0LDQewsAj4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:U5ewsAj4nQ/tbw/2Mkjy6Fr7g0o
TLSH
T13E85E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5d7fa26f2964a6a4bb002221a516e03ccdc22380f0cf00a9834fc49576b091da
MD5 8b1f0a6d957f1cc44437733a6e22e18b
SHA1 3d743fe62aecfd1c96814974fc24ba9e5120f98b
SHA512 3abeb37357e68de37ef4a17a3de8c6edbadc0a7806fa5b6dfdc7f1a689563e217b9a8daf78a2047b260c24213b072b210988dada59600f47afd6ca89fcb30de2
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHjL:AUEtQevvqc2W1cpV2EI32
TLSH
T11D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dbda21f166ad400d83aa87785ba545da4fbc016cde4f5d7c07ff88ce2f5a3e1d
MD5 8e4fbf711199b0ae737eded2a32aa78c
SHA1 bf8bf77a5b404b7ab4ae98dff92448020de3922c
SHA512 925e6a55f940d91174660ca64d49f8ccabc2e285c1d894c26fcdea17afa4c7c178a8270692871a715dcc8936a9b3bb921c05d5b872b50f5eeaf3cc975a6c0425
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zYQ/lFTjN4:coqtVjnmsLm
TLSH
T161D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3bca6568437b5981e050b204e775a2272b01862173c2efe61da7c9c613cbd479
MD5 c91929c73f560a72f489c494996292f8
SHA1 ea7fcfb6fe2ec669c8dc22da0db45dbb1110ba2a
SHA512 17e3f005b491e5bfbac521654c3832654fd5866ace63587264441abd4cec8574fe03afa845106da93282bf3a4505fc7513a860f91357d06b76660e738f3a63c6
SSDEEP 24576:WAhGLJIFoiwtA5l7S53nnQ/tbw/2Mkjy6Fr7g0o:WAMyFoiq53Q/lFTjN4
TLSH
T1A035AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 717c2fcc67e9eacd88e1214303bea99070ca0ba452fb9afe883daa29ff4afba5
MD5 f58380c658b383e27224cb2b17fdfbc1
SHA1 14296b8308762f6cccef9eb4e5acaac62dc5892b
SHA512 aacaa056ee2d4fbd97a24187f2426b3838190bf2d9608f4630fc4f182a24a150fd84c9a19b31b88806a3a18acc2cedbe9fc8b621d60c5bd88f2f5dbc17fd8087
SSDEEP 12288:8mw5HEjsChNZBFgl0WDm+CLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5wu0OWknQ/tbw/2Mkjy6Fr7g0o
TLSH
T10075F14936A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 3404f9df52d2cd8f7df4690843f3a0bdfd7da92b8b25d2fcc48142e2c6be8993
MD5 99f9bbc71317bc3f40dac53d7f9def54
SHA1 d5d6c51a9637f09eb092b4d0698a30d3a9d1a2fc
SHA512 448d904d033551cd1eee6edd831c1cfda661dd6a362f9a6508eb9fdb7ae1e4dc67188b792b008b03fed86b928f51084cd5d424210e0363a75396f3832e9fd40a
SSDEEP 12288:R1Z1IyoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:rZuBnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18965126933A470FAE6674278CCE28646E77338826BB193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d3e752c9ec18641c199810a3282b573cee7e51d01f58d77c561da2f42a350e0e
MD5 b077d25a646f749522d7d4a8bf61508a
SHA1 f618047288fee37b4cbf6829a46c710a930e4645
SHA512 091f21f05139f1b9d54e8682bb4c566c6e7d0614b133fc955d880f839aba71f6919f49f530efc996b9f9b8bccadc82a1fc042080e030a8f447a85bd5c28e153e
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:1QRQyi36YOcPQLvw2gAf+PN3lLm
TLSH
T1D5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6ccabb6251847556e90a99e93878d857799e35710144157c8ea7398865d6d044
MD5 a0935f7449e7938bf15e182072a55372
SHA1 b400c07d87ac08d11ab199da33ff6f5c975df880
SHA512 aceb68f5fdd68b934a1df3709e17036f69c0801fa00d8d59e475bd4690bcfed7d89902da056d2b0f3cca17ea4e50437caf70a96821699313609a85bb5942b88f
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:gQRQyi36YOcPQLvw2gAf+PN3lLm
TLSH
T175667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f2bf55eb9250ce463a23ca87e96cbfd7a25b44cdfd07f871f5f3a067a01a5b63
MD5 a041c2f4fb849139f089a18fd4e971fc
SHA1 2f1f49fc8907dfd77a15142a96205ae42859951b
SHA512 94c5d092a352f26314f0be7e632198b38790704f28afec91fd58ef4ebbb78a43c0a919fc5e1db7dec62969bf1a9c930bb3435b9ecaf8fbafa1dd330831e9cf83
