0fb059a3029daf182c76b22f8f0351c3bf55121e383bc7bca8241b77dc3b2715

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
Size 4.2MB
Sample260723-fg8djs1dre
SHA256 0fb059a3029daf182c76b22f8f0351c3bf55121e383bc7bca8241b77dc3b2715
MD5 0ca113b8a8ae1f5f71246f77795ad402
SHA1 c545059e9138cce6eafda1941291a51123c2aaff
SHA512 6a88cd99891230b3f2fb45a73ee4df2646d43bf04ff6fc97963b8752c7bc5225387c0afae2495beb4e959dd353fa93b9b422dc93ec13f595b747ad8c92b96862
SSDEEP 49152:P0dpsE9LOc+quo5s+0yLKmGQEByhKfos6v8hbGvONP5gPbmuhmBKJLNiXicJFFRI:cR9vb+wubaKuhmBW7wRGpj3
TLSH
T18D264B12E72151E9C825C07483266323B7E2F96D433077F74A905733AE64EE05EBAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3272	elevation_service.exe
1656	elevation_service.exe
4080	maintenanceservice.exe
3508	OSE.EXE
3912	PerceptionSimulationService.exe
2412	perfhost.exe
5996	ReFsDedupSvc.exe
4140	SensorDataService.exe
1868	ssh-agent.exe
2564	AgentService.exe
4932	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c3267334e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\InitializeRestart.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\ApproveRestart.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\FontSmoothing = "2"	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\FontSmoothingType = "2"	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019e180065f1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000691f0e075f1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc6d5b445f1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ed1f2435f1add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
1656	elevation_service.exe
1656	elevation_service.exe
1656	elevation_service.exe
1656	elevation_service.exe
1656	elevation_service.exe
1656	elevation_service.exe
1656	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2300	2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2564	AgentService.exe
Token: 33	4932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeDebugPrivilege	3272	elevation_service.exe
Token: SeDebugPrivilege	1656	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4284	4932	SearchIndexer.exe	101
PID 4932 wrote to memory of 5492	4932	SearchIndexer.exe	102
PID 4932 wrote to memory of 4440	4932	SearchIndexer.exe	103
PID 4932 wrote to memory of 3240	4932	SearchIndexer.exe	104
PID 4932 wrote to memory of 5172	4932	SearchIndexer.exe	106
PID 4932 wrote to memory of 3460	4932	SearchIndexer.exe	107
PID 4932 wrote to memory of 4940	4932	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0ca113b8a8ae1f5f71246f77795ad402_akira_cobalt-strike_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1868

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e036bf46e615a90f76f68cfffc9e0f78a21566572ba27c49f845c0a4cc61d52b
MD5 f9a437097959151452817fdc9b9c3f8b
SHA1 84ad1eaff89b10de91dfa79cd9c1a849080100c9
SHA512 3577a1c76415b4cb6390bea0c536eb715698ab711bee7b2a663127ced9ca769a79d92129285c7b0264ff8187075fd27feab624817c29324c2d601cdbbea67e74
SSDEEP 49152:lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxntLNiXicJFFRGNzj3:73q6mjBS7wRGpj3
TLSH
T147D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2cf6fecaea3e4dddacc6d7d21d8750668b486b7e0341766f314a3c8094a509cc
MD5 7cbdac5e82964bfacb12862bda00de46
SHA1 bc30b336e456afd26de1b1a63852f82ec1c8dcb4
SHA512 f7988c8c7d067e5f131b1d85950dbf9003cbc188627117dea5052295099b3d8c4e3593301cfc8c3367b41f0138e7be80417d50d3db7af103d22cc270013be92c
SSDEEP 24576:yXYfDtczA2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZtcbLNiXicJFFRGNzj3
TLSH
T1A875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 34ff368ecaa82c8efd426ca80b5477095e81539ed20b141903a27b987263e0ae
MD5 bcdaddcf3302e5d885472c35c55e7f22
SHA1 c069db00a57716a35f40e1135a3e5e88802efb5f
SHA512 a62c20ed0d237148dcf873b4557ca7b185e5e4a1d9de3b4b62fcff191573f3fc047ecf298f0bfb16c724ffa21ce22eab5dc18af83476a46cf0f4052cb3ca7c83
SSDEEP 24576:10Le5ji0hmxhrM1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1Pji0AzoLNiXicJFFRGNzj3
TLSH
T141859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b618e609a6c5dbc73bc5bb051077cbf320ac2c2ec031dcd20a3531df9f9235e7
MD5 e96a6cbfb28a627a78bedf9728d92254
SHA1 a8eb1b96e1184aef4732a0981e68c7085b4ca5f1
