6bf6b75ab0da6e014695fae1d71553b62d3d66db06705a8a492b93e2f0e5d1d0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
Size 893KB
Sample260806-ctdsxsfd44
SHA256 6bf6b75ab0da6e014695fae1d71553b62d3d66db06705a8a492b93e2f0e5d1d0
MD5 304db2715ce97eab5b69be7f0951fc4c
SHA1 690de8d178382d57ff1fb834a05926a98ceb76ce
SHA512 492755eb5ecff98ffb158ef65842806440b765f2a87f003eaf909930958024ccd438d443d70955a92fdb225458a615476413b521956802e9664037501aa1ff01
SSDEEP 24576:jVYEcVWRK1gqbRpoYPV5TFXLw52ztfiH:jVVcV2K1xbReYPTdLwMztf
TLSH
T12615F103B64894FDD05AC07587678AA2B62774C90B26B4FF1BE562353F29AE16F3D304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5460	elevation_service.exe
1252	elevation_service.exe
2692	maintenanceservice.exe
5452	OSE.EXE
5968	PerceptionSimulationService.exe
3128	perfhost.exe
3248	ReFsDedupSvc.exe
4776	SensorDataService.exe
5816	ssh-agent.exe
3252	AgentService.exe
1336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2e7883cce05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007878da614a25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8434aa14a25dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b1b46604a25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	936	2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3252	AgentService.exe
Token: 33	1336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1336	SearchIndexer.exe
Token: SeDebugPrivilege	5460	elevation_service.exe
Token: SeDebugPrivilege	1252	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4632	1336	SearchIndexer.exe	100
PID 1336 wrote to memory of 4612	1336	SearchIndexer.exe	101
PID 1336 wrote to memory of 5416	1336	SearchIndexer.exe	102
PID 1336 wrote to memory of 4460	1336	SearchIndexer.exe	103
PID 1336 wrote to memory of 3424	1336	SearchIndexer.exe	105
PID 1336 wrote to memory of 2856	1336	SearchIndexer.exe	106
PID 1336 wrote to memory of 2056	1336	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_304db2715ce97eab5b69be7f0951fc4c_akira_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1488 1628 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1488 1628 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 20782f7040edc3b15d1db4d60913eb75d2c0494fd98ca160c9989a102c46d8c7
MD5 0b4c2bfdff3d316cdee1736869ce42c8
SHA1 012735c752ae8a22b721bd230e2fd952430450c6
SHA512 bcd57e8e9503ca7bfa5ca6cd2273af2acdc0f8e56e6b2a3ffdc14542b8cffbc26bd81b7f6c1973b57a63e2de2eae07281573e47ffd891501adbc7e4c9312e701
SSDEEP 49152:2b+632BuPkFKRrdE6ohrstBhuXjfS4LWxniK1xbReYPTdLwMztf:o3q60jBVK1xbHLmMz
TLSH
T116D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3d55b00295ee68daf4a15a49714101a9ee45c1390ca8b5c4a6908e408f3a20bf
MD5 7b63c9b504c01ea2c78d074b945c7988
SHA1 cd3430f25b6654a07c8fb0756bb9fc4e30d33103
SHA512 48e3761cd6e2a801cc5424c9691eabf2294e29f5ac0c6f6d3db2fd258598778d78b7596cfcce2d4393151ee69f563bd4c48b970925474e6333c2c515e072bc41
SSDEEP 24576:GXYfDtczAXRK1gqbRpoYPV5TFXLw52ztfiH:ltcsK1xbReYPTdLwMztf
TLSH
T1B805012963E408F9ED67823DCDA28951EB3378854760E79B03E496265F333D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 90f6f0c332dc0acba4a901b7edb5348cb2bb8478e6ab20c9fade302499d83304
MD5 8d4ff7bcb3e437ec7b054d377b9a9dd4
SHA1 9443381d07f8073d69e9a037f6269845b82aefcb
SHA512 c1a4a4aa284bd232412211e3f244043bc4ef0e552e00605381a29d4ec12f0556bc82a6f41b479f0a134d4c753958cbce7baf373456bca7c442772a9f2b2d271a
SSDEEP 24576:h0Le5ji0hmxNrMKRK1gqbRpoYPV5TFXLw52ztfiH:hPji0A7PK1xbReYPTdLwMztf
TLSH
T13F359E16F6748335D073C0B9C5D2A68AE97230865B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 04ffb64e25238b83b25ea1fdf4223d2617d6e9e1c8524a1bf89db4e8131e1f21
MD5 55bdf7f285e009bc381693de88ce05e0
SHA1 0655ba90447af40d2e5313ebc920ce0fea02de5f
SHA512 b8e2ff65cfd42bf175759c0ccdfa351e84f0d5da3e71b84faa0b2cd6a26e62c1b96430d352b83d3bb1f74034ac791236712f6b4929be7a684ff8d5e79491ee85
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWr6q8wyuoRK1gqbRpoYPV5TFXLw52ztfiH:2/ezSC6vUzPviHjybK1xbReYPTdLwMzZ
TLSH
T168756C15F5788323D0B3D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 46428bd37da4b8eeec25f6f7b65a21fa96074360c35fb11d843257eb36386a42
MD5 fa983b53ebfe55556b8555570136bfd6
SHA1 08737960b31ff0cb7dee719d1d5d4d39c0962e69
SHA512 8104fe63c1a9e6038a71f44d5a44ff8117379411540e8b3805f3c4e9d9d84e142a4884b4b491e1d110ecec03cfc03e6ea0809742457020eadb8b50f0ce07e85b
SSDEEP 24576:1VbqPb88hv/l+bLRK1gqbRpoYPV5TFXLw52ztfiH:1VO88hXl+5K1xbReYPTdLwMztf
TLSH
T1CE559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 489f535b5bff60868069e8c9f69b50c7c1f084180ea36ca5a8638288e8aaef23