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0RnQ/tbw/2Mkjy6C:k68Qg55nhheWu7PNU3/IQ/lFTjN4
TLSH
T152B55A33B2F600A9D44DE1769F46872196D27C758FE0E3DB8501721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bc9d70b0ebaf613c36270ce173c8778c351f6fa8e65f88d5b062f0f3a1d97dc0
MD5 4c31d802686b0778eab910a15db2b325
SHA1 33f06764270e8526378dfe741f9e34a7f7eb7676
SHA512 ec43e8b508a758facd8ae61fd4188009c27f383c31cadd164832f9d72bd259ba837b2141ca97bfa06b5ed366d5f1cec245c592d6ca7e1d26793404abb131c959
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99e:qy5112gYy5azzVvL69nLKnhZSLm
TLSH
T1FF167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c7ae7b410d6fc603e75fcbd7da9bb74ab1d70e25225348c4d757758c7596cb8
MD5 5c4dd6d32448a96333eee22a374d7c7a
SHA1 88a27b3aeb54a271a68c88c205924680200391b7
SHA512 b3f8a04739329796c1e71de8f572693b31c15065d73d5235d2d840d6bd3a3b6a13e343a7641ca450b0e4a377c239c5340651f755ca9aec5f44953bea0962e7fd
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glSQ/lFTjN4:Uu6JmVxd2ddLm
TLSH
T155D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0a4c15ec61f44ff119ca4cd909fb28eb486a2728d2cdb2ffecc879008711558d
MD5 9b79388ac795f468c352418a87809b2f
SHA1 21449ec2117d7d1f3ba9653fbffa99729c47930e
SHA512 7fd8a6828d224b5284228ff7af84796c4241a8d1e486434c9c1c9c94e85902a5918950523d517061852fcc78f778268b7de1b61e834b6d9a792c6305dba8a034
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4x+Q/lFTjN4:FmifPbRsLm
TLSH
T186B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 025e2280b6ac5c2208c453a0d62e7167d67343b4070567e4af5c7a9f71c0234f
MD5 6e75f051083a3c823a6a9c3a9f741434
SHA1 a640d690550b17b86c11ba98f75db098dc642a91
SHA512 598775fe5afebe42827462ac9cc46f506322b499f3a04ed48008fd0d569fe2742ce9a8dc29c7a23bc4aa0b1591d7e2264a3601e05cd0b4c0f3b5b91632887d67
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqBQ/lFTjN4:/5dKTi61mLm
TLSH
T110C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c7415633311418f44c37eb63166c3df4d12c59de79063cba9a5fef268e42d812
MD5 a45b3f17c29951a16194b501acda1f1f
SHA1 416f9075c62a1788a2f446fa9f159f889cb3b6f7
SHA512 a507e646f2b633c3abdc18bc780ae56364508e33a5b7b22d3a19132188d0ae4efd2994617ab20c0d3c31bfadfd7a95f446d08885ea06cc6df7bda5cd6498411e
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wCQ/lFTjN4:cX2iyphoLm
TLSH
T15295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 7c8970d6a50f587ab50921e82a6505db33da73a34eecd0af0fa740f790a48923
MD5 4234e1ce0cffdad94d17676ac9f412f3
SHA1 adcf5fb6691cf6d515b70015a3ffe59d5170cfb3
SHA512 16a55c7094b11ccf04753bf4170fe137d23373a66118263efe542068d355b5d2378e34d640e97153a787104455f1656f91c80e1a29afe40c6e817376711c0a14
SSDEEP 12288:SlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:SFnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FA5523686965F98BFA1706F188838182AB7F0DC6BFD1A38E77482129967D39405CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 9bb745579d7e1615faf8f1cc00304fd44e93e3d9573d9096be13310852eedf4f
MD5 9455be550f1f25e80d3cc7ae5875a5c4
SHA1 455a690fa452dd3925b13b018ca70627a9656a52
SHA512 0538bfcb986fb9dedf0b855b2774c6c393f1aa90c380c91235b42f332c1ad18859b38d4d895a8ecf969251782c2eebc7724ce6052f96b02106b0bfcfb1a401bd
SSDEEP 12288:vcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:vcnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B15523687964F98BFA1706F188838182AB7F0DC6BFD1938E7B482129967D39405CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 5128ec4ae63765f4db492d5e79309516c06c276034c4b7f47a5972a9128f00a5
MD5 83db93acabf84a8ad49fc882215f887d
SHA1 c7a055d6b11d4b39064a50af4c756fb0d080f846