SHA512 5f77889e5842da805021c384b13bd3b38d504beaeb3463771eb066b88ebbc81f624580dc9938b6fb9170bf34112553ab1e52635c027ebb7c068c1d2c7ec6208a
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyuL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/ezSC6vUzPv+HjysLNiXicJFFRGNzj3
TLSH
T109756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8a43b6890c5ea71e1b9fc0e731fcf0caa0562d03edb8b9e34ccf1032b0b6e3e2
MD5 ddb1bd17381ffd4c37ae178b8b2f24e0
SHA1 351c4135d0a61e2331b918d6896f2752ca5bfc11
SHA512 df29f9ec2b65d9abd4e31e867f954564ead65fcb57c0560e6dd5374208d53cc486de2aa3d7b3e3362a27af0bf70263e3c5ca680ab03a9d11ee9df82bb5389239
SSDEEP 24576:HVbqPb88hv/l+BC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HVO88hXl+ILNiXicJFFRGNzj3
TLSH
T191559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4e58a940576ee99b0320f7861f0169d79815b750c3d9aec8761fa442840a90fd
MD5 b87262b1f61a2079704bb38e1e7e634a
SHA1 1b8d86204e8afa366986b9dbe617b8915af534d0
SHA512 d9b2639562ffe3fdd1e6e92d4e3bf7cc262bb657edeb0abf99bd7011d87e438fff8b3c63d62cd1872ad869480eb60de9618fa4f73aba19d0ab28ca9c80a246aa
SSDEEP 24576:5Gh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+LNiXicJFFRGNzj3
TLSH
T1ED5523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E923CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 33c2493f70f6c0be4f6da76bd26c4274ac26ad7adea0e6a1ab5c4c61569e1c7b
MD5 322465afc9f507d493151092956b8af9
SHA1 713d0b49b093f6978d2c9e35cb0be0e447787c5d
SHA512 bbc85e17d1f1b755020c9f13d7435b775ecd67219732d40f04e2a6537cfaa91259cedb6045a356d455b451895e68edede4f8d4ab7a8a7ee7137bf5f160aa78bb
SSDEEP 24576:rJIUq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rJIUqLNiXicJFFRGNzj3
TLSH
T1D775CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e961ce0c7f364d8b8280963a2b6b1675d252388718fd41414033319af9967f6c
MD5 dd652a0a2bf61045add96180f1586376
SHA1 0016e594ee1e1b92b6d6fe0e4de6bb3aecae6486
SHA512 4eb4b9912149dfc4d611567ba87ac64740634006a9caf68ddc5575324b21a309b021eb50b391d41e94aeeabd19df2234de1430fa8b6f1a34e5918c24345a3e97
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THk:pQvGAdlCEL8c/WRNw5C77wRGpj3
TLSH
T15E266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1f4ed7c8d439534f4cac09d4e054fc25740ea7c86b5a8580f00c1178cc487bd2
MD5 486352456a9570d7cf2242a03c5edfb8
SHA1 86af2cc14ffdb19bdd137507ddef96fec60c3d9d
SHA512 576ef0d356723ec244e1d8043a472fcf022ea06082ed08b762bcf0206d72d40c0792527c1148108e5282f8118e370bd4c7158e84cbec5dc392255a68fb1ed5a6
SSDEEP 24576:ZfewsAjY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FljYLNiXicJFFRGNzj3
TLSH
T1C675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9a0508fef81c47f9f19e7fdb46d050e1cd81bba250bcdecbea8ed77ebe358992
MD5 7dc536e3d37ca4e48e0d7c40e29e7d43
SHA1 6042395f3ab72e5954d9f6233e6896cb113c3444
SHA512 2bdb598a11e1666f9a87291467075940bbe8b4d798031cd0ca2921feeace50b3d66ed35e971de4d41492fb7c9dc9cd92b7902c823ec25d97d85df40fdd7c1655
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHMF9:OUEtQevvqc2W1cpV20I32w9
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 85a705c388b19420ae76fe5ff1df2e04c6ac9707bf8641f01ba8489314f2e764
MD5 1f993588965e796af1d1f32dd4f3e58f
SHA1 0e688f91fb485a401cf2c6471de597e1a4922d10
SHA512 b9d5b8ae09ad93b727234c99bab8931a6c25c58ca90fb82ff22c1e9102bb0011954fddee24b4ed33f96c6cb5c595667bacb9612a27769cdb4e2c2b52d796aca3
SSDEEP 49152:2CbRquA/m2yL5zLfFiV+XenmE3/z4LNiXicJFFRGNzj3:7oq2Vjnmv7wRGpj3
TLSH
T1AFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f6e0a55ba2879fb41068da038d693f3e807abcfeb291a9773a9b2f29b5e45695
MD5 bc7455fc0427a1cd7c28e101933b2544
SHA1 4f929b1bcb9e094a146c6750eae6577fc25b757b
SHA512 b9146e4fa6019473dcc54cacc8c3869b5da2c6a2912c538d3869a05e767c67ee985116ba8cdc0698011f0a9beeb06128ec6d5df41fb33a6e9fb509234ee2fba3
SSDEEP 24576:qAhGL6IFoiwtA5l7S53P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qAM5Foiq5fLNiXicJFFRGNzj3
TLSH
T157359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0ab7ea0db5ec3eb569b65357f15e17ddd5425f6eac6ad0183dd1fb53280d74ae
MD5 b8d40a0e60d5170142405571db30e5b7
SHA1 1c191c648f055007f7ee8322451c2a3e1d4718f4
SHA512 36c8fcf5c5294521629fd2f847605bbc746b61596546b326c820095904f9ae10ee23769c20a1092423a400bdf7e814633f3851e9c788302f575ecf215fb5dba3
