856f1db726f6fb2b8022cc0fa47950dec93e97fa684bd6a4ea912e0e1dac8feb

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
Size 1.6MB
Sample260715-pl42csct3r
SHA256 856f1db726f6fb2b8022cc0fa47950dec93e97fa684bd6a4ea912e0e1dac8feb
MD5 202b5fc3653cd3710b61b88597d82346
SHA1 e97be338e5dd92354ae18b727f9f06808070a674
SHA512 e341eab8056888e764517fcdece7ee6d7114e4410865e2822407c5a6c880f4913648c5e576238ec2cb2ef5165c139555fb9ab16a200ce6db49623e0183e934b0
SSDEEP 24576:b1SjWqU1tpe9vTv377LGyphjggLXuOKrmJS5T+v8zVW76r0KA3qHwg4xteLG:Z8etOvTvr7zNaC8Xch/3qHiXeLG
TLSH
T1CA85BF56A6AE01E8C57EC07CC6839A26FAB1381103655BDB07E09A163F37BE15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2980	elevation_service.exe
2704	elevation_service.exe
2444	maintenanceservice.exe
1548	OSE.EXE
4480	PerceptionSimulationService.exe
1272	perfhost.exe
5708	ReFsDedupSvc.exe
1664	SensorDataService.exe
2024	ssh-agent.exe
6028	AgentService.exe
796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7b336ec883806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1e4fd245514dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000044e6f225514dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000541ed2215514dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd4259225514dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d1b30225514dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040cfba205514dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
Token: SeBackupPrivilege	5708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5708	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6028	AgentService.exe
Token: 33	796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	796	SearchIndexer.exe
Token: SeDebugPrivilege	1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
Token: SeDebugPrivilege	1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
Token: SeDebugPrivilege	1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
Token: SeDebugPrivilege	1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
Token: SeDebugPrivilege	2980	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 4536	1784	2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe	87
PID 796 wrote to memory of 5712	796	SearchIndexer.exe	99
PID 796 wrote to memory of 2608	796	SearchIndexer.exe	101
PID 796 wrote to memory of 3128	796	SearchIndexer.exe	102
PID 796 wrote to memory of 5508	796	SearchIndexer.exe	103
PID 796 wrote to memory of 3164	796	SearchIndexer.exe	105
PID 796 wrote to memory of 5044	796	SearchIndexer.exe	106
PID 796 wrote to memory of 5880	796	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_202b5fc3653cd3710b61b88597d82346_akira.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:4536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2704

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1664

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c19fb829f7ece55e39f2bfe7192f763516f218de63296ca9b727ef5e9d7d46e5
MD5 b5779ab10978eab696805a0df5866e9f
SHA1 9d1615eb8accee1953f9e9f4cb8cd76232ec4024
SHA512 97f6f531de822f7f2683cc874712d3d18cc0f06530fd3c013e283bd7b42efe7e7311477e35285a18d8c0dc132c0f6a4c737da10bb07072e97694ab0bdcae7b48
SSDEEP 49152:5b+632BuPkFKRrdE6ohQstBhuXjfS4LWxnDXch/3qHiXeLG:P3q6tjBSXA/6CIG
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9411e713e0ca1180be6dc13884587a66e0bdfb2b587d225149410c11c01b1692
MD5 600690ed3bed7d2b97936cfe7761fb8f
SHA1 8a2675f143f6dd9a81cab76b4356f584ea70bd9b
SHA512 0fc1fc62a4eeb4dc92dc4f3bda975f88e9033f58e0b7ea69ce3392f6de17eec5d66b4a1d5c774601405f0a6fe93b7c786e3c3430c9a2bc93bbe6d77385f4ab2d
SSDEEP 24576:xXYfDtczAu5T+v8zVW76r0KA3qHwg4xteLG:UtctXch/3qHiXeLG
TLSH
T10265012877E508F9ED67823CCDA28511D633B8514360EB9B03E4D9261F736D46E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e5a8fb500b691d15c34e68f291942326d30ce88d8f61ffe7ed453146d4a3eef3
MD5 2365d53aeb879fcc2a8a8a609a0aaac1
SHA1 35dae7736bb84c0d04ea896b2d67b7bdb0d472ec
SHA512 bf66e44c965590ee5fcbe7a129b4aec7e32049931a881716c1f75d9f1308650c0bd7f04052fb9580fe4fef3a0a2538d97bce092e2d8241483237bdaeeab1818f
SSDEEP 24576:O0Le5ji0hmxnrMh5T+v8zVW76r0KA3qHwg4xteLG:OPji0Ax8Xch/3qHiXeLG
TLSH
T1F885AE15F6788731D073C0B9C5D2A69EE972308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c152414e14f8fcfb766ec121abc030dc115f1a149c1f4a749f459cf9137e2a2b
MD5 1fe8f4a66372d08b2956428e451c61c9
SHA1 9ca00dd48916da5b016718d6ef033dda7fe25948