MD5 aa98d0fdcbb32f31628cc265b16a770c
SHA1 b5b7f41a34c1529b95aead26f1d573a2ec3ba9a6
SHA512 35d6ad6e6a8686bee6ac8e1b7a80c8e41bba8edb22fa4bb84f9aeb7b0521e15653071d7af1837aa95d4e2926add63286f49616d543873aac8773b38a3efadb48
SSDEEP 12288:OjORKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:OjORK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T152C42387479D546BDB3B013AAAF70DD16B4A5FC44D0B966B8A52330BDE707E380E3602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 cc192ea2308a5872025d36e5af107a96938f55c7867fda70fd4355567b6bf0a5
MD5 4898eb607b3824ae31924099ed898ba3
SHA1 58e51856c7efaa10979472199b454d19e4f44ffe
SHA512 52e6bab7da2247f54f9e688ba2ae625056bbe318bc7e0e578dbd62c6e294fa7aa5607aeb4e785318eff784888c9290c151fe622ef99c014a9648a5f9db4efdb8
SSDEEP 12288:7eBNUbTVO86UjRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:7JIUjRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T14D05CF3BEE28FCD2C27E4DB95B918640E76278704F12A3CBD165820EDE236E15E76C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 845e879d6db1b3a8da7cdcdec7cb70ef5ecb1bd47fabe71891bd701e5c4d46f4
MD5 45ff595ff222af4120af9119cbabfc9c
SHA1 aed6e503797c0603826044479f6f62805eab9298
SHA512 c95dbc0b45149e1a358ce4557fd7f912f2f733be6cc3789218ce4c33782a2dd7d4ea12ea3ac317a7f2b0ad0f8dfc0b1d79c375d5520311f6560d9f9ffa50d2bb
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THo:YQvGAdlCEL8c/RRNw5CMK1xbHLmMz
TLSH
T1EC266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f46baea1301e9e75824dc71393a9aca4a1b58ba838e49f43c4ec4b7b0ffd49e9
MD5 0fa8067add719d6994657c0668df3019
SHA1 ecdc339aeecb62dda87541a3c9156fd8115b0783
SHA512 ca1f0b9d64f888f6041f2b9927e5efb81e6b3a6384b07ee56204abf06db9d62df1b804cc79eba2fbe86d3eeb0fcf84c466908cdaf5a261d366dcc6ef1a525e79
SSDEEP 24576:/SewsAjhRK1gqbRpoYPV5TFXLw52ztfiH:Klj/K1xbReYPTdLwMztf
TLSH
T17015E031FE74E036C77F0DB61B76C756142D7A604F521AC3E3A89A8E99302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db2574e29c0a7797fc27a4cf09afdf24898daa972af6f92ac37d442b193db37e
MD5 0a63761a05c64c41516d6f978105ab73
SHA1 04c9cdfc3a6d4fc73900172da3c2ba102ee5dd8e
SHA512 351710ad5067096b7c5d45bcec87945f4eb06d98ed78da7877d4d0a32d67ba8aae38e0c8d327a2340b5c138a5c5939623e1f979faa609b375dca5126196a2817
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH+HLm:8UEtQevvqc2W1cpV2RI32+6
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 358e6e1c986dfbfab2c6655af4e0cd8f231dc35c445820d110b37aea88eb13f7
MD5 57d8e80f10efec59cbc5879084c788c1
SHA1 f71b05fa6945357c41de0b09f01e609d7a092abf
SHA512 8a8c6d5602c06b3015a47b2b0f3b1c7103315c1655422cd9a3de20bddee51052719d24cf414317b2600f4ff714d4c8df6052b55edcb1a74b6edc2f8b52aa4734
SSDEEP 49152:YCbRquA/m2yL5zifFiV+XenmE3/zfK1xbReYPTdLwMztf:RoqHVjnmoK1xbHLmMz
TLSH
T145D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d2a4aeabd71fdb06345b119ad7a71c2ba69a6c71fe3ff6dfeb20d22f9448253d
MD5 345c894f5142fa2ed811896bf3b91c4d
SHA1 15796387aee39e6e170763d8465b3231e724ed65
SHA512 c23f2215f08bf0f8d02150944690c9f12619e73752ff105c6482bde3c7c1d05c565106254e3887653e9ab96ee60236c82b1cd4d8ee31cde115d0185e01ed24c7
SSDEEP 24576:/AhGL2IFoiwtA5l7S530RK1gqbRpoYPV5TFXLw52ztfiH:/AM1Foiq5YK1xbReYPTdLwMztf
TLSH
T17435AE81E7F955D4F5B3AAB899B685B0EA76BCA65E31C20F1150D10F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4b165be0fd9da2f2ca6e7c56f628a0efa113230ee41ec6107a6eb2f5a69050d7
MD5 6fdfc8c561664656b6f5346e58ccac36
SHA1 9db2508f4d33be50d38b2fb03a11e38cc2a662e6
SHA512 a1af669fc64bba115fd7a18e04ea46094fbacad4d112afab92eb9fe47859f756a8e29a76b0a081286e9657abfb14103a5c37dd839da053e556bdf0e8e281e7c6
SSDEEP 24576:kwuXOWNRK1gqbRpoYPV5TFXLw52ztfiH:kwsOEK1xbReYPTdLwMztf
TLSH
T1DE05F14A77E80CF9E9674239C6978576F7F2B8012A25D71F0760C61B5F333616D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fd23685fe4233b117019a236661ad41d3974a80e43f48bad33c27f4674db66e9
MD5 40ba4dd4ff048d2dbacfede7d5cd806b
SHA1 048b2b2b09b22e17784400bf344a5598221cd598
SHA512 c3a4cab1741d797a2e0054fb5f66965389bf7152789be0ad03f64ec23902cbc790e158f22aa3e488440b16d064d28ac1eb7d3fec64cbb681f757c0637df153e2
SSDEEP 12288:F/Z1IyxRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:NZuiRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T182E4128A23E820FAD267523DDDF20AC5E76278961B3643CF0661521B5F73BD21D36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 64b0a6e0607171804da8ad88de512dab03acafeb1c886d929d8380a676a80800
MD5 d5a540f9082c95332d8b7495ddc12914
SHA1 20da7d450e4783657557fc6de5eebd598d1346fe
SHA512 92318e7d0c3344af22f57d79188334dd97452be51f887da06e1e621a3cf801e0e0a2e27c0c6213c7a2e17d4c72424d37032aba6995bdf84a3855656419a4f556
