25b70575ccf7c2c507928e13eb2d582690d7f9363e5b5f1c28e778e0cfa1d0f4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Size 1.3MB
Sample260809-31lefsfp3v
SHA256 25b70575ccf7c2c507928e13eb2d582690d7f9363e5b5f1c28e778e0cfa1d0f4
MD5 463ebdef459ba406e002bd69e7cc5fb2
SHA1 45002acbda9278e95b424fe7a0d310203f334f91
SHA512 34661626caf942e048f5d881338737d21922ec62419071360dcbffe6c89486a9b7a2a49eb68458f5d34ae4dd3863666543032ea306db2016bbedf135d73d17a9
SSDEEP 24576:UdKx4n0yqC6BsrAHtoAfYLH8AcevDN0FImbwQuq3Wia7gD:wKIhVe2AQgAT76sQuE
TLSH
T1C055B013B24A91ECD96EC07C471651727632B88D47307AEB22956F383E6BDC22B7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5692	elevation_service.exe
2844	elevation_service.exe
5296	maintenanceservice.exe
704	OSE.EXE
1440	PerceptionSimulationService.exe
3248	perfhost.exe
1096	ReFsDedupSvc.exe
6068	SensorDataService.exe
4284	ssh-agent.exe
1720	AgentService.exe
6064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fbd21cb6c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec3e75145b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000774b52565b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000030e14c145b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063233a565b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027c46f565b28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000618742135b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1096	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1720	AgentService.exe
Token: 33	6064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeDebugPrivilege	5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	5604	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	5692	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 5792	6064	SearchIndexer.exe	102
PID 6064 wrote to memory of 6044	6064	SearchIndexer.exe	103
PID 6064 wrote to memory of 2036	6064	SearchIndexer.exe	104
PID 6064 wrote to memory of 3152	6064	SearchIndexer.exe	105
PID 6064 wrote to memory of 5396	6064	SearchIndexer.exe	107
PID 6064 wrote to memory of 2348	6064	SearchIndexer.exe	108
PID 6064 wrote to memory of 4432	6064	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5296

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1440

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6068

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4915cdf7fe6b495c1a5b0efd2027f4c4a3267115e97b5b3110026decb37b90dd
MD5 d52c7510fa4cc358f4a6c6411ae0eac6
SHA1 9d205bacbdc6db71e570208476782855c21ff4f1
SHA512 0cc7597cd7ccace77847bb8346040b4fb21899aaa037d8e282b35d596b5efbb86e1f0983c162057469cd55c4e8fdc05b716ce92c8f252cced1f6dc3a8f86088a
SSDEEP 49152:pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnJAQgAT76sQuE:/3q6sjBVqGsQr
TLSH
T116D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f6d9dcdb27457a6d98dfc2d5972acdf7aa7f6812a0483891c4bae490d27f3bb4
MD5 db0a51a08168a6a5e140bb57f663846a
SHA1 a9b3c66d600924837a5ad904f048e347261f04cc
SHA512 e4b2572dbd077a14900907e6c20fe2effbc6798e973bc4f42abfa2f93a46307ba0bbb4182037177285b2710f1846394835f16a435864848c1a565532fc4d9cdf
SSDEEP 24576:PXYfDtczAkAfYLH8AcevDN0FImbwQuq3Wia7gD:6tcPAQgAT76sQuE
TLSH
T1A475F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 41f03aaf920fc96aab9a721d2431028fcd778c784e5f9165263f76f7e8b240ac