SSDEEP 24576:ZwuROWM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZwSOzLNiXicJFFRGNzj3
TLSH
T18965F08632980CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 902183a2b0eacddaad4b1f8b6502eeb39330718a05284cab7505709d798a2035
MD5 974cb5cb5564d364f3d99242597f33ad
SHA1 9b68357b00dc19a6e0c5045e8319fe6efff45cdb
SHA512 6d64d1f6f3e159779cca13aaf7237a1214e0ffdeb2e80c445f1ea34107944425ace939d61868d5407c24cd543e577a3b89494818c69a735a708ab94548a1db8e
SSDEEP 24576:QZud/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
TLSH
T19B55129622C820F5E6BB403DC9B54504E7A17C2A573643CF52242A6E6F36FD69F39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0b54900db55b30385020616e033bb663917583978f091eac50f6a61c8f2369bf
MD5 1bd7c59302784c435e76ee00f80b2913
SHA1 1f6b9f1ec897ef2d0ee7c7dfa7d09d0bef3ec6be
SHA512 8a84a8f2a9a42317094281f50757f659cefdcf5b722e234d1e6d726bf6eb6d80d8ce53d312cb96ba0756a31f7dab72b212366bbe070c2574948b1cf8cbc01045
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:9QyiKanX+PNiF9
TLSH
T14A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59a9a3dc0b81b30c2d3d59f5fb793bf4c2035319cd6fc270a73d1343e7839c3a
MD5 6ea7771a597bfe74d9d962c9ca40d619
SHA1 4d44cc511fbe454472eee0bba3c7b35bbe6563d9
SHA512 1026ea552f4454cb316b176e5e68c53acd344dd48d2590cf11212427d6ee2706f8439159acd88637b48c9e784fff585403b7530538a22ac5cb962436f2167b3a
SSDEEP 98304:jQRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:yQyiKanX+PNiF9
TLSH
T18D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4cc5458c21be6b6c59fcf0e516a9c886b66505a8d216b1529cb4899321d7b584
MD5 4e2fbb1d6a6c49a77f61875549d2a2f5
SHA1 5ed555253910ce015265cdd25f0c0b313def062b
SHA512 6bd205430670f581d003a6da88fccecbcb3d334285b94714a736d737d4d9ce336ceb5ecf02c38127efced1a82575147f456aaf687681d7a9b1d1c5f71d8fc77d
SSDEEP 49152:268Qg55nhkeWu7PNU3/oLNiXicJFFRGNzj3:UthTRc/o7wRGpj3
TLSH
T158B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 826c8654cfb140dd5aee98298d54236cde5282717727338a0cd878b6239ca5de
MD5 05f10dac6f5281b680d65f35b55004b0
SHA1 992c953c62bb3845b024b095b9774692e783a127
SHA512 d95fcad780b342449e3ac72a87dab92effcf23261987722cf9f6a696e95219a409b527ed6c048071ad70629cd0c725765062668699dd74e0e32f1a47d2012c95
SSDEEP 98304:zy5112gYy5azzVvU69nLKnhZh7wRGpj3:OLIHRWh7F9
TLSH
T1C6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5821dd439b55b5cbac1fa757fd85901b8725ecfbfa084063251986d2fd608046
MD5 8303d27c9852b38e0500b657f6202012
SHA1 2a2a9cf0b12a619d553fd6dbd9cd3e854cd921b7
SHA512 3eb0326512da1e32a144fb05e0d6c0c4204d102ced02299185897a4cd4522af0f9e88973ef14d29513f9e9cf169442c042e10c85711a85d3cddc2a75007fcdc9
SSDEEP 49152:QB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glGLNiXicJFFRGNzj3:Ku6JmIxd2dG7wRGpj3
TLSH
T125D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e446b08cb1295b2e750282a935dbf8d5c9c6860a54a06bfb0cbc43be8e226cdd
MD5 a89913308a52ea19bbdd47ac81aebe7f
SHA1 8f4f5acbb97cccb49fc3e03c45df4418a2698675
SHA512 112bdadd5f5eab1142ac4c1b37f673a9bd13feff5d48c3e751c184674aeca6db974b26276acda329c6dc1acc9f8b69a91b1e73789ad9101198695e70611e3c7b
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4xKLNiXicJFFRGNzj3:ymifPqRv7wRGpj3
TLSH
T1E2B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b177684e8ac26de441e1cdefad7ab01081fe899c70506a97fba97d5c3eb8c5bb
MD5 2df349c2cca7d068cf2e34c00d15e42f
SHA1 e20f206013eccdaae3048c4e1fbe5280ea3ca107
SHA512 01b823e0fda99a4551aa20b9d741306afd1f0253c14cbf8eea0b0fbaedf8170ace8f6ca798fc74d446245a42da0ac95a0f382f3bd5e780f595ee7b9c09c4671c
SSDEEP 49152:ZSuZQIY0Be2KkRVtOnks6NMHqdLNiXicJFFRGNzj3:35dKqi61d7wRGpj3
TLSH
T1E4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e8bde9ab4c7d9c360c33a29366fb5cbc76174302c062f17d5dd3261de1046645
MD5 5a0259912a6bb637b316e613ea09174b
SHA1 4cbd3b4391bbcdfb6c4c7d3be50d9fd642e8f36a
SHA512 0c8a4f87ccd056c268edd7c8aa9dbe8c51094de80ffc7a6d1579ec48fe33835f614b55609d44bea1e68da603131d3b23715046d67785ca1eca06608d52423018
SSDEEP 49152:/htSn8EApI0figjgiDn0AP5w2LNiXicJFFRGNzj3:uX2iWphT7wRGpj3
TLSH
T10695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4909b4d7f0abed233957170ba0b708e70b8e4fccb8501e1d35189e1d76eb2842
MD5 b40ab66c8287ebb334df1bee26fd1d06
SHA1 0a0ccd23729c8d3b12c502ad5deddff1377c644d