SHA512 aaebfd3ed6cc2be075883472e539f3c25f88f45d62e259d14bfc7a98050ac8d3d24ba063f98cc8e5eed9cc8e17945516c050dd5b3e347bd6a52b352be65e11f2
SSDEEP 24576:Ha7/ezSC6vUyDZaqgrvWx6q8wyuX5T+v8zVW76r0KA3qHwg4xteLG:K/ezSC6vURPvMHjywXch/3qHiXeLG
TLSH
T1CC755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 820eb9990237f9981ddfe2d8ca7bcaa4edc5208f29141b830f0f0a7794cb1029
MD5 0714f1e13f1f2a96e3b7ccced610fad8
SHA1 cf62d83b221076423878c8850e043dd65db9473e
SHA512 324dceec37a301c051599e6132529b38c75ec8881e80b20eb356427ddf52349066f63d4353dc3090e2756c73331769a411a9c8e6035ee8761926f07d8e55937c
SSDEEP 24576:0VbqPb88hv/lV7K5T+v8zVW76r0KA3qHwg4xteLG:0VO88hXlVOXch/3qHiXeLG
TLSH
T147559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4efc389583f28e2a8ac25351f7839a6c8a3f5ac46da14f38f72113c7a1ec27f7
MD5 414a1dc6b40bf1095c43973f5aaba275
SHA1 cb197bfee9cdbbd73376bef165c586322847e59f
SHA512 dc0214a7965d0c9753896526ccc91196d142e60eb418d9a078961fa9caab25683122d3eef18882dd3102a76f028ea79d80f9e7e7a65f7c1bf2d87eaad1a69267
SSDEEP 12288:2Gd5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:2Gd5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T17F4523485E6D2850D39B8A303FD7A560C652AC7263859C1B5B8BF6237CF4CB0FC166E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0a4224c7f924e4d318777465cc7152c233f5f57d69c0ac1f3e7a320673b98207
MD5 dcade76b28516c4612ffa145cd69f08c
SHA1 bd5b3224895c3d078578600b3131584e6ed13705
SHA512 518e5741adab794726b7e115f324191161010a578f53ed53d238871a166ec048b35cbee757bb4f4172571acfe1d4a32f191b547b9ceff92fb2afa246fda681be
SSDEEP 12288:aeBNUbTVO86UC5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:aJIUC5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1AE65CF3BAE28FCD2C27E8D795B918600D77278714B52A3CBD165C20EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1686bbc886eb32c0fed3172ccc4e424721d5ff3f4992e93b223854d495d8a1a0
MD5 fa0897ef59ef87755bff25e33585fa58
SHA1 e1b1006381c5e844c3288bd6ac1a8f72b9a78281
SHA512 203c5d2451911b064e2144048f61ee5c799fb14a82e83e985b84de8a94ea3e6f7ed827160603c8053c71240bce7b3fc391fc27a9e657af9c1b29a86b6305a7ac
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THb:zQvGAdlCEL8c/pRNw5CNXA/6CIG
TLSH
T116267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 551bc64860a59bd73b04ea5aa66ffed90dcf14a81954c7fa520bc9e1c41f19bf
MD5 5de04cf0fa6399861ee028c03c321370
SHA1 b86025057603d353d1e53c8b11abf048c3e4fd0c
SHA512 c109f33f02a1fc88c3d6092d0d39268632f67b44fdd63cdf97042582f47748aeb9a88ba84d8b55d220b8ff8b1dfa5641ef153a29981d9b4c4cffd7112b257a5a
SSDEEP 24576:fwewsAjA5T+v8zVW76r0KA3qHwg4xteLG:YljMXch/3qHiXeLG
TLSH
T14075E030FE79E432C3BF0DB21B66C716542DB9204B5219C3E3E88E9E59702D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0ab49eec17414bba43cb463419cc49ce81a56ad19923e7687c8d89c051ba8654
MD5 3024cff84a5ead8f4e9a83fbc21d2721
SHA1 d6df512268c394419a9cc05430860edca168e3eb
SHA512 0ea0b50d464af7ec10364e6347e8efc8c36e6b64ffa913294acb7dc18b7230656a5838cd7c99b45a18e62f4d2d6b2e8bd897b834953797e1c029658da445f8a0
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHKCIG:ZUEtQevvqc2W1cpV29I32KCIG
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9866d1e1541655c3825f138dac22595c34e78284234c84e365be5f08fb9672c9
MD5 776b86b26536d28407011bdc5cd3deca
SHA1 4c7e593caf96948cfb5e4145ea3d8126237cea1a
SHA512 707125109ba8f7ec47185f323835a11806060edbab636b7951cd70b7da403cd6df579bde2c45d3d0bc17d04553c1b1d3e64e14d78ff8df4de1e470decb4ef808
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zsXch/3qHiXeLG:MoquVjnmhXA/6CIG
TLSH
T1C4D58E0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 94de3d0a1234cd6f3c8d4acbe4b9f3fef2b37f8098eb65b565e25308516861e1
MD5 c1e34c4b5435d91b643f8e825502979b
SHA1 c61c7334d61cec0e97d4c7590fbabfe005ec4906
SHA512 49d2ea0360dfad0bde4c5b391bdbe373be67753351c227f2021b68565612cd77f34270b87f788afe20e9bbe6cd090474f5cc88d399641a8850f2905956fdfb19
SSDEEP 24576:LAhGLmIFoiwtA5l7S53L5T+v8zVW76r0KA3qHwg4xteLG:LAM1Foiq5xXch/3qHiXeLG
TLSH
T15735AD80EBF955D4F5B39A7899B68170EA76BCAA5E31C20F2250D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 25f79020507de0df51740d13edf79606c62ad25be2244288d5557ed0dff567de
MD5 9f4d060e60cac65469669489d34d6b4e
SHA1 b2c406031e5f0b2af8c60ade7bc7ed6a7c9434c6
SHA512 f2ccae7ae474571f6d599f289c3f180223942ee6bf910b544f22969283706b5d13af6b65a6c6899c2111d4327c379af58ad7bb66212b261705947b7d71c630d5
SSDEEP 24576:MwuXOWk5T+v8zVW76r0KA3qHwg4xteLG:MwQOFXch/3qHiXeLG
TLSH