SHA512 2a605dccb0c1ac520c03917a3bc9211ddbee587f219868aa37256bcfd3ce4cedf4e4efc6eaa1eeebcfc0d47c030ad1c4148b858e16810f3aa928e4a7e53fdce4
SSDEEP 12288:yGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ymnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B35523686555F98BFA1706F188838182AB7F0DC6BFD1A38E7B482129D67D39405CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 69733f5074659a603a498ce1476d51cebf03cbda3a38907e1586c0efbc8b9a21
MD5 0f330b54ad47dd78ecbedfef38354051
SHA1 645fa8e6715eb05fe2a263096a5a1aeb485f348d
SHA512 3381cbe607b08dda562aac525cd236eb01f051ac4d8cf8d3cc7c08ca3187d89421b0cf0deb05ea09a64703f34b878fd7215c70d3321b1c8a78c60cc487ce29f4
SSDEEP 12288:bVnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:BnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1815523693669B4C7F92742B4CC938142F7BB3DC5BBB1A3CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 c8f3f3a3126a34ce64e9120602f971a698b138d2b57f004219b677cd204d5e40
MD5 fd8c7d32fe7dc69fa5d7561e5c12f6de
SHA1 47c0f125ee65483541e1d13c01a7770778f04bed
SHA512 343dc8e61a06a4ee4eaf2600ccb9b6571d564ff436f94bf0c7a63ee1f00e59689c3248d79527b49e5036da8fe85d86ec584492bb06d05be6aee5b8129d8221b2
SSDEEP 12288:DfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:D/nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F05523687955F98BFA1706F188838182AB7F0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 dd3f8595159d337be5fc797689bb15aabe880286566e1230e714bb08af8ee860
MD5 d0568d404191665f095425525c212a3c
SHA1 3038300475851967d6cd17af3c2a621c6e33220b
SHA512 ded44b0b8115a7ba7fc54197d5f549d38fa90c9cc00afb8a7e725bf467570c3e4ff2951d86911e01331b3dd773aa74b84bb3580fa54215fcd272cae68ba02c63
SSDEEP 12288:qgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:qAnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1235523687954F98BFA1706F18C838182AB7B0DC6BFD1A38E77482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 63be86dc90164f4ee3779280c7943814dc2a1cbb46c1854e08dee356ad4c2f2f
MD5 18cd4699839fe7af7fb365bb8fbf8d40
SHA1 0d39b3a33a89e9f7382070cc01ed51c0219be827
SHA512 fffb8dddb32035b862858792934fc7af7dcf2d6b7751e7a25dc09b8916c9ea56b68d84ac6f2aed366ea30185245cbec349bdc78fc133e4b41f808c51318ae6a2
SSDEEP 12288:pUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:p0nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E25523786914F98BFA2706F188838182AB7F0DC6BFD1A38E7B481129967D39415CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b3ea749c9c5731b88f634946414de13f978b874a1899a67ad68973a2a2bb8038
MD5 a9093ec994ee7ef54e116f38a10689e8
SHA1 68a0bd0ef7fc050e65d664783c9b978001361d6a
SHA512 115b235a195b30d1eb380e6db0a772bc701a952d7d941e0e35c5f9dfd279f57fb9665bae7a5dcf5aad40df2e3beb87a31ecb1736c9201c95858a1ba785d8b210
SSDEEP 12288:PiZwb2zzFEoS2cPvy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:qZM2zFVSO8nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B07501A4B35058F9EC67827ECC528906D6B27C5A1BB0C75F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 793274109ff46b9e8532bed2b56853ee149e50889eeaef24346bea53e598b9a0
MD5 7448b258da9b3a5e85ed3717ab5f640f
SHA1 0aa10daf871f46dcd6d0bf04671f0044880b26a0
SHA512 688ae64e96f6062d00044e20573d980a9eec77dbd3407b3e9d82d642689f185513bbbcaadda5d8dec39f31b0c75581f76d355c5a828d886704cde240ab0149f0
SSDEEP 12288:RhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:RxnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1035523687565F98BFA1706F188838182AB7F0DC6BFD1A38E7B481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 f6f471f089a06272a16b6e0f37518d28d0ab568ab4424315a4621f7593ecf5eb