SHA512 a632f3fdb148766abc168db9d8caf5b1ed32ffbf76f1b6255f35307839932294555a23472cf3176b61b0a6b53b7e9cbd72f5d39d9aaead60fafef0af72efda9d
SSDEEP 12288:yFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3558955B1FAFC0039C6764428F5882E2DDB5618E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 be589a32185062a0c1a641fabc5a6f9798f2e038d55d65635178d1cc16cf6f0c
MD5 19488f03658bd781bc4cb6ec009a311f
SHA1 f7424a2b2a3e894bcb58f4152dcf17c6956a93bb
SHA512 7448239d4c685a59a64bf958d86c4b15d65c001787d95eec9e3a6aff0d8f36e775e9e4db7791d17f4f0e3f6697fe300a31fae7e5d45acc3ab2a44b3a117acfac
SSDEEP 12288:NCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D3548955B1FABC003986754428F5882E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 40919c9fb5c176b3954a5b8d42089f757aba13f981f588777148437f0d3be0e2
MD5 4ed89e818586495b142aa7ab10eef5c0
SHA1 995f05d3be0c2953188457038d0267af01f1b46b
SHA512 ae9bf8922f3e8b54ec43a308e144b0fd7c46137aa5c348c562cdc9484fa89f575f397fe89505284de2ba4068213e5843ef8758cbcdd1d70628d0884f74912718
SSDEEP 12288:IAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D3558955B1FAFC003986364428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6da9da3ead64663a9b7489d2d14f726293a512f8e69a3e0d20dd704e04b45d98
MD5 dff19d6ef558b7d1a1d986d44064f411
SHA1 69aeb757d553329e0f5c694258c0c633302708f2
SHA512 d4c5dc4bff7d8c43df98c666b8667880ca377569e8497549ab36b1deac4ad63f44b455994d98aefc085df4dda6d73a9c690b74b10264e3e4f5570d6352e98d25
SSDEEP 12288:AV7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB552393168901F1E9F98039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6a5a9ca66343e02ff512589f20162d4fdf7002f814d03770dab1c2e31db3c74e
MD5 57c30cc547a65e0c707c863b87ce451e
SHA1 1271715827cf844678d07343d362a98a2f02ffe5
SHA512 7ea50e8e3adc05b7618787036b44663255e8184a53744a27a77faa8b5547ef56e9f2b9650c500b4c72ef60dfc87c4eac9c22210dbc18b220fa415f63caaf8679
SSDEEP 12288:kziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD5523D3558955B1FAFC0039C6364428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0a224c6edf06ed6f076a30bb2171e98aba2ed4c72f5ca3945d445a87d6623a6e
MD5 4b9848cb4f9fe9db0abff44862b6a0a3
SHA1 ff2850acbcb43e73875754f5946ee2403497ec76
SHA512 16b7548463453ae805532a1e2f7505fdd91d0a6750e3ae27e86b255ed436942331f029b00a30b83e2ed70851f5ddf4098ceb379a819d0a2a7707760f1809aa14
SSDEEP 12288:O2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1845523D3558955B1FABC0039C6764428F5882E2DEB5615E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fda22a67e9a7712107ff000b4d38502834c6a0811e174ec01f89bf6bcda57258
MD5 53f33591dda516766cf4c4ee0fd6f447
SHA1 a2cb5c6636e14b0771f7518f770e528e10b07a08
SHA512 9f56dd65ed7819c0d96f25895c9676f28c2f0e5de3a037524dd74e35da47c85927aec122b9969de7bf7dfed1a71e19637040d13ee3ea6b032cea6d7fe298c280
SSDEEP 12288:b6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3558955B1FABC003986354428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e59f878a0ff8f11bd77ec91a6547f03c8b7590a716e38d51dac69959a8ee4421
MD5 15390398450667a5f1837545e7d2bd7c
SHA1 ef3be71a17848e9261988f22ffc3db9237d706ed
SHA512 baca64e7d883ee39bad37a4af1133b2233e8edf573e3bee9a5188b7795df655296138f719f2f6441b8613374be696c6581569a732fd4b22bee9d5ef916213433
SSDEEP 24576:jZM3zFVSOk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jZM3zfwLNiXicJFFRGNzj3
TLSH
T13A750195B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6031366d7a233352ed95b1c4d79cb022a4283d2353f569106102f3f2992b8ca7
MD5 ae8c1d1e3ccb65233899499c49f5862b
SHA1 20fced26c96e67fe2b9cccc75fffcebac528dc50
SHA512 d7af0e5796a38ee9c10dd8810f30528ca67f4a34b35c114ca6e00c6d580a0ba14b108140f9097044e4861504edbd8900bb0b0a24b2e4e970ce8d50f4c4a97bbf
SSDEEP 12288:KhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3558955B1FAFC0039C6364428F5881E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3d7127ab986d7bc0ca9a742ee77de64ebf9c346dbcf5508469c3e8f93eee3c73
MD5 2c54ada20e99fa53b6bca47b06d5be8a
SHA1 016ee7a8c58e945aae279c0da0d91b0ebae654b8
SHA512 9b7a9ee7b27873edeb7152814fd6bed26c55af530176f8a87b27179834b0622a196f1f6dfd454bb0f858882714913f0881ae7679cae743dd09d4120d08fe0d28
SSDEEP 12288:7NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3558955B1FABC003986364428F5886E2DEB5615E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0d95d5fa7a5e75a4aa086ea343613f5f5c0414e1cacc8ac06dbb88ae1345a056