T1C965F14936A91CF9E5A782388A97C135E7F2BC122721DB1F1760C6176F37260BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8afc666dc5ccc969c8bd579c2dbf9757552ef5ca8d7be606989b404c20541b82
MD5 ac138e860a9ad8933a27a8cdd24e0860
SHA1 c731d6932cd383cdeab4bb34898f99008c1f83b6
SHA512 f97f0104f190e604b91cb0e3b786db6b3d7290abc889989e7dca35db816f5fe6396f67326181021a9a504d66cf73af2b58e9f7c31a85f19ae1687f4a73615f59
SSDEEP 12288:gbZ1IyQ5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:IZuZ5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D555124936EC30F5D2A782389EE25604C7727863237247CF165682672FB3EE16D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 21fb5fc67fc748fac7af6662ad283309e5b97ff3c0dbe36aaab50fec9d95d158
MD5 9cbbfde23f6b21ad9f224bc1ef8b39db
SHA1 a7abb2da37cd41cee8d439919f5d1ed02ea61bcf
SHA512 348bad0c6a0c882abec21c8e25c9e43e69d6b02b1de8177d4174622042879d6d567d7be8965f0d5cf14123a71297d63b71f7f9afe79ae7cdc29d490e5b329d31
SSDEEP 98304:GQRQyi36YOcPuLvw2gAf+PN3+XA/6CIG:tQyiKakX+PNkCIG
TLSH
T1B2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9350f6f59457dea9f872856ee19a0fce83937e079ad1e49c4d13904b5ecef736
MD5 f4daa29e2580d1e9d5c8c094cba3c8fc
SHA1 4d4f18805ca5913063d4da906d43443852d0a9f1
SHA512 c208bcbf6791cb4e1759a839f1e2a6ce31b35f83ed1be3d8ac3188fcb4bb8608a0b2eb6d464b53c426ee149386adf51dc3a6d76de4a7175c535a71ac9e6116ba
SSDEEP 98304:MQRQyi36YOcPuLvw2gAf+PN3+XA/6CIG:TQyiKakX+PNkCIG
TLSH
T1A8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1c67d43cf0f83c32b265f161d9d8b098a75d0fe5be0be72203aca426d9b344a6
MD5 7cd333eafe8c1e3316cdc0243c7c64e0
SHA1 10da110f54f6a0bd27942ad3f279da56722b877a
SHA512 934cb21c4812a96101ef7ba8bc584eb9b83de995b69304756033d6585c90d70a804727e56bd41e5ad7eba8e6d4ba17b5f63dfc43f9237440908afd9ecf3180a4
SSDEEP 49152:w68Qg55nhxeWu7PNU3/8Xch/3qHiXeLG:qthGRc/8XA/6CIG
TLSH
T1DFB54933B2F600A9C44DD1769F4A872196D27C758FE0E3DB860572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3dfc0b30e91671a7541dd7763d35f15be0c8d7dec06e2ed38a13f1ea31d2e00f
MD5 27e15b635ba9ac4676ca188245de7cc9
SHA1 18caccc9fd7bd3b3f1a58599acb9d46770faf4c4
SHA512 c10f58a95bf0669968befd0aab938cb5baa9717131dd040de08735b2465fd42974682134180a15a98de7d22b5951ab424a571f92de7d0923e8626d53fa8129cb
SSDEEP 98304:9y5112gYy5azzVvD69nLKnhZ3XA/6CIG:gLIH+WhNCIG
TLSH
T1AF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dafc915ae917a0366a6955b09149ee2f637eac72fd209a1cc2e41721342c345b
MD5 c719dcbf7ea861a4c4a3ae5ace2f8322
SHA1 7baa2e082227a85782f5b9225f155082387d295d
SHA512 a37ba90e27a06deddef582ceb5586a70f25dfc0811925c8790bc95417d9d39ffeef8359028b842e4afc86d118091d28e739a58ff27302984bac98171f2bd0967
SSDEEP 49152:IB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glmXch/3qHiXeLG:Cu6JmQxd2dmXA/6CIG
TLSH
T10BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 74dc9670d2d17ccc5c99d3c4c46924f28fc6f2bf91ad5e015fa063f99eb1bb58
MD5 28a5d7f0d528929ddd75865095e7976d
SHA1 1b50725423f41f1ecb816315d2ab238b8d798264
SHA512 847869a9e35fb6b380fbecf315cb293281e24245c9f86d328401fc5b1471c9ac5a0a753a95ea394beb26e9983eb8f6beceeb3aa1ff19a28e135f7a2f445234fa
SSDEEP 49152:S1hpsNoJpF1A6yU44CwH7R4xqXch/3qHiXeLG:SmifPVRhXA/6CIG
TLSH
T156B5AE13F2D900E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8c8c75e8219ce73998b8d221505ed157b1ae247a160cbad94005f445b4254d7
MD5 14d51646dc274d855cb1ec314a511e5f
SHA1 522a29546947e54f072d346cf4d8c99e1d4d71c6
SHA512 e19855e378a58e1c592fc06e37fe7edc6339c3ff52245089a8fa42a3be8d20e86f4c87db48bb24c32201aab2be17af0b2f47d9f1cacaf449269267b6f1002b91
SSDEEP 49152:zSuZQIY0Be2KIRVtOnks6NMHqTXch/3qHiXeLG:x5dKOi61TXA/6CIG
TLSH
T1E3C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ef0a75ae51099dbb3fdf96e82695b1f4b1f66b8bca7ae8e8096a89f5ddb70f98
MD5 4d176d2a4a71a161b25d99eec2931a66
SHA1 1d3167c96185beb6d49b254d70e0cf01c05a7e07
SHA512 eb78b77e5af4f3f05818863fea2df0d143c3f95ba36c4e90cc521212607471fc9801dfb063bdf04b46de962eabfa9ed9c544239557d37b061941b568b5e02b2b
SSDEEP 49152:3htSn8EApI0figGgiDn0AP5w2Xch/3qHiXeLG:mX2i/phlXA/6CIG
TLSH
T1D095BE13F2D900E8D05EC178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 efb7668ce586d4067c354c75829107dbd8cfe57f46a228398584b14292e0bf96
MD5 fafb7a011311a3e8c69fac48027da623
SHA1 91fe9cb32feffd20b925d9a68b61d7379c56f8d1
SHA512 4d0c9db89256dd154df511ffe69e9dee2c62f8777865c9215c9e7394e3ce1ec80b51c440cd786a00b2c1021c48cfa7fca598d804993029e7c1134543e306e534
SSDEEP 12288:m15T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:m15T+v8zVW76r0KA3qHwg4xteLG