MD5 3c58021dedc8240e2d9642e9d045481d
SHA1 f5a8da0ffe96c06c88844ee44c3cffce799c3376
SHA512 e44e5e41628fa512773d3a14cd2fa7b6b94b03696b7a1b389a740716b9104a4fdbf15a441dcd60ada681bd475df4b86a64f5ab738567124a0cb9b36f32de2d53
SSDEEP 12288:+tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+NnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1335523687564F98BFA1706F188838182AB7F0EC6BFD1A38E7B481129967D39415CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 ee6bce5f8bca6830b310b6358ce062ac7c44f2aad34a4933862d62b48f56210f
MD5 7148f501df8794211918433790554044
SHA1 91e085e3d913578990f26d6b39fedae0a0864fdc
SHA512 16173ff62780c1107ecf314ac2f06206cb07990d0913930bfbdab77a0cfd7fc3b1eacd1469de5369550684aa32511e4081d420a684560e9335d86cc61e2e375e
SSDEEP 12288:xyPz5L8oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:gzyonQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CC65021772A530FAE537427888920A02F77678725B609B9F2754037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 7b7dfa41c17991f3dfd0983101c938df991125faf33ed724d4048f6ff979e704
MD5 357717bfbe2c93338f701d4a22c157e4
SHA1 fed33c5673e9ab0a586f73883eef2d1cf6efe257
SHA512 195e949a8351b02df7702d819e11639d2ceefa1f9c1b3f1819e6d17e8693f1bdb4322502f7d2f519e761baa4c9c03fdb712636cac5c4ad3a95afa71bc6c2949c
SSDEEP 12288:JhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:JxnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1AA5523686555F98BFA1706F188838182AB7E0DC6BFD1A38E7B482129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 938ab7408d89201c46b0f3ab2f44f52496db4dc961b9f34fe87839257e65edcf
MD5 ff940050fee8eeeacfeb8b3e5606f361
SHA1 ff520303a6b77bb72038f873c9e67178c4386086
SHA512 1476da982a3a171c403412e8672aeaf59c78dcfdad32d927cf0f009647cf91245982354364b926b7bf0bf71eb4677574a56e03d168119b771b5ce952a34c76ef
SSDEEP 12288:MhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:MxnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1175523687565F98BFA1706F188838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1709e21fb8070b0bd1ea5089e1c6ad2bab1750025f191813ea4d0aab0b9e7f19
MD5 09350c16f58bda9ec45892694d68f9dd
SHA1 a9da719136ca6079e90d9d22320bb4c4d600ae7e
SHA512 ebc0bc8123e34c9d97d31a0d3a02927f463d8391001eaf2220044e7d9a3cca39a332af1e0ab4b6b57a551ad67f9d9c899fa9e47f7396de8496f0bb58f82576f1
SSDEEP 12288:GyPz5L8oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7zyonQ/tbw/2Mkjy6Fr7g0o
TLSH
T18765021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 c612935756da269fc0d2aa01bfca75a8f6238750827008c6128a22a4ca7e3a21
MD5 6963449518168ec8615c3ddc921d5dc3
SHA1 2bb3c5cb36704d6170dd81b9344fdf0ba878a255
SHA512 668587c001ccf0c0b845f46a5ebf053a51e521151af19b8e7d686ffaac54a78360bad0ce93cc28c8dded36f8bbc28ab7615952a80a41396f343792291cc06830
SSDEEP 12288:ACd9CWYoaLHF3z0z04PDvhWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ZTDaLl3z0zD2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1357502A4B3505CF9ED67427ECC528906D6B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 749e92bd254e19b94a9a24d242614730b3a0edee761a784238c293c91e51d412
MD5 af8bfa28981f78480abebd76d1892e87
SHA1 b7862a2ef9217a695d11795503ea9242f9703b48
SHA512 2cf906a3639139bddee6481ccdcd4e42be4afd271991d582258a7cd7ec37ea36a64b16aa8d0de70cc147d68fe0f2d38c1cd85fb9d73b8b20ae35e10632e4870f
SSDEEP 24576:F3Hd9CHKy7GZKnQ/tbw/2Mkjy6Fr7g0o:lHd9CHKyawQ/lFTjN4
TLSH
T11A85CF90F3E414E9F1B78A358D724512DAB67C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 29485d72ed1eca66b033f2b406f99f06578e0795d601fafa37a0aa9ea9c06bfb
MD5 058c4c5d4b7bc53b5b0e5ec1391e3506