MD5 3317ee5f1da22ed7c999ce1b3862d7a1
SHA1 eb408dfa36eddc09bee4500c836486bb2a9a1218
SHA512 12407e75acae1cc3e12b802e741ae307e65cd73b80af7defea13a69034ec688654eaecd969adc94bb575b105af006dd50bf0060a847b3ad33f6fbab9a222aada
SSDEEP 24576:izyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iTLNiXicJFFRGNzj3
TLSH
T1DF650247629530F9E17A8139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 47f0f54dd3790bfef7bf2ee0e7e83d3e2cd30b69d1e577f50f95ecd12858605b
MD5 ada2e73cd29e5572cb791533f3ec2d86
SHA1 b4a7dbbb7d1733b758c073738113d7bf4a635a41
SHA512 92b8c4589fdc2b5b24da2b2dad8402571afccdbbcca31b60b9fd550ad664eacb07cf0a645c8e76492cb165794b7182ee713ad36c0c1fee2f0e0ca3c61ca9e478
SSDEEP 12288:khiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D3558955B1FAFC0039C6364428F5881E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ecaf9a8011fc20ca61e4d50a583f6200528d0dbce9bfd8ee49599ceb8afde41b
MD5 fa35ba5f7c79b54dda702495fbf1b015
SHA1 5d00c5dcc3d28ec02defdfbb24fe022cc6a1f8bc
SHA512 c891a90c8c6f35c5d29123de0739bd27010c1299cba4b81e12c898cfa7b39d378c9f9c04f15871e6ad2abfe625c3dde8368a75298d699560bf730ef8ce3f2010
SSDEEP 12288:0hiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3558955B1FAFC003986354428F5885E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1d9b4e502364d7d73cc1787621e03529371e4b33d1d2401405ceeb59925d9b40
MD5 1eaa56e193e6a3f316d08870451ef02d
SHA1 b3adf5410072f57dc106c380e683eaf90280bd15
SHA512 8e42232b60c878dba7166bf0b0ae2acd2c1cf774b0ab3e2380bf74b28664f35dd24ef9b082772566920f99732f37bbd4a9fb1660013d0b8aeca5659994c11a15
SSDEEP 24576:3zyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3TLNiXicJFFRGNzj3
TLSH
T119650247629530F9E17A8139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f082f02111191d2bdbaab684c03bf05a6a39786e3add64e96d31fb2d38e920b1
MD5 7ecff3dced9bd1819dd451f0c32f9ebd
SHA1 5cefb15624deacc5925656ba0600f89e0b86a87d
SHA512 ce5026360effa800d7b3d068a11a34a9df2c18b02e6bf7fa25501963ff094be9db70f35eefc25ac1953737effa2677fa165665dfd96d606d996b968ed77500a5
SSDEEP 24576:UT8aLl3z0zDi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UT7LljLLNiXicJFFRGNzj3
TLSH
T15C7501A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 49e5e4e31c30800e33ebf312e743f3d5a65dd5e5d0d2e98f5c48be78d1af7852
MD5 5178c0f879f6cb8a431665963e7d20d5
SHA1 d077613a3cdbc6c8c21fb5581e17661861e60bf2
SHA512 180be3148ff79986ba278d76dd54dd453d096a389d22ec8d64d8f72f33b2e7a12d3254f0d13244ea9f83877a1681501ae39dd6b5f6666f631d88de5f1123a8b9
SSDEEP 24576:K3rd9CHKy7GZe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:srd9CHKyawLNiXicJFFRGNzj3
TLSH
T1AE85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 202f3707576f4b55fb8db9e440cdd7f3d270de8fe82451f1956f01ad4b83ac25
MD5 85b59029758bc064254db1c5c710b9cc
SHA1 7cd178a5fc200ba8207f480afb42a56b4b640204
SHA512 6a9e1d31413c4f6827da1d30114c282c0cf48a81a33b7c1302283eceb3bbb0a2a124e1f13e37a2249d7a68c97809848450805e07ec8aa5a1a90b194c364c5801
SSDEEP 12288:1giJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D3558955B1FAFC0039C6364428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fd95a962dceea5ceb4bf4e1a973c9cd9d413bd5b100ac037fb3ebf2f3215098f
MD5 b6ca16e7204310ceb73e563c33a37d18
SHA1 9f1f30586f3f02a9eff582140f3fe1630db4d21c
SHA512 6e0ad77edc52ab9867fa8b4660745e17bc37b194a5a26f93207834dc0f50e354b5ce7e266c48099053f95c0df8446fffcfa37ae81d1ec22413f76df6b326628a
SSDEEP 12288:XeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D2558955F1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 02a72e6e5f6655e788812fca3943e2b0744c067a249767247256c4d7bc99999a
MD5 c22174a8ba3281bb2c046f28ad7717e5
SHA1 d2d7efc234dbe7b99c012eaf8ab269be71b69d1c
SHA512 a0d245a998fa8a8ed00175990e38cf5a75128d851df8e67eeb1ff97f800c3b23aabb0e785eb1808846fd19388ca09a6523a20db3d13ff881e79f7dd990e09f5e
SSDEEP 12288:h3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3558955B1FAFC003986364428F5882E1DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 85aa86753aa2fd7e2db3964aef2cf5744a66a5a3b0bc86504b77894aee14a847
MD5 e6d9c3b79258bae42f4cf900749479b8
SHA1 513b8fe916fcfe9d549a10d323fddda3b1272752