TLSH
T15D4523482CAF2815D34BCA712FD39160C54668B7B346581B2B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 911fd672ec510252d64cf8ef3f32a3eb9ccefd620e0407d4489ef70d4481dbf2
MD5 2dfaece82ad9dffddb7a1d53f5587e3a
SHA1 e250c976263cb953eab00dfe41fa5ef7d6495ff2
SHA512 487d1ab3c5ca15d4cf71e5e49f3419db980537fc293f40aaf51717533f3238049e12ad294afdc6034fd43cddde7749f45f64c28ece8abce9f0d81526ebe8a197
SSDEEP 12288:Js5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Js5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1404523482D6F2851D34BCA312FD39164C556A8777346581B2B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cd054d0ae71236cc3f0783685f8b0dd6e7ddef5680fec4f8bec14f603eba0265
MD5 f3b8c7614062bde765276a3d043ccb0b
SHA1 76595a72d89ecdd307f90c33bad23693ae2fd328
SHA512 cd68658e4cdbb52989882ee8547644fcf92ebc990bfb29cce5ad30c151fa5251f2c90a1914dbadb142974b9c3f56ddcdd3921f0380f8976c18869abe2d58c15c
SSDEEP 12288:O65T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:O65T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1FC4523482D6F2811D34BCA312FC39164C556A8B77386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ec24f40a3e27fa7d2750eee1306fbe50b95188d9f8ef8cb8a90aed693e8a0d2a
MD5 ea24374a528cea4bc89efd585a32368f
SHA1 58af9ec56971c22559248db4d33f8111f6162a20
SHA512 2c3f5c8bad514f8db2603e5afa0fea452d25890d46366d7422133c681faa4eaf77580728d3877be3cb6e19505d4c8a6eb602af6c23dada81e995c6b28fe73751
SSDEEP 12288:lVr5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:L5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1B04523482EAE14D0D657C6349FE39120C2A2BCB7B322595F5B4685132EF1AF07C35BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f12b192771e73eb476dfb5c135c3812cea70d33c065ee54beb7b74e6c680abbd
MD5 1dba4066889d28dab27bc967bbfea1eb
SHA1 1efa72ed4b447fbe59e7b7cea6edc860cc7db536
SHA512 3ba40bc07426c018595d1870e973dd97e673f950b6b91d1a09819c205106433dc2bb83cf36b8fcb294c300a88b5678693e6785e2038a453898b2e26041994828
SSDEEP 12288:qz5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:qz5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1894523482C6F2811D34BCA312FC39164C556A8B77386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8ed59e8332806e1f127a0426c8863e380b06a342240e0e70019dfa0a84f392fb
MD5 fa80bb52db9362f08374a16c4c1ca06f
SHA1 1e1975dbb6d0ee331f7431a90782a783d5c0800e
SHA512 2756004776c5498b85cc707e265349eab10b8e3c217acfc03ec0ff2939de36c4b4de879a924bed15eb1222736498fc0e83bbccd9684160a5fc71299b1284fb08
SSDEEP 12288:345T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:345T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1854523482D6E2811D34BCA312FD39164C556B8B77346581B2B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 560be491bab1f424d68a866cd177983694aa34171725f50cf6b31ec3a7262377
MD5 dc5e63b12832fa5e82b9d2b678189638
SHA1 2763aabac1a30cdffe2db5a3ff906902d88e968d
SHA512 22937e62fe549fb6d4340eaecedcb850fb97cda67ce7940b6971259b41eb39898dec06295ec58890d354e3502970c3df1a694fa80e5993e6255d9b184c7e2cd8
SSDEEP 12288:IU5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:IU5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A84523486C6E2811D34BCA702FC39564C546A8B7B386581B6B8FD123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 397826afcfd69be436dc9c79540a7f005e22563d859bceb311cddd39b834a306
MD5 ec747d13bc0d1eae56893246a84a7278
SHA1 c9319c0d169eb6fc84fc447c768e2475781c5cf8
SHA512 a59c9545c4714cfd874e93ee2d35ed09de6a8ff68bd1b845c959bd3f2fa6312c80c8d9d8421c41bb50f2a105a7f2c7729aaabd2f9e9d2083cc16d109fdddfbb4
SSDEEP 24576:9ZMJzFVSOM5T+v8zVW76r0KA3qHwg4xteLG:9ZMJzfkXch/3qHiXeLG
TLSH
T11D650194739418F4ED67813ECD568915C6B27C6A0760CA1F13E836276F737A01C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2fcc0eea28e9b3c941f43e8f4368b1e901a1132b68f60a3e42bf7a2949916a12
MD5 f6e4d93e64033b3fe1d567d24463c615
SHA1 a22611cbc92e60100cae28b69be9d691c335bca0
SHA512 edff2a39ed91ed1817a5aa01636228aea82c954883add23ab56c1eddc7ca501de7c6cac6ce5ad741c2f48c11ca2ea0eb69e57dc18fd0317f9a15056e787da1f3
SSDEEP 12288:fp5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:fp5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1C14523482D6E2810D34B8A352FC39564C556A8B773865C1B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8bcfc331cef9522c32ed038be8b6653d7cb3b2e66545b6bd2974bdfe2bf8d0c3
MD5 c068a3824509d2aaae10f59f2d0e12d4
SHA1 b67f2d989c76a550b38de5359c9d84c820dd962e