SHA1 2d4c9ba88cff8d5592bfc44e9730b5715fd8f1d3
SHA512 e214416cf4403d943a762b12d3212509c6c892c2ea2ffa731df0d78e857157624d08200813648e0c69b0844eec795bb42af5f629f9511d1ba071516a1ccbb63c
SSDEEP 12288:wmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:wGnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1705523687555F98BFA1706F188838182AB7F0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 bc4737790a450e80f03945bbe7aae270ea395fdaf2da1996fabc8057837839cb
MD5 71ca68e23f7c2061aa66b106d45408da
SHA1 4b61dcef45b267c7212ba5d4b8337c3725e98811
SHA512 8a4ce8803d96d347020825ee1f5ac69d4bc70178d28227dce97d7e69431e56c03097f7f8dfd52cf8f5884a0b1d0746659cc5afc8e82d40bb817260a0346122f6
SSDEEP 12288:NIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:NInQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D65523787964F99BFA1B06F148838182AB7F0DC6BFD1938E7B481129967D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 27c32d38668979d4c4c9c0082dcaebed877326c133715dcedd6e486da8e384cd
MD5 fa55689c0a8c0dc6e6f589aba7378b9d
SHA1 260c134a668fe763bdcc4890b38858fc7418ed2e
SHA512 f877332cbbe04764b9c9f55031ee11307431aef8f8bf017247283bef95fa5b686d7d7ed725ed9e1faad0209f637bf1672b6c5eb3f8865eb79d39013ff1cb9b55
SSDEEP 12288:1DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:1znQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A95523687565F98BFA1706F188838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 562de8d57e7aff26aa96bb039f91af8c85a46420c070f086aeb4b4faf2d1ef8e
MD5 c767c662ea3d6cc7f11b2af0e922af74
SHA1 b063e422bb5a5a175eb44eb86ce32fdae9301dbc
SHA512 97ff8bf05e06377206699209334a4c712ce4c75cabad7bdec20cf1de2eb74c1f799c5156e4840c79cf9ae166a40dc9c3d99f94f94c7dfb59dfde5c8bc4e0d356
SSDEEP 12288:AhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:AxnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1465523687565F98BFA1706F188838182AB7F0DC6BFD1A38E7B481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 a2b982a691330d5374c2f25901abe09ec1a5fa3e12c729b6f1b73fb223b78569
MD5 fdd9c584dac7987518b9a93c200c7657
SHA1 d1fca87e9f7b56663712f2397d8b063eb0e455f3
SHA512 aab4eae43f8c7a55a30ca2bc34a762d7663d02113240a35d5537bd53ac4445743eca910dbaaa2ca9ab32bce44d1ca02afbb181222c19bc337389a39a4acd3bd7
SSDEEP 12288:WmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:WGnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1475523687515F98BFA1706F188838182AB7F0DC6BFD1A38E7B482129967D39415CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 db17acffdf545c701eb89cb211588a3f127195cd02d31ac0680276ece7fd4b36
MD5 b725ef0d369357fff621816fe503ef5f
SHA1 7651314692a482d0840662e6832ab0c87f1e4892
SHA512 dd5baea9865c3caa34c9a60bc1ec96e1cb745e8a78c38a98923fe539f17a654b64e14fe9ef5393c0e001a0258f79a3056c24dc39bbebd24e52ccab0fb8037111
SSDEEP 12288:+ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+pnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1095523687955F98BFA1706F188838182AB7E0EC6BFD1A38E7B481129D67D39405CF784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 9f887146eb2027e2a75d6d3cbb706aac3369f2975f1044bdf14c830e58e561e3
MD5 5b0e73a3312845c810e6169c779d8868
SHA1 8c9e33aab983875b8503a6a448222e6ed63c3856
SHA512 be8d4ac1104a6dcb68d882b7c5dd3830d0ff49458c246614630c66621bedd56d6371e369681e3ef4289ae71f3cfe71518de51346786cd1649876fd492cd9d001
SSDEEP 12288:ifGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:i/nQ/tbw/2Mkjy6Fr7g0o
TLSH
T12D5523687515F98BFA1706F188838182AB7F0DC6BFD1A38E7B482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3ec7250fe49087d7fbdc003fb3c8179566b4d362844f1ca917be138f974e245e