SSDEEP 98304:mQRQyi36YOcPhLvw2gAf+PN3pK1xbHLmMz:NQyiKahX+PNQHLm
TLSH
T141667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3fa4fd79d1e3f41b195c961b77efd1cdf31eb05685b4f03e1e86450bd8505d84
MD5 83356035ed19189f2f28b5237850d18b
SHA1 45d585ee8551e423d8d75a793327713d084c304f
SHA512 c5b574d9e172f7f98894e33f9bfb6e9d2f675f08396f8a80a644498364f5609b995a2739258f31c6e1076c202b9c6763b4f364e6e66b58237c06019477d53436
SSDEEP 98304:jQRQyi36YOcPhLvw2gAf+PN3pK1xbHLmMz:yQyiKahX+PNQHLm
TLSH
T126667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7cc7548ccc387f7dfdeb836793cde21bcdd8212b092d34c3792b6dff70595e1f
MD5 e7ef70394ee2dd5f24a83477d1b18f1f
SHA1 20ec0021a21fa145892780be685d87f4b3ae0a0f
SHA512 752619a86bc1a0276a16b77739a04b58af76c744b64b5dd4b4d5c22b554c3f6daa1a9817e5d0b23a73ddd79702a6a1e6d1bc0d5fd3e5ee97e239760893ead1c5
SSDEEP 49152:U68Qg55nhceWu7PNU3/PK1xbReYPTdLwMztf:+thLRc/PK1xbHLmMz
TLSH
T141B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 34e93937d2143739acef0a6ae12ac35a9e0589626164bfa478e3f7459007b7aa
MD5 b9b99897e28d9451b636b8b5461484b9
SHA1 75d4d782fc0952ca090f40a37172d55ba28287f3
SHA512 2444ca72de9fbfc7ce30ff6b15ebedab8e5a91d0d1cc8894f047b10ba120a90f560ccb868396e5d0d867081786c21c8ed847dc78143cc845bfc8445685f01f1c
SSDEEP 98304:fy5112gYy5azzVva69nLKnhZ+K1xbHLmMz:SLIHjWh1HLm
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aba2f89fb95515e05cd0828f62c67708e4c4efca84566a8adcab3e5afe21a92f
MD5 ae5df22ca81183841814051699004932
SHA1 f159c03605227bb5d918e370bff46e1170f114c7
SHA512 bb7bc5d7b69df3d1931ed56f1b84b2d8e4a6c285a1110b1115f2518e7eef167d6da885d280eb3b2c6ec5580be3662e110667df65ef5e0c12e4a01e11d0e5ce67
SSDEEP 49152:gB+taZ3usBWOBr4tEG20bqx0z+n217aau1glxK1xbReYPTdLwMztf:6u6JmUxd2dxK1xbHLmMz
TLSH
T151D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dfda9207446733f40c57f757f10d4106015966a256ee399d3e14558163c0c83c
MD5 367d90d298f05de2f969ee6c07902b99
SHA1 9388cbca185fa5d9454ed174994c6a7dbb5c4453
SHA512 b5a5d8a02a0a651d1ca2326cd92a6e0621d7f7120c915ba0548cf269e303d440e38065039edd606e6c13a7ca8bb39beeab1240585d81270571086162d6dd9088
SSDEEP 49152:i1hpsNoJpF1A6BU44CwH7R4xtK1xbReYPTdLwMztf:imifPkRoK1xbHLmMz
TLSH
T1C3B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cc6e2bcb7102a40b7d3bf4982d57c679ac4cc6f2545a7abe3828439ee7172d34
MD5 e0670567eb877ef95b16f24a3e6411f5
SHA1 b9f4d27ed2daff0963d251a95aea51c5688e59d3
SHA512 a9ff3ed96470adc855dcd3e7ffa988f0fa8d364fd32c837fc1f67843dacdf9a6f7423b45a8b772a5c6b98deee220643b13dda7ebff50afcaeb1d554682e1251c
SSDEEP 49152:5SuZQIY0Be2KNRVtOnks6NMHqSK1xbReYPTdLwMztf:X5dKvi61SK1xbHLmMz
TLSH
T1FFC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 096a77f35f2469b277b201df7ee69a62af38a4fd3cbcd8efdb882c7fbea65f4a
MD5 04e6b36c5d7562680ee6525bfaeb9228
SHA1 c1c07db27a46f213867a8883ebb80f8d9c87460b
SHA512 2f908b632bb925139e54d4be6a88237aeadb2c74376b091648a8b8f3767cc2455b54d65cfe554f904d46cb3a3c827e6b3f0978d59eb0e1dc852aeec3cafabb16
SSDEEP 49152:YhtSn8EApI0figXgiDn0AP5whK1xbReYPTdLwMztf:JX2iyphkK1xbHLmMz
TLSH
T10C95BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9257b0f94aa4bba99edbd3786dea2f187ac27015409ce112c480e7c644d9a7d1
MD5 08f9a5c8d56425836c3daf30e28711d9
SHA1 7f5326780487c017378927ee2486d6847a1a1a38
SHA512 dee6786fef7d45e9482e0f7735ac3888a786a4702b4176662409ccbf178afe5712031346b8c2e3ce7d62333701afd232e75239a0960c75afafd492d8def736e9
SSDEEP 12288:tGRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:tGRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1F6C4238B579E446BD62B027A9AF30EC5774D1BC99E0B52AB87563107DF70BF305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b9680cadf291bfd5e3f2287bab1faee55558f5b49fd41893a78a8e2a077af212
MD5 5b970b26a041bfe0f8895d65bba44546
SHA1 657f1261acddd6b54478872350e941b8c6460bee
SHA512 12f6183e69032089d342e401c4d230c9d23de2312349e0d7945ded8c125dd7d320da2aa1a49114dcf0aea5967aba7e3b51b7b21ecfdaa34055c9b11a4a5c9e56
SSDEEP 12288:kVRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:kVRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T14CC42387579E446BD62B017A9BF30EC1674D5BC99E0B52AB8B567107EF70BF304E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3704c17e085877bc429dad22fb4a15482ee4a6bb279e830e5d0f18aec7f812b8
MD5 7c9e3a59b73b940df938a2a45bd3cc36
SHA1 6b51268aa1f9c8632012bb237afa10a0e07598a0
SHA512 4bf9d5740582ae02766981b9880b91274ee4638348309b982147224d0d016cf4002ea283471facc8947ef90334d4089ca64f86ce8b48e22afca653f022dd6fc5