MD5 1bc4510af013b648e789faf6bfa0f555
SHA1 77b3319e16a53a55c472ce7a0bed3c67cfc8f2b9
SHA512 da514e32efa6935e2d028d32d3aacf33ffab0a8fcc40e257b7965cde40b60537a3d54ebf63b912ccc8b5cc20317dc9b8eb9dfc625b93f2dddfd30aa0d0450064
SSDEEP 24576:20Le5ji0hmxxrMBAfYLH8AcevDN0FImbwQuq3Wia7gD:2Pji0AjWAQgAT76sQuE
TLSH
T13A85AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 97d4881b275645f85513b9bcaedc78bcb9609a991d9dfc4ac2b134dba4d1374e
MD5 820478dc3b8aa091c484f0b6a8fc542d
SHA1 06e043a7f0661b4ca1a2a815b4d28d8c8ff10a2e
SHA512 0fb22a34a7178bcc3ee65a6e096813ce1116012300a1e7813eecd6078646648f943b7b79fc7d25be45d62b11b1378d7c6d86b13eaa914c34d3ff82a55eee4a3f
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWn6q8wyu/AfYLH8AcevDN0FImbwQuq3Wia7gD:f/ezSC6vUzPveHjyqAQgAT76sQuE
TLSH
T19A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 afc36c2c63bcf4752cb6450cd0251192ec74e296b72ca6cd91e4143e808e5435
MD5 556171274c6d02ba4aceb74dd13c22cd
SHA1 62ec6769b4a7880956d8168fea75e077da1503bd
SHA512 c7357710c6d2a3a2b575237efe5c5c1f9e7d33a87bf3dac8907464b75ce5f269fb671601e6e1860f1acf0965c58dd1d651f91854005cf9fea836518cd78831c2
SSDEEP 24576:tVbqPb88hv/l+YwAfYLH8AcevDN0FImbwQuq3Wia7gD:tVO88hXl+nAQgAT76sQuE
TLSH
T179559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1acee06b9f1d625c221dd78bf19fd14b3fc44fb5981e4930b8c45aaaf2ce65ea
MD5 36c274886e1748121b01b8b478ae5bf3
SHA1 4e2957c8bd857268adbc38752c1829b9e42bc08f
SHA512 1a1749a1a65a075d4f4e1947b9a25aa41014aa5672d0885b4c9fb0f2fe75ad2cd671262d84bdf7c29c1696b9eb44cd2f47596e3d6edd4256eb4c2691145e54a2
SSDEEP 12288:/LtAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/LtAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E55523574A4C30EAFEFBD1369CBBA5B963D1BCB88245969A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0e85dbc80e22141f957870f82497bc8c1541dd223ef9d0356d2a0340b5ab5a72
MD5 bdbc2565ec5970ad37677158aa074c15
SHA1 62d565557db349652190d8bdb32d007772d1117b
SHA512 e72832b085b3d7b7758ed1cfae6338e5dff2d97801fc49175f30ad8370484a83fae0dfc364fdaab9ee40b84c6a32512431e75fcca80758038ef370d7730f00c1
SSDEEP 24576:MJIUIAfYLH8AcevDN0FImbwQuq3Wia7gD:MJIUIAQgAT76sQuE
TLSH
T1A775DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 045d0165ed5d89ad72c26fa105af18b5d157238ef8dd2e66d107ed639251ba19
MD5 dd33d366c0442f01def45ed577010f60
SHA1 0f56421dd4dfb1b15fa67bcd2b57bfb62aec7585
SHA512 f332efc30b3d5d5abe72c19c0d4e843797b42a23fbd77255cf2e9930c7162bb14af4755e7a21c6016f3a253b46f25e690a50e24f78383f93a8a94f63d1d8df8f
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:pQvGAdlCEL8c/DRNw5CUqGsQr
TLSH
T1EA266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 139bfc2f080d8790015cda7f8d2da59d2d9ee1cab08313a88df9f11573ae9937
MD5 8cf2d9533ee396de99adaa6d48ffcc77
SHA1 871d630f7c3fedaaffcd6d0fc402c39d89cb0640
SHA512 9a32469321705ef971e190dc4ab8c4cfb2616dd35975424bcac500ffb8778589e3ae05ad09d120b8a2deb6ac099c2ab8b26c4d47e2ab41de1850340bcf63903d
SSDEEP 24576:e0ewsAjGAfYLH8AcevDN0FImbwQuq3Wia7gD:fljGAQgAT76sQuE
TLSH
T1FE75E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 515bcd28f33ff4f3968085c08cf9e5c212311009163c55b039fe43928e61d69d
MD5 a934c99755e40653fbac2e19586a5b1d
SHA1 c6e7c393050a8059776014b59b7f776490d0a526
SHA512 d50f943cfc1838d7fccc1c7e58c204b1c0944d088a897f6735092773cb6e49eca57fde2e1a743517efaf27f196e09a2b812f98781179ed423853b5dbf09adbfc