SHA512 1c76c871b533f9e733e3927fd710926c6107d321219144e8035525fe326a1e1fab99d0b280908b3889cda1536071b81e6776cb66d87148e5159c0a7a5d5f3c17
SSDEEP 12288:it5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:it5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1B84523482D6E2851D34BCA302FC39564C656B8B7B346581B6B8FD123BEF5CB07C056EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 fdb3dba4e44ff4db6d9e20a33928df851bdfad5db1f269e031ed61359404822b
MD5 1342f93e516e900c6b0b9a5670328e5f
SHA1 fd037df95398f4dbb21c47dddf5b439a365f43c0
SHA512 086569dbba535ed312b059af44ec1b4ea425092ee09f139f27f3d827aa43aee97c066660efd32b1a1d8eed6c7581d86492140e10f44e11ba26e41da7fecc20f2
SSDEEP 12288:eyPz5L8Q5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:DzyQ5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D655024777A930F9D16782388D921A11E772B83253218EAF179447372F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a263ca582f0e3d7bde6686f06f061bb3bc8181187f36df16a0345952ad54612f
MD5 25ec45195e8da9171dca10b70a2e7b68
SHA1 19c68bba8d83d67a88c724469c3e565ce845af6e
SHA512 d3aebe2d678cecbf03ac50150123660fa03d5090b190319ae1fca6df694a3039697230b20eeec16234054ab62c10fc0bfe9db8e3cb60475ba0dcd9426413b2e0
SSDEEP 12288:cp5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:cp5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1FB4523482C6E2850D34BCA352FC39564C556B8B77386581B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dab2e828c3336f8d9822a9b59858dd555477b4865bd52034472c1a3873daacb6
MD5 4f2d8b558b7d3c9ec2f63bf19e65c48f
SHA1 57a592c3553916f44863236ef63dd997df2997ac
SHA512 158c5d12e344579d2c1057e325b8260d4d2ee9aa7d859bda0d0d3faf7cb2a3a9fbf082f16f9670e09bc18f34453e7f8d8f87c1d563841a2b61a55d329084840a
SSDEEP 12288:Xp5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Xp5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D74523482D6E2850D34B8A352FC39564C546B8B773865C1B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f8f7b13af83117ae28077364a618efcfed3b55854f2c71042b4e393a784208b2
MD5 63e4b63ecfb12dafcddd5ba097fe5dbe
SHA1 9f0b1c294257db05ae941291042f509073f999e3
SHA512 b68ddc273d0bf2b9a9c7a32ba232f9d31c6047ecc6cc5348bc985962fe53872223aff91577ecc3423ab3239139707a7c86650d1a84ada70a9d9fb91c682d2671
SSDEEP 12288:KyPz5L8Q5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:XzyQ5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T12355024777A930F9D16782388D921A11E772B83253218EAF179447372F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 5f5abc9250c80861e040475ae30ca01494a375d27974d3babe613e66772687a4
MD5 aa08156611c1bf0ce0443ffdc3c9dd70
SHA1 778e64a79407281b5957c1b8889dac7da5b00796
SHA512 8365b4a88d495fc324b5d85e195d585d45af10ab67d47ceba7d2481d41c4b2c3767dc8084d2c67fac4508f46af754f6c77aa64365219311e768749f7aeeb5a8e
SSDEEP 24576:QTuaLl3z0zDq5T+v8zVW76r0KA3qHwg4xteLG:QTdLlj9Xch/3qHiXeLG
TLSH
T18B650294B3541CF8DD67813ECD568916C2B27C6A0760CA1F17E836275F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9640ea87b5a17ffa2a1d85888096bb5f40b673577189857d5937a2c98b2972c1
MD5 82c599ee880c0f8a85d3afb8bcc60d63
SHA1 f272bc8fe42a4fb8b0035c7bf5eb6c1193b21448
SHA512 1060a7dee6e602e93166cea477e2c7dbe507ec29241dc069fa00235cd4f30d1458471a36c7ae6145667e0b7b6993b9e3fd883fe8393eee2f97c4e4395290d1e6
SSDEEP 24576:A3xd9CHKy7GZm5T+v8zVW76r0KA3qHwg4xteLG:Kxd9CHKyakXch/3qHiXeLG
TLSH
T13575CF90F3E814E4F1B7CA358D764511CA767C5A1B21DE8F03A8661A1F33AE19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a0aca8e43a773e944669e3602a9eacfe56527180937624603afa7de448c1947e
MD5 5880aaea1a3bd8f56fa6c58fe4ffc0f3
SHA1 2b05b56e2edc3200ba26b7dac3b58626a0a55088
SHA512 cba1bddf3f972397cb5f8eeed0aec4d632647da16b70d8141ec5ed770741b10e77b3d94baae2f8920683d5c4afb62d7a4d3e1aded6a47fda0061f45986a79fa7
SSDEEP 12288:Ra5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ra5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1434523486C6F2815D34BCA312FC39160C55668B77386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4f732d572940b9e00ac38b04bd8ea0ed35c36d82474f640b27625a8a71f08695
MD5 2a771a76ed69b6ac177f2d9b42fba816
SHA1 5df6e53f97631ee077ad51a683d158b2ad2f8f62
SHA512 48591c67e8315dab74d943beef87cd71112d9e728eab13c7aa2ba0a4f66e5e482fcab9cb37aa2a980034a97b88fe9c182f68db6196ec9581fae84c907243a769
SSDEEP 12288:Sw5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Sw5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1094523482D6E2861D34BCA712FD39560C646B877B346581B2B8FE1237EF5CB07C056EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c0bee28353d921ea4e3ea42e22e1f457f0dd1dfb23a2c8df1ac5f8b3f1196a29