SSDEEP 12288:17RKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:17RK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T11CC42387579E446BD62B017A9BF30EC17B491BC99E0B51AF8B563107EF70BE305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3e00e6086919bb04ab326d241c11f0920f649575f8b0407e2052b896e84afc23
MD5 d11e4e10e263ae6603151e4073f785c1
SHA1 bd9a0bc643a4f5ce27aabeb10f1d0d280f807970
SHA512 34eaf473af13402ca71e8c89b9245fb23a913b983eff1223124fc511e89f85624054501df49ee1003b44afea54122fa6e8ab8e012799b50457fa412c1580d8e3
SSDEEP 12288:1VURKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:ERK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1EAD42346579E00DAD927927ACAF309D1F79A7EC49F2753AF8B41220B5E707E219B1F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 546194e07684da097687010a680e41a4951960d6c6f72cf53292f40e3ed15cad
MD5 64293d2df99263338ded545deb912a50
SHA1 566cf71a569eb2cca64cb2b3a22bee62039a30b7
SHA512 c6e6a8afaf1a89cfb489bcfcc811d2e745cc23a2408c36b57a1ca4d90c80941b527d127fd84fd40f2496bad93a97e2c0837a27a7c855c040ea22fd89ee8be9b5
SSDEEP 12288:acRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:acRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1F9C42387579E446BD62B017A9AF30ED17B491BC99E0B52AF8B563107DF70BF305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 15170c091039aa3b1aa4987ff9af9254b40d432656607c29756657553b2194a3
MD5 0eb28fee903754eb30cb55ef0a5465ca
SHA1 96e2f8e101596715a3248e368414e159149471aa
SHA512 80f67924975a7f986fd07a509242eabcbc31ba606fd05bc7e4948904ef72a9a014ba55f52fe5d1e9309089dc3577c9927ebef2406a414213fc7e177e01333e84
SSDEEP 12288:cZRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:cZRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1C4C42387579E446BD62B017A9BF30EC567491BC99E0B52AF8B563107EF70BF305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 306e663e58f135e254ad81fb6ef74780d5f19ed6ed830a61de2d00873d5c29f9
MD5 cc963baa214e313b84c258bed9047426
SHA1 780ce0fde4bd3dab75784fbb2ab9282acba1c39a
SHA512 c69c829a333c9948db82581a0b936970483c0cce1b4e91efd70571cd9776ffca1008b4c393790d7a520537b7aba094ff2a7914fa3e47b7e85699bdd630d49526
SSDEEP 12288:49RKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:49RK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T19CC4234B579E446BD62B017A9BF30ED4674D1BC99D0B52AF8B567107EFB0BF304A2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f8f1b4433e30110a36d5b235ffc741a17a962dc7a84501ff8eb5b6b4369c31d1
MD5 9eaf4f29af4e104113fa5038ee7d53ef
SHA1 76d15b9b8c534a92b5ddb3e89765d820879357be
SHA512 f9091fcefe83045968c406c1249ecde7eb0522dd5986482a53191285b01f6da37fa735a79e64b64620e065416fc534328f1c5cb9005d67c2930e8c8ce9f6264c
SSDEEP 24576:VZMMzFVSO1RK1gqbRpoYPV5TFXLw52ztfiH:VZMMzf3K1xbReYPTdLwMztf
TLSH
T188050195B39418F9EC67823ECD664D86E6B27C5A0B60C61F03A436275F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3128aa6c8586792c1505dc2b454792bebbe60451c0ac67b2ea38a11dea54571a
MD5 48e4ead6a395c8c27354d869e1d16087
SHA1 12a4bb59bdc5db0e1fa4544719bfb8f776195c7f
SHA512 df6aa32acf347857ba4c20e9ce3b0eeb599f8103ff74b9cb04b36ccb9b1b15209152e5705ab3b9dece866292d909a066e5a2b3c29d511704bd753d4bdbc02d77
SSDEEP 12288:byRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:byRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1FCC4238B579E446BD62B017A9BF30EC56B4D5BC95D0B52AB8B563107EF70BE304A2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 600ea5c246522fdb126be4491c8aaeba1904e299940e1d71c7e1021deb563f6f
MD5 d308fae7e0da75f92d60d86bb5af6514
SHA1 383ea1ec2256577c70b57ad5c5ec796008fe8bd8
SHA512 19fb7b9de71595f075c4ceec5ac3a5a3cdd92afa5b5513e9818ebf53dc7251974368c28cf0596e3bc4008497b85eaaea7fcfc4c45bd3290f4c6969413855119e
SSDEEP 12288:UeRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:UeRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1BAC43347579E446BD62B017A9BF30EC5674D5BC99D0B52AB8B563107EF70BF304E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 dab9892f335de30fba34c65b2fa8ecabef80e83faeb82914a1d1df0a0c8a9952
MD5 cb279982af42fb1affce012fd9514101
SHA1 3cbef3c5aa04b345850f0a147dd050e84b7e4811
SHA512 4f6a79b83351b13ac1ce43e28adfcc79d6bbd49f0cfc1eabc8e480f8845e020a0e7546feaa33461e0faad9cfe3379c98bc9a4600c342ac5d4e25317cf4188b99
SSDEEP 12288:myPz5L8xRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:bzyxRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1E3F4014763A520F9D1374239C9A20E82F77678764B258AAF47A013376F337E15D7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0ad99a708b91d3e5021833fffa1d576ae77c8f188b02d90b717e4c8c34417a4d
MD5 0f790c3afe102c19452a307a4f6ee07e