MD5 564021846767ad3ef69d45cf2e64bc36
SHA1 5fa372c807ddfa9601f6a0024e37c749aa251e48
SHA512 44d8db0f36cf940db03f98120a2e0e592494483176474cc187df30e90444ce2be61ccbe26069299cf4d2c05e978dcd75de5b99c1a2b64c5c07cb33f4025df1d1
SSDEEP 24576:XfwvZk9RX6wkyAI9nQ/tbw/2Mkjy6Fr7g0o:AMnYI9Q/lFTjN4
TLSH
T15085DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b27b755d2c42b35cbede0d3801fbddd79040bde91690a29492273c24ad10dee2
MD5 7ded32f0bc680c3a794710a7da6d9c0c
SHA1 9809dcd2002c9617a9fa672502cdf4d9dca2cd3c
SHA512 ef3d8a101bba55f8e99a5ea039d3c9e1a1a268f83e6dda979cf07d9b5365b90174b8301308f972a371253fd9c8c81b0ab5e0242b7261a77ff29f3eb0f0b95912
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iQ/lFTjN4:MySzPFLm
TLSH
T131066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4ac87e1f6f00fc75af869db2805840beda098c2bb9830b40b828de875e3fbc5d
MD5 c2c7aac5b6879bb20c3512c2e08e3bca
SHA1 2ecdcf623bb6feafc375eaef25e1b119f8287ea3
SHA512 cc851732a7f9fd32e26f7e5a9ba2175568e37c16024d7bc5b3209c32d0dd1575d0354112309b531da332787250ba73aed540ecfe7fc9ab0507df78bdcccebfa4
SSDEEP 24576:c47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYsnQ/tbw/2Mkjy6Fr7g0o:c47JUQj1irIhCnDHUPfF/SQ/lFTjN4
TLSH
T12F65AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9718f4c1361b02f0fedefcce652648b852d1e9deee12004b7bf3a9b7f545c57d
MD5 3cf0f7577296e60648c5844997ecd4d0
SHA1 f18c30e542ea907a2a882909db03bb01c89926d7
SHA512 f80323b0243811b0b3264754768ebefe8350f09671d3cecf1557159ea737b03ed5866da99f7d64f88cb01a89d6ab5204544ed0a3ba6fb41b46aab4db96a278b9
SSDEEP 12288:iRsfxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/BnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18965F119D29852E9D02E52B5CB828641B3373C9597E1D3CB67C0F13E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 06d0a10e247b1892c2e38af18b8f8bc0a5503fb248f4506bfb6163f1b43bad82
MD5 dc301d88bb3fd16998b11a7bf6e34870
SHA1 1b88e0a1ab0e98139c28382ff04aec4c0b55beea
SHA512 2dbee8df84ca2db06937c300390b02314f4d899f6985a8d0874ba739b93fa3c6d5269f47f3e139da13a32e29161e96d25ace7a3b8e49c5c862869243b5e1cae8
SSDEEP 12288:bbwx+oU3fydEXxcktJ4pJZ4HgRRV+IZvgSJ6nZo8JhckR9B:bbWnUPDXvsJfRB5gSMZo8HckR9B
TLSH
T1B2353840766AC75FC6AD40321E37D2CCA7707D41EE04AB0772C8873F9576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 b288cfecf0e6b0d492dd03e81bf228842c70543e7ce55a97cc67e0f50d2c0ea8
MD5 0d394c954a7a8135dd11388374a3d12c
SHA1 76bd93d2e649ac01e20c1eec8e62e793b0d8d77f
SHA512 9172cc102b63cbee1b1bab87bb275446ab6b0550f9af48e3ab395ab8fc8c48c114f7ece96bdfb32a3b50d7aff9ba096a11d22d4a8dfbe1f642f33947b4668aac
SSDEEP 24576:n4Qfhfv8FVXbiYuKitSyeEhu8if6Y5VEE:n4Qfhfv8FVXbiYuKitSyeEhu8if6Y5VP
TLSH
T18755A6815437A38FD5FB6032072A5B4CA7A4EC0677496F26B3C8453ADC26B25A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 144b0a2eab850cb77f21c941dbd370923ba494ef0cd27c64c9b9709cdcdf3bef
MD5 1a46bbd08be4ac4612729a64b0d36f85
SHA1 2388f2b8abf39b558be60ebf15915bd2c15493c1
SHA512 e1a320a5d263cf02848390f6089dce5afdfd1f91b07ee8a2212eb71072f03a41470efcf6782eccc80dced59644929461aae9217e9dbeda02c0812d66051719c3
SSDEEP 12288:Bo7pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:O5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D65522656668F94BFA3B06F058838111773F1EC5AF90D3CBBB082269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2e4c515b6d02353730014690c1e53c9779347349d0f84ce60bbce9ac664ad52a
MD5 da9bfd92eb4e2d0f4fc442ffe89e55d7
SHA1 a8094206a2802af4449b5025bcece463ddcfae31
SHA512 8a7a29cfbe2002ba05661d4b58dd9d467d6b4d0dae7bc3771eae591846773b1d701b0507d8196375d04a94bcfb05be01da289b852a3be74d6c5e57b915c6a8bb