SHA512 29a95e0cb57d7b32daa6872dab1ca100bb40e45a089e6c7458be1828c700e77f9fb4f86d6befb97eadb66b869994fd2484dfc692c124df7ab55f4969428d256b
SSDEEP 12288:5hiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D3558955B1FAFC003D86354428F5882E1DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9d003a860018af87c0add2230068f6a9e8397b27a28d55164452190fed9d9a32
MD5 2fe1e7dc6f42d56f295de7521b5ad619
SHA1 936571c70bcfb2581106af8adb9c17f13fd2ba3a
SHA512 c2fc91b0ae9798f20ac149a559657cf369fb664217172677303bf62276c381412e0cc939b389e38a49303218328ce5fcec7117bbd457ee1095df9d90fb7fba88
SSDEEP 12288:ogiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1655523D3558955B1FAFC0039C6364428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4031f4126154198c6f75dc0ac2aa5b80f9002ced1c3a0309851a990e464953b6
MD5 50bd02ebc50ee90205a35e3108689381
SHA1 a54a48f96f6a1b5b973d0667048b57f4a1a1c906
SHA512 9f9410e08086889899b3132d981b0d1ae3b4fd89259208c8def7774197a2e71a076a78cced4ee582b727ebfd0d2a1d194fa62bdec3b9d9c9c6f818e288d274e2
SSDEEP 12288:9ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3558955B1EABC0039C6764428F5882E2DEB5659E3E3043D1EE278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a96690d34d939818ae2129541ff2043d5d7f741622f1c381c619742e82b6a197
MD5 6cadc5126486f8d4526a3a090db51e12
SHA1 e9122f7e9dffac52cc94f53ae04a92529f26a7e1
SHA512 8e6fc98c415acc9db565b6cfab1a54201c8992bf71fc7864ca7140b0d2df4f19e755749cf54de1f68ecc66d7a356e77f04d6048361420a2db1d3fc798179d064
SSDEEP 12288:GziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3548955B1FAFC0039C6364428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 fc764141b50790d0d5e0722153a7612d5f315e841d72b08a3b2ebded640a92f6
MD5 cbeef3037db83efa1ec4a59d2a35ab2a
SHA1 2672b0b3f7dc2bb73601077b75d75f5b6639a445
SHA512 53aec64a5debe3feb1f0a9e8a5e84dcf99d445f0e4211b1e24a7b8354b44f7d05083444a10db69ad1e94183c0c27df51c936fe049d1f737fb79d62d3abc792ac
SSDEEP 12288:yoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3558955B1EABC0039C6764428F5881E2DEB5659E3E3043D1EE278FEB8F38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 f9d00863aecd903aa73e5ced7509afef839ffbc1023ed378e1f9ade6eee2f153
MD5 e0da1e0670c00c08e31094101023dedb
SHA1 caeee766da0097e9b6fcd2f8dd60f763d9c0e1af
SHA512 2b7f09b3a5468b309d1106146275cc7763a252b3443bac46b79bc1fcbddbc85502e4c6eff96fde8f5ec39b8a2710cdf11c224abbe59c2fbc29dfdede965e895d
SSDEEP 12288:rziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3558955B1FAFC0039C6364428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 b0b3030cc160f91dab1f8ced73ba06febe7c6ce41967ccdd0c3f67608c31c07b
MD5 593ea9060a83fc23fe1db517062c3725
SHA1 90ca60067d14132b03ffdbfb0b985e1afd5094ba
SHA512 e36d37dddda8973f8f524a3bca224104a1495ba3751f86b424bd52b276d1562a5249764893a9d7d263a014789e307ce66d76c97a269edf0dd71bacc2d52ea3f5
SSDEEP 24576:efwvzk9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tMnYIBLNiXicJFFRGNzj3
TLSH
T1C185DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1ab3fe224547085973b88b0814e71afb089c03829ab597203625ce087cdff500
MD5 eb16ab10e6501a651afd8b34765cad11
SHA1 f0c99daa0c30f7d938b004e8fc06c53c6b8b9532
SHA512 49ac7c74edd4a21fad952366060b086dcee0e60bafba82b62802d10fc60c83ae015684098531b19145f363f3421cae69dbf57fe6b072ff9039a9a2a365dd500f
SSDEEP 49152:2YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WLNiXicJFFRGN:5ySzPe7wRGpj3
TLSH
T15E066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b07a25c197ba0b2eef1442659203cf9a5da36a3aeed9c22195be6f3a8c37817c
MD5 119498b61270e48cd727a906d93c0d26
SHA1 55ca8199081d5193efb3e228ffb009e60d286b16
SHA512 7a290b76d04a0cf4ecfcbee4a4dcb9ae90c843fd354057fea04765ea41ef5efbef709e240c049ae915c34f575ba7c89ecdfc0789540aa8ee9f273a0ce5844890
SSDEEP 24576:747Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:747JUQjqirIhCnDHUPfF/GLNiXicJFFS
TLSH
T11265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 93fa3edc209cfe169f404dbc1aadfeb0ff675881f6facabd99cc78cad07769f6
MD5 0433162c4e05e5b8ce1d4538ff8a1e26
SHA1 67664d97afd939337e98d69a55d0792e73508093
SHA512 3b707faf681e37a1468d17e12f928d089c89abe60071c467e03e574712138d50f63e29d1b506142c7b7d74c432e5f700b0f99aa05167e3111435b83bf8c12518
SSDEEP 12288:ypsfRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 53a4b9df0388e39c88788fc21e65896b31b9c6a95924fc73db5771321222396e