SHA1 94f5f5d14eaa1ab9af4f59ab0190a2881c8f1504
SHA512 6ba263be45d3b6b1c9210000b196e1e0d9c92380ae3ae4b00460beff15a6fbbcef128653e2572c41aef89c0a213d12054c9be69e75402ad7dfa6163f8d156694
SSDEEP 12288:vyRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:vyRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T146C4338B579E446BD62B017A9BF30ED16B4D5BC99D0B52AB8B563107DF70BE304E3A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e3571be5b2075fee3068f703bd98b1b794cc9315996903017728937f8f2f5916
MD5 3808db62bac297d7fe9ddb1d9eea723f
SHA1 e52c96171f927113244846ab131ecbd3190ca4d0
SHA512 cb89403f54b018dd91f428ae14707ddbcd43d687f25e1125a12d55227233af86e7dd4f7ad88ee82e10fc880831f2e7d7a3348fb179bafcd1268ec4cd80577f47
SSDEEP 12288:MyRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:MyRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T15AC4338B579E046BD62B017A9BF30ED56B4D5BC95D0B52AF8B563107EF70BF304A2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 07bce31122a05ba2e95af1488799bce46e38e29c48a89996aeb50ecfd9981eae
MD5 1b786daa1a542368bbd6b16ce379a76c
SHA1 d3dc17f87d0f07b690b12482db6d3c77e5ed695e
SHA512 a33b836af7adc9a7ad37eaf74b190f76beed0e44f68e29c9c272225f9e791236c3df17a531a6d3735cf494623d1bf3a7cfb04f328c2e1b94e065ae7fc74ed840
SSDEEP 12288:KyPz5L8xRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:XzyxRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1E5F4014763A520F9D1374239C9A20E82F77678764B258AAF47A013376F337E15D7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c26d53d4a6ed6d56f27b21cefec1c785fdbf5d3bc228e804dbfbdfbc5478a9a8
MD5 424a6512eec0ae9bf31dd96ec3ee9645
SHA1 736b21938f309a1a421bb817d6bc4ccd12c5eabe
SHA512 628ca4f10b87b2f8aa47fc596c5612052b54911b55e1b72e6f06aa487aa068cf28eaa70ee85d75cc9c8b402dc7d9ab7147421f36200899bdbc209976d6283d4a
SSDEEP 24576:UT9aLl3z0zDrRK1gqbRpoYPV5TFXLw52ztfiH:UTQLljcK1xbReYPTdLwMztf
TLSH
T196050195B39018F9EC67823ECD664986D6B27C5A0B60C65F03A4362B5F333A11C3EF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b16972a518d95b6eb92bda2ae0b1f3f25b5d3652e1a78f9d4c330a83fb0b8e81
MD5 76de7068c78ed024edbeac67b3a7827b
SHA1 bc49d1f444057be5c5460e2832b09ebef30bb92f
SHA512 327dd592b6b9cbdc66df9e10bbf841e051f755e418dda72b907dc132ec690b43a6bcad78e09d38ae8c1d0922be0e475b24fa21b14f91837db5157d11200b462e
SSDEEP 24576:r3td9CHKy7GZvRK1gqbRpoYPV5TFXLw52ztfiH:Ltd9CHKya3K1xbReYPTdLwMztf
TLSH
T1FA25CF90F3E814E8F1B79A358D764511DAB67C991B31DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a6e823961cc492c2a5f7e04394275ed38cc41b3aa9be3091482ff4956365e899
MD5 997550e615eb9a3fb5cd9cd643153c17
SHA1 d7ccf1f3e5cd2cf0318154f1bb5447080a052852
SHA512 c902a38e543f709673e05a9ae3a32edbe9a4e2f1c58bba395a063e90539d06e9b7f501792fca39669c95e55aef6af61a0f3b7cbff38404f8ec234cea0dbe082e
SSDEEP 12288:/bRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:/bRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1F3C42387579E446BD62B017A9AF30ED16B4D1BC99E0B52AF8B563107DF70BF305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 92cef9c20acbf0a386c396bcdceae00bf855441af6c54fd66b94bb15f69c6eb1
MD5 3d33be24a7f1354b38240b5244431274
SHA1 c3ac2c5f5bd8ffa357e7b2ee17d63264b564baa7
SHA512 cef8eafe75ded55fbfdd0a561b77223572709ea952042db1f854dee81c4529b7c5eddd5a35540c483b6e3c51b249bd31712193aa32c76350c4a7efd6a9b7d667
SSDEEP 12288:ORRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:ORRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1D0C4238B579E446BD62B017A9AF70EC17B4D1BC99D0B52AB8B563107DF70BE304E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 34c3bbed3876e183e1aae2d59b4811538374f487a7019ae5881f5c3019d5f172
MD5 a131c3d3e9300cd202ca9419e32170f8
SHA1 061b8d1bc8d336832d2e5387f7b19dd759bb4be9
SHA512 b62413c71b49b9b07cb6b84fdc21d6246e08f2699bb656e7a7c93526fe0338c556f915220d90fdcc44f56dea82daf789faf88819a6fd47739c26d408b242607c
SSDEEP 12288:gwRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:gwRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T169C42387579E446BD62B017A9BF30ED56B4D1BC95D0B52AF8B563107EF70BF304A2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 6f7e10e0581060c418b67a5f7155016ff387e0063043441e0fd5a40885210157
MD5 a25338096a895abe4f2f4b3a08a94a38
SHA1 2841f444e62eeda62933a7d729406ae7468c7854
SHA512 7466ebd3d28edcafb16b4ea04fb83820ffebecb4200aa97bf5a535ce4d23fd4c51a2ee8413e8321684a66e90d1327abb038024daf0814cfbc63a3dd007cde399
SSDEEP 12288:IyRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:IyRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1BAC4338B579E446BD62B017A9BF30EC56B4D5BC95D0B52AF8B563107EF70BF304A2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 154779b958be3d8a3bab7308155cb75de83700f0fce50cf4730eadceb6d2b67e