MD5 e1bd2d59d88a0ccfa060609c489ac7e2
SHA1 8032cea3f722f10feeb4e382fba1717c70ddcf76
SHA512 0f578db21c8af7d880d69408b7b88f127b355ca2a2dbc8380fa200862013697acd2da29a04f29935f9f9d9b0021e6c658f9c6d0270a5a55469b01765dfe64929
SSDEEP 12288:Yf5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Yf5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1384523482C6E2810D34BCA352FC39564C556B8B7B386581B6B8FE123BEF5CB07C156E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cdeafe21bd617e73c837e9c1b1f2e13d2055a81266d9d9ffeb325b97b2746eb3
MD5 c0861c587e5a956fca28dd53472ef62f
SHA1 5fadb01c5f0ccc2d589bb3869720c845a93cc997
SHA512 96ba76e3ea4c4c0c49b2c829452db283330d1282be6b6813c6fcf3f9bb91e7a2ed606ebe96cc97806b8389f7d77670c654f5d35bdfbce2fe40a55eba7eab9de4
SSDEEP 12288:Ep5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ep5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1194523482C6F2810D34B8A352FC39564C546B8B77386581B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bf4a6e2714929c063862b61e872c9c1c293d0b96bb4e8c04569d5a4ecad9c9ed
MD5 4f51b9a35ca1071ce7eb66a4ca64c4c7
SHA1 e3ade1b58892fb04cc48c05770e404438623e4c8
SHA512 074cfe0a82244407c2b6e4d5e7869a45ffd0b1e302aa93ce707be1185a68f698ed3480bd14e9010a7634efd81f26ac57bc0a73f94736b9f14a70378c155a8d26
SSDEEP 12288:Sa5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Sa5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T16C4523482D6F2811D34BCA312FC39164C556A8B77386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9cbf1baee36969edb445b50f19b4530d55f43822635cf6c21d6b9a799d25ad8a
MD5 6a350b5deeb610737188ab9d84219fa0
SHA1 751575bca5e95f7a121520716c6ba4da669b7194
SHA512 36b2bb4fad53832e3775e4c05048e61fe33cf9b235f50a2250519823e7ab1fdb7fbb684bf8813f04edd6b7e69134d0d2536e844cf0636250802cc084a2bc148b
SSDEEP 12288:IR5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:IR5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1044523482C6F2854D34BCA712FC39560C546A8B77386581B6B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b69600e0da4db2cade4cadacb5c494ca1f0aea4f6779c6825d5dc420a90065eb
MD5 2b66bb9102fb828b07cdd8bc834735d9
SHA1 8ce59a69fd4af48b6f2b4405275876bbaa3c0831
SHA512 352b31ab3cdb3fbcc330de4302fb68daa6c7ce364228db8a20b13a4c3af98eeb3fb81e6943d8914d75b09425d3f3acc323d1fd17a2d9cee41d1ffec87f48c368
SSDEEP 12288:Bz5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Bz5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1014523482C6F2811D34BCA312FC39164C556A8B77386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 763952d3eae53ced456fa818d632108e88896c81f2c36eb51d03fc71c192e5ad
MD5 5d521ab0105f3bb227c113a5a6b2cf45
SHA1 28a250a19d9be1828facd1ee93c98c647058b8fc
SHA512 66d7dac130c1ef862289cf61f4f6236927ba7884051773145d4478695bbb29498e7d4cee376f628a50c1d62d1a6b8fbd8c1cf1b47f1c76d954ce73952b64adae
SSDEEP 24576:3fwvOk9RX6wkyAI95T+v8zVW76r0KA3qHwg4xteLG:nMnYIXXch/3qHiXeLG
TLSH
T15185C029EBDC04E5E177823C99B3460AF6B178691B31C6CF129A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 907c52bab519a9bb9a799d3340e266c7e759c814bf18237754fd66a6fef5adbb
MD5 3626a0b736545f490ac5727a9079faf9
SHA1 23d091d3fb81a8d1cf702eb5f61c817a8077b874
SHA512 2b977aa967f470e4a023ccc07ba733c7134da7e99dac45758d25d49b33a821fcf10f58805c843f3f1ebedf3a029de76d9be084eaee663ecc04ec151f41c58ec3
SSDEEP 49152:tYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WXch/3qHiXeLG:jySzPeXA/6CIG
TLSH
T1EB066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 af9e4b0bf733cc2994e9ebf32b0f4ef52c566c3f9c2fa7d31f84b4e26c7230b7
MD5 923c3a560130f13d816d8c7cf5565a56
SHA1 7bf0d6f2037bd72f884d2c6c0d4d5c228dfb1fc7
SHA512 e071bb10a590160b2394732a41ca0ffa8c445a345485ec151ec4050e208630a0a8372a9d8823f23816708b2414bd9b5673bc0a570058c48172ec190f363e12e4
SSDEEP 24576:d47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYc5T+v8zVW76r0KA3qHwg4xteLG:d47JUQjairIhCnDHUPfF/mXch/3qHiXj
TLSH
T14565AE1DA3EC01E5E1BAC27885554A1AEA71742E1B31CACF12B0837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ba25cf536b0a0af1e427043fd842ffa7f48d1081b9501e0abfb8ef8f64265892
MD5 7bd4103db1e265956d8621f11235d76c
SHA1 5eda7a5bc7ca359ffe4b1aa448dfda7b2a826f45
SHA512 b483b42739b275a2e6c9f5e38943e409bacbcfdf9b8aec66faa268ebf597638fa34e8f4301ecc0f8c568ab39c7ba8590d2f00bcb53b1e5557c20846e78d7ca94