MD5 8db581358d38123a0c7f6ebc31d32262
SHA1 5a749fe4f74f40cb336aff86c9d95eeb5f186a7d
SHA512 55fe536a50ea9a4fc57b920879ca14516755e5f1deeec55af14e9457257e4d5e3648cfb849fe37ed6ef3200e8342489ce930b30400aa7b966bf370fdd7cfa6a4
SSDEEP 12288:jfJP+LU3fNyydWNx/HKELSRp6Y56Jz85UH4z/OOdL5:jf10UPXIYWQG4z/HF
TLSH
T199252810766AD75FC5AD80321E73C2CCA7707D41EE099B0772C8872FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5a20988d0affb3bc6bfdbb501a118b4cc23e3d9902af471d3bbbb4fabeb5ad52
MD5 5d576dfb0dedbfc78cdf584f2da7913a
SHA1 21922dcdae97638294d6b63198505c0b87166dcb
SHA512 9c9637c42150b7adaca0f123e29255b8394ae6065fac05b5d373bf61fd1221c9396cd011588d8de030cd084eb03af1f75be96f10e40013d01e08fcb26b3d24a8
SSDEEP 12288:9d/HKELSRpQJHKELSRptMpO6bd6M/MlthbHnv+ae63swfvTyPOWcOAMMPfTtO:qMpO+/vcz3TtO
TLSH
T1E155B581A537E3CBD1FB6031076A5B4CB764EC06B7095F26B3C4453ED86AB25A0B83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 86e61d7c9e7c2d7e00a6bd85b4e374392600b9479599e456d246de2f4b959cad
MD5 53b6f32f7d057c52277908d7e35e2138
SHA1 d72c9eb0e67b03b3d76d4a89034e3d5f7e499a1d
SHA512 f70fe8c97162af1c0d8ac12d4d981c17f5905017cbc9e4f3413f200ccfa3e2f1d190d222cefa4bbd74b454aab502611171e6c664643cd5216bc4aa587c27a444
SSDEEP 12288:ZF7JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T105552393468C59B1FAFD1039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f26a37f4ad78f09a592c7ebd476f173058695dd20fbe8512e110c7f2f8f362f9
MD5 c7708c7908a5664f7bff5b4e35b8136e
SHA1 336df2e42504af2ecda8205cb58ac1ea55ad8d37
SHA512 2ec0e81f1d65259765d541067315f5c791b51d2a796b0ef9be76473e0be10a61124666e2dfe3423ffcddeb80d8b040cb1fd2ad5207c4b140090deab420c9b45b
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ygb4mBIBhGFULNiXicJFFRGNzj3
TLSH
T16165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d2d514fc5cd3fcf0eeb9e788e63b21a3f8d5d10239b613ad2e8c79c82687a076
MD5 b16a69d7b8edb4c825b435610b77fb39
SHA1 8e6fe9231d65bc09d340b3e170c33e513a5d54f3
SHA512 54ebd52b7a54c72d11f440fe2d2f0580fcfc01fdcc3bd17977e055f2eddd450e0103b67e9a0a1277a11346ddd7487d556dd6b2fd4e186f3a2f8cf3358066b79d
SSDEEP 24576:MG88u8FpJqH1vzria7/mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v7ZFPqVya7/jLNiXicJFFRGNzj3
TLSH
T15C85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5933a8777f17096832a39a8afed10028221bc94217d3f49b1a17edf6af89ea09
MD5 ef5370452cfe3e4429ad42a5c4b3056b
SHA1 531c4a6f1413c9b239846a66239f228080193b1a
SHA512 a4bfa086633c40a474eaa2c8d6a146e8cd257297dec31a669bd758a20ffb64d58896ffa4f56623ff6ba600f8855f1910bad01ac2018872a4d40bc7501591fe8f
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjALNiXicJFFRGNzj3:6G05lO43b57wRGpj3
TLSH
T1F3D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c58c2c1434fda08670d494d4a4497fc54fd0832ee4e7a8aafc8232c6a3f586d9
MD5 f6f9037af86e04e76b124cad9ba11d39
SHA1 8144fd8fc4b3a4491453330c6655620575af0754
SHA512 fc8b9b93fefa9cd757326c3f57f61126a65e88452a8c301d7243b189b27249bec229d3b95b1cffa4e82ba969ca9d10b3da77b6c552de6e25fe8f5853d5a2277c
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnW/TwSfVcYG3K/cJHlnFR+IGNe8jg:La5POZ3lJt2pasx2+moLNiXicJFFRGNf
TLSH
T12665BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aceaaaa7666b9a5e891c2b7c945d1101bef44b9092b3a673520d9493e00e57e0
MD5 b9d126ffe4c75b51ce1d7e969585811b
SHA1 9484dedd30195fd346641ca5c398b748c841bb79
SHA512 62297e1fc64d708190b84a7f53cf206170c4f6a8b0895eef7820a18c7eac4184b80dcae5e408212e2af07501e77028b2b121b269c9d1961dd6fd6b8994ba0aee
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7Fks/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fNc/zEOVHFDLNiXicJFFRGNzj3
TLSH
T1B3858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6eff4d9bcb261e3cee403bc5dc70be1550c04cdb308977b22abbb10dba516c27
MD5 abe1a8aa8d6a413c1d891a8608ba8d29
SHA1 26ee3076074abaa6f88866f4a4d99e2cb5558f50
SHA512 8f64b69456191d4df25b10f25db0e2141cf36da659d4a5012471e7a92f333889d16c5e4c4bf1776f85ef500050081ada190d5a7db0c60b4b76255bf52dc044b0
SSDEEP 24576:YzkNvNnaFeYhJNtmZBma/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YzMwBtOmaLNiXicJFFRGNzj3
TLSH
T1E455AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3adf3018048207e526b006ff60c2d652a35455c4f4352e107be98c46a5dc05aa