MD5 e0315b1bd6e976c3f048817123380480
SHA1 a82d2d20f733ad32ba002948a3199e55c878b340
SHA512 56602a697b1803ada3d3e5e1b370066ad8cf17ca35a19388ed02b8e447cfa86bfe03fbca0f922cee9dd373e5dc3e6dcdfcb55c05c1ceb4bb3edba1f74429af03
SSDEEP 12288:rbRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:rbRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1DFC4238B579E446BD62B017A9AF30ED17B491BC99E0B51AF8B563107DF70BF305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e29c5ca05ecc87cfab744f0aa33df1c8de803ac514898c2ee1345120fa72a30f
MD5 0bff57e8d64ce0bcdcd0073f5302338b
SHA1 5632ed496210daf823d1edd8142acdd86a63ccc7
SHA512 ae18bb0836d91e638579c45488ffc2f107dcdd2e7e683d378412dda8a81d50a4c15eb7ab9debeaf1116de602010c5d04cd65529b33217be236546fe4df55829c
SSDEEP 12288:n6RKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:n6RK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T170C4234B579E046FD62B017A9BF30ED16B4D5BC59D0B52AB8B563207DF70BE704E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 dac9296e5b1e6c54fb4baea8302fbddb66ab28898c89db53f8e8a94ccbbf2553
MD5 323c49d488bbdb667dd11456dae50976
SHA1 5726afde612f07377e5d609b41679f879b3d42e3
SHA512 fe91d32fe08f88d3c8f5a4b17860dc90d57674e5560517b79e4a97330525a7f266e5ac96e5d893031231810808fd905d0c9408366716397d3d3fa3a6399f2968
SSDEEP 12288:scRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:scRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1EAC42387579E446BD62B017A9AF30ED17B491BC99E0B52AF8B563107DF70BF305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 95b9aa5419eabef7ccfaea6ca90fddf469519648504bbe7f10f9a0d19cd2150a
MD5 2ece9eb05cc34c281b0606a37bfae763
SHA1 b1d0f31cc122c75a9bfafe752b584bc2025f2b58
SHA512 1938e25c1ff0da4070ee9c10f9b7b9e72219749f18fd8ff09e628679d2c3cf5e3771c0d99cd197a85352a0cdf48297f6216846cc3ce52be00b902ef10f4ba3d3
SSDEEP 12288:kzRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:kzRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T183C4234B5B9E045BD62B017A9BF30ED16B4D5BC59D0B52AB8B563207DF70BF704E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 982982c87bb494a55152ec8872f8cca73f3536937395cb0139a7aa738aee2093
MD5 87bd94e725ad11754560c9a5c00eb3e2
SHA1 dbf9cbb7ae602c2013117161230174aa1197a6bc
SHA512 2560ebdba60b1ae27bdb39ba71c4cdd1de520e7dd54c9a1b3475bca01b93704087a7ee0270379df20ee2b89e8cb2fa946a9f1643899e6e1d477e35069737b76f
SSDEEP 12288:5cRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:5cRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1E9C42387579E446BD62B017A9AF30ED17B491BC99E0B52AF8B563107DF70BF305E2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 bd9948df8416e1f2cf1b3c82a6ed24cea26ff204b522e2dae63313fd6eacb1da
MD5 95a6cbe907af326790f500f914a5ec1e
SHA1 f079651fde231b7f36b6ec95e29e88260e797110
SHA512 9bc440cc003627e516ad6b583512c03455957cd616c23246f39c65cf9f3b5d9b39b3a3e268c3c419b4c53e6434365a053c1701013841535a05c96026b215fa45
SSDEEP 24576:5fwvok9RX6wkyAIuRK1gqbRpoYPV5TFXLw52ztfiH:XMnYIeK1xbReYPTdLwMztf
TLSH
T1FD35DF29EBDC44E5E177923C99B34A4AF6B178591B31C2CF029A536E0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b6fd57502ef8900bed24e831ae55c53f77cffd425ad1fcec45f46b4c352325c8
MD5 25dcef158c00d41a6d24d7162b264790
SHA1 3a97bd289f62a5e363619ee43b54b571ddbfa3c7
SHA512 d354a4ffb6bc39973e0f22a2d51ee14bf815f20ef2de76d3f64afb5d875a161a94ecdd3a2fd2623345d1e91248d73112f9eb9fea7e8cfb565dd274a4b2f8253b
SSDEEP 49152:bYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BK1xbReYPTdLb:lySzPJK1xbHLmMz
TLSH
T1D6066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 85d48bd32cc8e74e0c714656b62268dcd4c0452562a73a524c3c7225518df758
MD5 b78c0564c7e11b7b7ac91c7a75a9565d
SHA1 1ac1b499a43dcfb98150f4dffe948a3e97b5b9fb
SHA512 fa02f4a3f5060e83abe213eed7885e4560bf553c906c5c24c15070592f73e64d0c8525210588a5bc785b5fe1eef095f372ce329cde5c39dc36844e8ad86ad25d
SSDEEP 24576:747Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYFRK1gqbRpoYPV5TFXLw52ztfiH:747JUQj4irIhCnDHUPfF/xK1xbReYPTR
TLSH
T18365AE1EA3EC01E5E1BA927885554A5AEA71742E1F32CACF1270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0090401c425cadad87a8cbcaae1b06f0ffedd62445e8b7e404b7da8e6c389b9e
MD5 c8bcb6b2519724e6e12d4db1ed6a5724
SHA1 2a63c639f1acd5662834f1e4c2bb345769a62371
SHA512 0208b5627f128eec9b379e6afafbbf227d38e17a1d946ef8edbc609089361f0b3bf6b5b2d6102cfcc44931bc8df472813c48aaf0467a6ac87702c5d1bce39a88