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVj:3UEtQevvqc2W1cpV2tI32
TLSH
T1D0474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 58d53359788eeb770bbadb901af144695b02fff83f832808be0d182458bb4b44
MD5 1053017be48d29abb81525c2c2fdc3d1
SHA1 18c55e69b547fe1af85c07a01ac2e7de74e6ba16
SHA512 2839557936d7bd0840f5d40c0725708cf07267f3e36b80aff5e51ce802a0a74a45f4061559718eebb3e6c2c6797e23440d3c86f304e172401ec2ffe9f9371b0b
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/zmAQgAT76sQuE:aoquVjnmYqGsQr
TLSH
T15AD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 813631e9cf5d5bf069019e9ed2527884a60af76265f8530de45071149fc5c88b
MD5 7f32a434f9678e32c817d5af4bd0912e
SHA1 e962a03414b76d6ca81c438a29924671f54ca3ac
SHA512 6b127665052fe3fe24fed0d99db526bc891dd4883aaaca033d437aac1a2305c23badcfeb6c0205013699d19306f6b905e9474e96addf70b984dc255f18a986ac
SSDEEP 24576:IAhGL3IFoiwtA5l7S53TAfYLH8AcevDN0FImbwQuq3Wia7gD:IAMUFoiq5jAQgAT76sQuE
TLSH
T18D359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f8a849bfb8ef4309f4e171145df0fa8b1fff0118013338efa2fb3bde3d0a9481
MD5 35959cc879ecd04cdb8f7a98fd0bd1d1
SHA1 303c31606c429144758b5a02818c66d2536c4cb7
SHA512 053d8e753512179d577f137f7d70d0d3c38458965e7bcfa0e79317b57e3e693004b9a01d1d5e3faa0cfa4191dbd5aa55fcb2319666931d75ba5ef1168fd42905
SSDEEP 24576:Hwu4OWKAfYLH8AcevDN0FImbwQuq3Wia7gD:HwvO3AQgAT76sQuE
TLSH
T1C465F14676A81CF9E9A7813985A7C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c60519fade8a48347699a39ab73a2ed27a8c6cddf3a958c546a6fcb752dc8ba8
MD5 6ed66ef76abaf2adb87344fdf90652b3
SHA1 a475842a1931b122cce5056a51547dea96ea045c
SHA512 6b10d8d9773a811094d4adc35f52029a2b18c284ec67655645c56beedbcdc481787ffe86900d106de0cfde91cf248ad7e0c9d21dd5fae2a0626ded6ba30bca77
SSDEEP 24576:7Zu5AfYLH8AcevDN0FImbwQuq3Wia7gD:KAQgAT76sQuE
TLSH
T18A55125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 eb5e69653f4eb948d95ff695103180a0babe91a0a2912314443417e8d32b6e1e
MD5 744e188ea978e925028e2d73065bbc75
SHA1 ac6f071446cfce1aae3d12dbc1040d6eca042fd0
SHA512 a0094aac930b0db9068ef95bb53b631ac934ca5df76c08c4a412106f33137883738a3527efeb42f00893850c9f84882f610bec1dcaf3d286dbb12688cdd490a1
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:rQRQyi36YOcPbLvw2gAf+PN3hqGsQr
TLSH
T180667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8ec4b9421557bc5168537fb93396331667f70f1e6a051e1acf199d2a3ce07199
MD5 0c6a24e311e0dfd8b4b57969c70489a2
SHA1 41b0ed9179939c7034c8f024a8cb604abba22e38
SHA512 b55128e2712000707a8721727cb9f69cb29d34c189aa87e41d5625dad1c95e719f086d21f6c8f849b6394baf362e68e4ef1b729208c99a62730a8abde071cdd4
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:lQRQyi36YOcPbLvw2gAf+PN3hqGsQr
TLSH
T1AD667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9afac9f2b53c64f7d85fb947d4830beb830a79b0cf8347ed90f67806a68ea262
MD5 869c245ae83591984b768122efaefaba
SHA1 678124ae6fe417e4f0381ca8f02429bc9afd7004
SHA512 bc7be168cb11da6abfe347b6a65e55b44cc9adfad2c2b6ff7bbeed030cd870e9ba015c060bb252013f17dd2a3ba3ade9384ad9f3742949e57b94f1e77336055c
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0JAfYLH8AcevDN0Z:068Qg55nhceWu7PNU3/WAQgAT76sQuE
TLSH
T112B54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ea1a38398365704467245dc229fa1cec565dc94b98d0de01535bf477bf01ad27