SSDEEP 12288:hksfZ5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:RZ5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T10555F009D69811E8C16E8235CB924640F3237C6693E1D7CB17C1F53E1FB69A06DEAB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 b03d5c6280fec074064dae69c81b007f90ca13ad7048674ed636dac5ce080775
MD5 0446b7dc8ae9f9ecbcd70e0f003cc677
SHA1 5ee9d8a04ca37b8ea8b96116b90999d2639b2e14
SHA512 bc4cb5f756a131514094fb96c382be465022f5a1a5c66002cd49444cc6d04612487dd8388ec5217b258d7fb36846143ce3c0877e7c68fd2f5870773dd099bea7
SSDEEP 12288:JCqkU3f0EyxfEf+2wOqg6R/FyEbsZiASnKe3E:JCTUPjWlb5/AEIMpn
TLSH
T1B6252950766AC75FC6AD40321E36D5CCAB707D41EE059B0372C89B3FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c297ddcde074b54278ecf1cfd9d6ff1496ea51ef6d25a83de1d48e45edb76915
MD5 a6dad4b090091b11af6eae03540cbe43
SHA1 bd66aeaf0e56d6df59a9c714dce1accd48398b01
SHA512 989f9c0e177d105f1b12800f72d72019fef9bc64fe6ea1929b0c895ab97b8fc55ef0fb0eb3130b5e7c9e41b254a3ef8be18165bffe692647ff300ad70eb10feb
SSDEEP 6144:9GFO4fYQ949GP98y2yG3JY/RF3jX8nHG0tIdFC7Fjz1oUZ4643HDcW8PAFGzU2AQ:KsA8y2yWs0RuE7M6IRT04Oeg982yWcW
TLSH
T19865F9815537A3CFD1FB6072072A9B4CAB64EC5377055F22B388593AD82A725A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f15fd373216259c64edf3aaf0a79fbc63b73ebc449cc124430501f6acd21f560
MD5 742b7fd865b6433e196bfc12ccf4acba
SHA1 e7a0b9f24dd410952991c1ab100c19ae1e5c1909
SHA512 4f7a45fe12ea8873ef618e4bb9f7ff403ba07434166ba4f94c80b3fd308c7768a42424aae46961c6bd16593b54a2f47f1e996c2dabd7bebbf6713d9c72c727ce
SSDEEP 12288:n07B5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:kB5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1BE4523445E6E2C11E26B8A702FD79130C60AB876634198DB6B4BA2237DF5CF07C357DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f8de65301bcc4f0fa723a2814812ada2b6869ddcc962117c6d8972ca6dcafd5d
MD5 c178ecc45e1a8cebef10bd812169ea1f
SHA1 2447ff89b2a77c0284b29ac01c171d2767888260
SHA512 2a182fde3ccc36f57aaba8b096f183684a97d3f711024dee93ffb1ae79d0cce4dc26de9271d179b6e2de4dab7cdb4531cdda2fd3a75a26c07c67aa0bd0dcda86
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYX5T+v8zVW76r0KA3qHwg4xteLG:1gb4mBIBhGFYXch/3qHiXeLG
TLSH
T1D165AE1E22EC02F5E1FAD2B89DA64417D6B278161331D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 88cc1efbf748264c190a2fe7c03f20115acbdf95f5f07c0dc0be0836f6660d2f
MD5 9ccfa5e5cbfd908cea9b9581ed93e57a
SHA1 2821afd4b1b554bea311d52352e10226e75acf00
SHA512 b94cb7ed746b69b2335dacc880244fcfe7b214f001cf46bf17a29f67827b8688450deb694e0ad5e2f72b7ddf2895027234160962fec1a349d91ee4ea025fb8ae
SSDEEP 24576:2G88u8FpJqH1nzria7/mM5T+v8zVW76r0KA3qHwg4xteLG:d7ZFPqV6a7/VXch/3qHiXeLG
TLSH
T1B585F16576E501F0D47BC1388A864663F6B2B4251364EFDF07AC8B521F23AE15B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1dd388a8d00122644c76bcc42752bdfb3c8ef2dd4108ed3869f001179bccd364
MD5 349b78ef3755b92bc25c5d2b138dc9f3
SHA1 e76c537ab052c279677cd662b836ed4c2a6c94b5
SHA512 38856aee010368636ae899e3316a2258c18c39f66568cfe94d559c9193cd97ef6a2763378ff3b2b500952357792a1211e39129989393fd901dcc9be2246d46ed
SSDEEP 24576:DPUr+NQI5T+v8zVW76r0KA3qHwg4xteLG:DJQkXch/3qHiXeLG
TLSH
T14C65F11E26AD18E5E67BD17C8A828619E772B462131296CF02D1813F5F73DE8BC3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c5d08f9ec11cb76082ea3b00b115445c18ca9371b9e961debb3e23d83172b918
MD5 dc74af19bc1cdd4988e7700f85b32bde
SHA1 6ad0ec215aeca7f58ba276a7220fca889b67d250
SHA512 2a611041aa7b323d83a5521d144e95729365f82fa5ced867b91607b5949da34714d5080a3fc5ea75f83f89fc6c7b813e3d8a244260714ac610c48dd8b4723514
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUXch/3qHiXeLG:sG05lO43bvXA/6CIG
TLSH
T159D5BF6E62EC11F9D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b944bb1e50b8b74d51f269acd258538243327715feefb7703150b2546ed8ba21
MD5 70aac6ae01c225d32df55dde4396d0ad
SHA1 e242fc5a3e68f92d845a2b78b8460f6ae684289b
SHA512 f00c37f493ed74ea6c09aa044c6b2b9b8e64a450bdebf61bea7765f8098bd97d32e4e23a5db0b57aec78578c6c2c3e4f4e47bd1c929ef45f45857338de3bbf17
SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnO5T+v8zVW76r0KA3qHwg4xteLG:Da5POZ3hJt2pasx2+m8Xch/3qHiXeLG
TLSH
T17065BF5DA6FC01D5D1B9D17DC583861AE5B1342253329ACF122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7ddbee244415cc2e552762261c50230ff046ebbd7da505543cb07fe3ffe896a4
MD5 11d93eb4999f92da62a39ac60844c9f2
SHA1 559191d735548e7f0d86d3ba87e77a220cc3ea43
SHA512 849b6e35ac6b6d87a6a85eeda3ef4c349412b4f292ac5455eaacb38af179188a4f53ca67fb8c711eae57819ef5a8021dc81b9ac2f7a7e439710008e5595d8359