SSDEEP 12288:nGsfiRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:ViRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T1C6E4F04AD29801E9C02F6279CBA64A81B3277C6587E2D3CB46D0F53E1F726D15DE6B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 94493ed1d4a79d1980491ab4a0e807888af93f4f0f42ad757fb438d1741eccb1
MD5 43768d540765f25954e3f1756ddbdce4
SHA1 e96ecfb7bbb2b61c0cb62a11ef7bbe4b0b2a262d
SHA512 2f8d375c22b650313ab628d398eb445559bd8f453a4e642b5a853a4d74492ed83cce54942e04e49426af2ddc96e03d9f72194a297b5a8dd984e16bc930c3157b
SSDEEP 12288:mOYR+VU3f9o9uVuzakU535FvzvibqW+F:mOuiUPXUxU5JFvTWqv
TLSH
T11C352940766AC75FC6A940322E32C1CCA7707D45EE05AB0373C8973FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a9e8a9fbe004e4463c76a4d4306600c4220ecfab5e8b02bd308fc717c6da8cf9
MD5 c57e64b5dd4f53996777d9e3c478157e
SHA1 00a883d08e3ed68e3aa2c0cf73d39f1a69196883
SHA512 d3440d60ad45ba828f0db09f7aff55d176a9e257da673e633c23b35de5e759ea0fb503ff4c5dcad6f02ac827f7a6b651b2d28cf0a9c110dd5fa91e9ecce79d27
SSDEEP 12288:aIEHvjWcns08xwH71dRdkjgVUVXVYHOfYj2N:LyHi
TLSH
T15555C7815537A2CFD1FB6031076A5B4CBB64EC06B7096F2673C8453AD82AB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f8a35f6d54892c50702094eaa981dee85527fd3f14136f698e6708d46375dc85
MD5 4a5a75d0b0d569c99dc0a7a439336fe3
SHA1 629f40166351383f35897f220a0c1bf256d536e5
SHA512 426dcdadc8d34d09d4131ac4bb0d91f15b7c6f0aeeebb20ef2e80289c8b480c2530ec2a4ea0c8db81c8178882a6d5516104979e96d7534bf17a937572795897e
SSDEEP 12288:Yz7qRKhecAZVyrbRpoYP5awd5PbFlhl+PMw3+UMoyaYtfiH:mqRK1gqbRpoYPV5TFXLw52ztfiH
TLSH
T17CD42347979D581AE93B12795AFB09E0770E7BD44F0691EB8A053207AE70BE24DB2B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 11d49647b05c23ed9c2ebac18e627328cfe75e7105955c8fc8e803af5afc8c15
MD5 bf1c8c7e70ed3e90f388d3118869bff6
SHA1 25a4bdc3bc5a0f152b59b85ade4f2f2b7651361e
SHA512 dddefa38ec126073eb2928c0f3dac3d3bd48edc9707c9f6a0441c89f88a654edaf1c6c97db4787a42f5b2e75f0c4df483563e1bdf9e03c350d07b934bfed003c
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYoRK1gqbRpoYPV5TFXLw52ztfiH:1gb4mBIBhGFjK1xbReYPTdLwMztf
TLSH
T14F659E1E22EC02F5E1FAD2B8DDA64417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ff7107ebaeff5789cbf808f3f8d4052f98febcfffa1423ba2f5a4e8866516d6e
MD5 29024aeff1a97a7855e13da202f667cd
SHA1 2a7ce9d5a76456f07f4c9c0aebbb1a420871b30f
SHA512 d6a8834675ac15075b9eb07468dee10f28e6c08992b1005bcfc82439ed612672fced2d488153d8043aeedde9629fce01dc4ea8c688da7eceab25524e48ff6234
SSDEEP 24576:eG88u8FpJqH1Wzria7/m1RK1gqbRpoYPV5TFXLw52ztfiH:17ZFPqVha7/0K1xbReYPTdLwMztf
TLSH
T19335F16577E501F1D47BD1388A9246A3F6B2B4150324EBDF07A88B521F23BE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 9900a554da804d5aa869c4f612f2e83027ebfbab1fb4dd21dc0c6e5f6eab6c14
MD5 b45f0dc247864d187ce8d5c58139262f
SHA1 2aea9adfbb8d114c8dec6793d9cd6ba24db74f1a
SHA512 15f4025cb98c79fbe28c6a696857ce7a43b6eff22618a3ce1a382e504eabd1c0b4575b29d6a32524ed9ae66648e36460739c9db70fa98114bb8d57e74123a39d
SSDEEP 24576:5PUr+NQpRK1gqbRpoYPV5TFXLw52ztfiH:5JQ3K1xbReYPTdLwMztf
TLSH
T19D05E11F22ED18E5E67BA17D89924749F7727452071292CF02E1813E4F63EE8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ed95e8a6bea09636897674c4646cc8230f8a55f38ffa3b232cbcc1a491050af8
MD5 dbc7a6937e2afdebcda5248cfc0439de
SHA1 d16cd0f3aa0701c3aef218f130379f518d4c0f29
SHA512 421365e4bd1a02755ea45ee102a7c8f015c4f5d1079160e8af9a0ce4f13a23e1f49c6c13e29b84ad6042fc47bd278ba94f271f7501ca21cc773f03a11aa8cd74
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHK1xbReYPTdLwMztf:2G05lO43b2K1xbHLmMz
TLSH
T15ED5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6530b0e5b4b72a79b55a6bb89d6880698b473122fd18aa41694b27b82b8c6a5f
MD5 8a174eee1fb41cc08b29554163d03b4b
SHA1 43ecd52447c226b925a58103e924445c2aa51870
SHA512 b3b9fc762bc6bd55b94a50efb26f15e1009d204e565f5b2ddc3d9727d92e0fa908a8fdf50f238422b9957ba1a983a0d8aa4ccef463df1fbcefdc3f1504a09389
SSDEEP 24576:ufa5POZ3dpqWVM50JicR2hG0lasx2+47eidn3RK1gqbRpoYPV5TFXLw52ztfiH:2a5POZ39Jt2pasx2+mPK1xbReYPTdLwM
TLSH
T1C965AE5EA6FC00D5D57AD17DC5834A1AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 54b98c4f139014fc43712008e34dc6fb2869615ddd7cd78af729d0a26d6e8979
MD5 3c103c858e186537e31f02a49758299c
SHA1 1f2b81dccc562bc48374cc5dba6d7075070f10aa
SHA512 b3ed82f73fe615c419b0c24b87ff8b5c4d1a404aa012c4d63415b50aac17022d92911efeeebf424d46fb9bff18c2e868ee88486b43032932eb9c1faef89ede6f
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FktRK1gqbRpoYPV5TFXLw52ztfiH:ENc/zEOVHFUK1xbReYPTdLwMztf
TLSH
T124857B1623E901E4F5BBE1BE89779946FAB17865173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b5a7e4e2eefc681f2796fca475aefc4ad11cb0fa03d642df2c9947852c5ec6c9