MD5 3073cc7567b2e3454ddd19bf8da49403
SHA1 18d629f5759e5380d1158db798c0986e9ff2a73a
SHA512 567499580e0b158c1c907ff463c8a1d2cb9ca9ff319412f4005b6917e90e954c036e17e18cee18c80b9011ace0fdc0ecc40b990f58e181e91fcbe4e683c2eeea
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99p:iy5112gYy5azzVvt69nLKnhZWqGsQr
TLSH
T103167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 023c54aacc1c27f162ebe828a21750fdb60fd9c134f57dfd970347ce91b83403
MD5 c417cb78b3c4ee517fcc874896566e5c
SHA1 ab09555dc022a2f69867ee17491ffa0c00a97df3
SHA512 87d3c57db43b7ffc84eec3b8eec65a60f97816b4b377023a0002fb9115863c3f6e04a6fad3718e9d7c26bf21aed94eb94cdaff0c33d7d4dd0ae0ddb91b24b65b
SSDEEP 49152:iB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl0AQgAT76sQuE:Qu6Jmdxd2dZqGsQr
TLSH
T1BDD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3c1cb22efc4e723d45ce19eff7a266565e211947b1513f68d484fde1b5500cb9
MD5 8eadbfd2db830a71acd046f9cb26e93b
SHA1 2ac3377c824f9a8326469e6be810f7c5f999b6a5
SHA512 ddeb4b8efcb4f5081480bd0e5076aedc54c366117e6ae868b06fa7df7f08354b9fa6d8b053fca956af3c86a7f625e19d762c998097be02690a9dc04517da388c
SSDEEP 49152:D1hpsNoJpF1A63U44CwH7R4xoAQgAT76sQuE:DmifPWRYqGsQr
TLSH
T1B6B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 db491c553da099b3000b6e4e91edabf34ccdc965e9579c569a7446a37d864140
MD5 4eaefeb63839c8fd51aa42418f928fb3
SHA1 7551335d8592e078098baaa90881fb37bf3f4f37
SHA512 1abc7143ad2108cfd902c423ced91c0b7c9a5c62865bb497f4fa66270110cd385932ccb5c6659d7281d6a8432e210ffc7a2608451d3e85c83971f9533a5eca10
SSDEEP 49152:fSuZQIY0Be2KcRVtOnks6NMHq5AQgAT76sQuE:l5dKii61iqGsQr
TLSH
T151C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 76ab314ab835e46dd40e3c753d754bdb771b3e85d1b277739065af174f40e8f5
MD5 53b052e13e53b8c51f6c67c7628734f4
SHA1 1c19cfefbe43d5733f887af6158b10214e464ea8
SHA512 bb56d42873a1de133a84d34401732c73f37a60fcbd4319e2d3bbcd6db0aecdb9064499e44ca4ef23ade78bdbdf1e3f041a7589f967104f2ac91c3f9f0225f623
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5wkAQgAT76sQuE:SX2imph8qGsQr
TLSH
T18495BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6114c3aec25374d88c1249cd6d8e5ca66160368fed994a811e0dad2edf005a10
MD5 a475da1d745331add7b80ea71224a2ab
SHA1 50f8b596dd6572d296a628b831c19d4a46ee1004
SHA512 167751ad6cdff43ed166ee93742dc533aea40bb00432a8b15bd48d00eedd926644ac447120521f7cb29b2b595a4434e575463f034ebe4f915a155a46fd7a670b
SSDEEP 12288:5FAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:5FAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13555235B594C30EFFCBAD1368CB7A1B8A3D07CBD9346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8bfd02c73e01745be2b5fd0c09b8f7eb3cf60c0e09861049570941fedcb143bc
MD5 299693842ad89a00469d7c359f4ac0eb
SHA1 00e142196c9a58f4d245a778831476ded2864941
SHA512 a431a20be4b583f26fc351f0501b1af2a8e760f04299b947125707d412af34864bd1acf365dfb8722cae677157dbaa49e451b87929e0c8d788e9c646f3bbb483
SSDEEP 12288:kSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:kSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19D55235B594C30EFFCBAD1368CB791F8A3D07CBE9346939A110A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a09ac592910a0e020849373f75f841ffda67c4724a60f9a7075394919b411f45
MD5 5e0e6cd74ab19e10c154f2fccc1cd496
SHA1 587fc55071214c07320acd3529c8d3c99fa7ec77