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkE5T+v8zVW76r0KA3qHwg4xteLG:QNc/zEOVHF1Xch/3qHiXeLG
TLSH
T179858C1623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d513b3300139a873ec67ecbedc20efa41e9750ad10109f0e27dff24a4ac63771
MD5 00973a79537d3727dbdee9255b73ecd9
SHA1 4b23c687b3c9d4768f46b934537ffc85fbfccc26
SHA512 46ce3220a5603e85aa028ffe5d6dc2da550fe2cf4383b9aa028d31f3e990815f587206ac45652b0f40bb8137148b5826ea2071727d145cb2906de94dc68a9b7c
SSDEEP 24576:w3kNvNnaFeYhJNtmZBmS5T+v8zVW76r0KA3qHwg4xteLG:w3MwBtOmaXch/3qHiXeLG
TLSH
T1A555AF6EBAB805E4D1FEC6B58E238512E6727461133293CB5390C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8cfd3651b49fd125a412bfb1311c9196e2aefa515af33da48f2451dca4cafe34
MD5 93d4f929db02ab80a9eede3363fcce35
SHA1 d1e36b335f90aefeb01dd5616b1377ccc97695d8
SHA512 62652b9aab6504e61964cea36fd8e53da90009307f14bde9c66b86185c7c15968073489f27eb121fd3b3ae2316a9968511d1b757dd278ab86f0f4687c46f95e8
SSDEEP 24576:TD3FHshBIYQgAV5T+v8zVW76r0KA3qHwg4xteLG:TDVHeBIAA/Xch/3qHiXeLG
TLSH
T11475E17DEA9C04E4D57BC17C9A938A06E77138A9032265CB02D4C1B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/796-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/796-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1272-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1272-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1548-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1548-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1548-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1548-286-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1664-99-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1664-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1664-306-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1664-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1664-93-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1664-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1784-104-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/1784-7-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/1784-0-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/1784-6-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/1784-8-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/1784-79-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/2024-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2024-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2024-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2444-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2444-39-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2444-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2444-45-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2444-49-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2704-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2704-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2704-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2704-162-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2980-22-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2980-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2980-21-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2980-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2980-15-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4480-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4480-301-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4480-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4480-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5508-320-0x0000015876890000-0x0000015876A13000-memory.dmp

Download

memory/5508-391-0x0000015876890000-0x0000015876A13000-memory.dmp

Download

memory/5708-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5708-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5708-87-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5708-81-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5708-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5708-323-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6028-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6028-131-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6028-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6028-126-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6028-120-0x0000000000820000-0x0000000000880000-memory.dmp

Download