MD5 6512e603ee7c8152bfd65810593be377
SHA1 0359f96d4ed4cd9d6e70fd98734fdadbac43ab5c
SHA512 19ad97404a858cac94ee383819c7a67c1730294433a1af78ca15342c07d911bfd1779c42ca11757f33f09b8f94ea2e06c69b3d4d3a378651d8a79bb0aa3ef656
SSDEEP 24576:3tkNvNnaFeYhJNtmZBmzRK1gqbRpoYPV5TFXLw52ztfiH:3tMwBtOm9K1xbReYPTdLwMztf
TLSH
T15455AF6EBAB805E4D1FEC6B5CE238512EA727461073293CB4290C13F4E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 31ff5a6fe19b04fe086a1b00022b23efd704cb433e085974c3838e192ca466dc
MD5 a113250dff0583c38db24d810b15d50d
SHA1 2a5dd1f2aeaa2bae4758fecdbe98d876b632cc35
SHA512 388c01769106f4b5d97ca44a7d9c99af077c5a02acf75e483a07b9b5d88f30d4e1c4699b5e04ee685af39f5bd4e376d753b6784e50a085595ccdaa51d305dd3b
SSDEEP 24576:ZD3FHshBIYQgAmRK1gqbRpoYPV5TFXLw52ztfiH:ZDVHeBIAAmK1xbReYPTdLwMztf
TLSH
T10225E17EE79C04E4D57BC1BCDAA34A06E77138A9072266DB0294817A5F67FE42D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-78-0x0000000140000000-0x00000001400E4000-memory.dmp

Download

memory/936-0-0x0000000140000000-0x00000001400E4000-memory.dmp

Download

memory/936-9-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/936-310-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/936-1-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/936-7-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/936-315-0x0000000140000000-0x00000001400E4000-memory.dmp

Download

memory/1252-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1252-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1252-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1252-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1252-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1336-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1336-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1336-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1336-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2692-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2692-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2692-45-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2692-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2692-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2692-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3128-80-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/3128-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3128-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3128-85-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/3248-382-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3248-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3248-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3248-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3248-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3248-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3252-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3252-139-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3252-126-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3252-134-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3252-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4776-103-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4776-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4776-109-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4776-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4776-366-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5452-308-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5452-62-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/5452-56-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/5452-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5460-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-14-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5460-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5460-21-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5460-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5816-122-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5816-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5816-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5816-116-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5968-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5968-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5968-74-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5968-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download