MD5 0c237a404f927c87498affaba6ff749c
SHA1 6eb143fb8183394b4a731f168551107860463a9f
SHA512 d9dce93531fecadc71835c06fc5c380fa09804578afc5fc74b8b88136cc73668ff9700bccb556b82efc36553befad51b4c24318984069352de5d80c7427a5299
SSDEEP 24576:WPUr+NQw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WJQwLNiXicJFFRGNzj3
TLSH
T10C65F16F22DC18E5E67AA13D89828619F7717866071292CF02D0517E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0edaa7f3a9e0f2c5d2eeed8be990cc438b643ab656c2228a01b9945922ffdb33
MD5 0a08dbbee1c5403780aa0552b228e823
SHA1 1f2898b69f6bc0a1a8b90a7722012ac2afa3c49a
SHA512 3e973dad2fb4427ef358b637ef659921348c58ea047b162cd42d1e0e272582a736afaaeb30effcb53dec15f074d4413611240bd7c767f87a9d161639a6a3dd96
SSDEEP 24576:nD3FHshBIYQgAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nDVHeBIAApLNiXicJFFRGNzj3
TLSH
T14175E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1656-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1656-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1656-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1656-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1868-369-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1868-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1868-116-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1868-122-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2300-310-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2300-87-0x0000000140000000-0x0000000140443000-memory.dmp

Download

memory/2300-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2300-316-0x0000000140000000-0x0000000140443000-memory.dmp

Download

memory/2300-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2300-0-0x0000000140000000-0x0000000140443000-memory.dmp

Download

memory/2300-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2412-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2412-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2412-83-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/2412-78-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/2564-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2564-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2564-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2564-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2564-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3272-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3272-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3272-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3272-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3508-279-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3508-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3508-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3508-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3912-67-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3912-73-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3912-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3912-304-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4080-40-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4080-46-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4080-50-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4080-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4080-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4140-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4140-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4140-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-366-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4932-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4932-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4932-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4932-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5996-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-89-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5996-381-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5996-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-95-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5996-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download