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYbnQ/tbw/2Mkjy6Fr7g0o:6gb4mBIBhGFsQ/lFTjN4
TLSH
T15365AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f8dee85ef29a917b51c2546b9ac3a6596c7d00c2284c9f481a35fcbec7a40f3e
MD5 85f06f021fb194d391e1958dbe5a6b44
SHA1 3d7042c133506e0c4cb546a675bdeddc81d22f4a
SHA512 5af00045ea7adf3c222f4de37c95178942011b88f8b83d937cabb440435ccde0cff2344abb1da1cfc409a5d4b82291d94971280e3018bfea3be9b3f3bfc24d32
SSDEEP 24576:9G88u8FpJqH1Hzria7/m8nQ/tbw/2Mkjy6Fr7g0o:Q7ZFPqVaa7/TQ/lFTjN4
TLSH
T1BF95F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c434892987e79d0b5033f3a310df472611146f25d3dc3bb358a5a7a73b1e8380
MD5 7590e95e1b90699be92eed6f4bf17edf
SHA1 578f33be97c52633cd157a1c0f327791029c1081
SHA512 c887b779395e133440719173f1fa6976c72e3a78d32935795890388dfc8947d6d9bab6243914beef23d9f690dae42d5ab3439fc5ffcf86a23e6647a7a5a2285a
SSDEEP 12288:AHvUrBFrEjwaQQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:APUr+NQwnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DC75E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9e598783ef5cf823bdfa7a442261378e289659fe5b437a4327567cf1d5fcd43a
MD5 eeb8273a12557296d31b3a026b24e27e
SHA1 ac78de3c37806bc1aeaf02b09d4c2097e7fb7094
SHA512 bd96dbe5817fa6219aa7244a4f86875337590db15e559a60bc984c47a6af47a62a870490d0269389e45c31f2df05d30689622151a8b947ee00251dfe2a77efea
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAQ/lFTjN4:WG05lO43baLm
TLSH
T1FAD5BF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8e622fd174c4e3d9f5c660c9d2bfe73cce3bc6a58de0fc20bff80aaec1b007f7
MD5 dba62ac19df9da18e6ddd36dfce69a89
SHA1 7f80a48eb5c4d2ede104fa121b09008be0283bb6
SHA512 f37c3a763eae3fccb6b3084cbcfde53be7dc02bd9004697d24601a13079e2ddcd5fe92ceea0eb1c66778cc14c6eae046fec44b9809d9a183444fe27147b9914d
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidninQ/tbw/2Mkjy6Fr7g0o:ea5POZ3+Jt2pasx2+mIQ/lFTjN4
TLSH
T12A65AE5EA6F801D5E579D17DC583860AF5B1342253329BCB122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 12e6dbc7fa24930c00e77ffeb2139f4710018316e2b3d4a61022e4b90ae56723
MD5 8fdfdd6a44e3822de23a6df8eadf1eb2
SHA1 febbd1d6b9f2277b552a36acbf4cc390d3a16979
SHA512 47469545533c8c2495164bc07136eb058cbd2b32d53272a9f484e4cf01509d10632376b9ebc259cb224dfcc21f56a67a5735419dd2ea97d84e5add7e4fb0a80b
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkEnQ/tbw/2Mkjy6Fr7g0o:7Nc/zEOVHFzQ/lFTjN4
TLSH
T146858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b96644a745ac2cd956e79ff2e8607a03342caf3745f51d70dc8c6ce13a822222
MD5 50a9b0209afdf6decd9864533b91dd0a
SHA1 7bfa914e8481e05f5f4a67aa0c755c46c2f03e49
SHA512 08c1eb110a8c66bac915f3961b66aad6bf6e3e28857d322de01188885dbcfb5d7057afd881ed23ad9ed40f0ea36d19f1923310137c77e014004bcc5dc5e8a119
SSDEEP 24576:X8kNvNnaFeYhJNtmZBmOnQ/tbw/2Mkjy6Fr7g0o:X8MwBtOmOQ/lFTjN4
TLSH
T17555AF2EBAB846E4E1FEC6B4CD238512E6727451173293CB5390C13E4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d4ab07406f544ae37bf47a5b5449bf9bb4d573824f8132aba048c9f76b1bf9c3
MD5 1ad1e00f6b681f3d2a2fb4f698357b6e
SHA1 32fb36d1acc0357e66bd7fd3fd58929847f6a6c5
SHA512 86f2a2508d35851a83f7d97dcc3d620c86efdd17bdbe111f90683547eb317108773c8c34d5ea4bc64daeeaf300342e8be98dd9427102e49adbc38305ab441c92
SSDEEP 24576:TD3FHshBIYQgAlnQ/tbw/2Mkjy6Fr7g0o:TDVHeBIAAlQ/lFTjN4
TLSH
T12E85E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-115-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1128-117-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1128-123-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1128-313-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1596-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1596-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1596-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1596-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1596-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1840-78-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/1840-1-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/1840-8-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/1840-0-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/1840-7-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/2484-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2484-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2484-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2484-128-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2484-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3356-416-0x0000022999290000-0x000002299945A000-memory.dmp

Download

memory/3744-79-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3744-310-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3744-80-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/3744-85-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/3968-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3968-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3968-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3968-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4236-55-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4236-294-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4236-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4236-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4512-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4512-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4512-21-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4512-15-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4512-23-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4680-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4680-102-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4680-109-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4680-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4680-314-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4680-316-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/4680-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5148-90-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5148-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5148-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5148-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5148-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5148-331-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5332-330-0x000001CB71E20000-0x000001CB72068000-memory.dmp

Download

memory/5332-329-0x000001CB71BE0000-0x000001CB71D11000-memory.dmp

Download

memory/5460-39-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/5460-40-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5460-47-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5460-46-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5460-54-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/5460-51-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5664-66-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/5664-309-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/5664-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5664-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download