SHA512 2fdd9e26d2bc946570e8f1de565a885f7e2379f8f3f7e37d3b64da5923c6ccf57412588e490f11d2b25b35f9b68435886fc8e68dd4872561abf42e4e11b49640
SSDEEP 12288:VAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19C55235B594C30EFFCAAD1368CB791F8A3D07CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7c9780df3684c7c4cd95fe1da1854219b2fd4c6fca00c9507056654c7137917e
MD5 d802eab556798cbe2cf672db539a8d34
SHA1 e29cff9d0803845ae22fad97ae0326cf5b7ffeac
SHA512 4202c714ef197955f2883dafe01d12e6691334006eb2402afcaecb8ad264507f59b445f58c6089785bba7a9212d2d241f149ae1d4a0a0d7e0c6cbf8285dd8e53
SSDEEP 12288:CVzAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:6AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B3552357165C20DAFCBBD135CCB791B9E3E1BCB9931293DF06011A8A2E3A25891F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8c16327ed07151e4f906c29e6dd6f9b28a46e3b28818b37a436deefc20c19578
MD5 226415fe3ea6017de9ee20cf38e6d16b
SHA1 92c5433daad7e5bae5a757e9fe6a0aa4739f528a
SHA512 2ff5138d9da1d06b1d4d9f615acbea9c81a871f699503255362b5fbe7919f5b93bd3238e9bb9f3a1055bf2c91c97da69a19ca41d207d0d853931dcf26057f29a
SSDEEP 12288:y7AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:y7AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F255235B594C30EFFCBAD1368CB791F8A3D07CBE9346939A110A2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e1f26253046484e4908b9d4217dbeb27d13da04210f318b7f41f451d9ce5b9ce
MD5 473bbc0a6b639b37ef6d181c7135ba9e
SHA1 b20f83b2e11ac5c130e7d6caaba41ea34d4a8f43
SHA512 c5a35dea6374680ecb90dfdb475b1c5ef2087360eb689cfb5856fd190c69a96d629bec3ac93cbdbbe94fb408f32497e37fff866976049838416204f23c258764
SSDEEP 12288:f+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:f+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E855235B594C30EFFCBAD1368CB791F8A3D07CBE9346939A110A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d8452fff6092d3153a1cc27ec3df7ef1402027e960f712bf00e53b008393a1cb
MD5 137ea1d08d6301f716783afa085b2ad0
SHA1 08e8c3def2dba3d6ea66f771f9a9f05e2a464ebb
SHA512 d5585289c6ae8d2440c1b498f5c0846612b3acc773aa442b7de3d9e3c1dd3ffb2e3e85a528412559e5ad87c693da3341e92c1cd4f1f4176a4490ef1051bf16f4
SSDEEP 12288:QaAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QaAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14855235B594C30EFFCBBC1368CB791B8A3D07CBE9346939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a7bcfed24679f848389310f6bf1dbe2e8c4c6533c31b0b01dbbfcd577909dc16
MD5 124880b78018735d90ba6dce0c5dc131
SHA1 ef3729897a3eb7a719e2bd1f3f737d40ac40af8b
SHA512 7370a856c0b006a973980d9b02ad4d34ccece4a83fea39f7c1f3437fbed062ea453f8adbbffccbb2966381bc3ccd48840a49364420e88604cf4c0a6c81abf89f
SSDEEP 24576:vZMRzFVSOyAfYLH8AcevDN0FImbwQuq3Wia7gD:vZMRzfuAQgAT76sQuE
TLSH
T1B8750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 facc2e60b7e1f29aae2c7362e4cd6851578779f9f780a0fa13fb477c7912f471
MD5 b9deb2dcda39d3d9a11bd00c8407c744
SHA1 71ad9a599eafc5f94fcbccf6526ef1b8a886b91a
SHA512 c0b202b6db6007e98609f994c3fd4ca16677e97eee8e75d30e5b308616d146ac14ca51cda488f102105ae47ae96b97e1a9311693d91f36c3f6046fba1f42a2a5
SSDEEP 12288:VpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F655235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 990155e08ded44d313ca1138f83212d8810bb1b7bef97027881711eaf6adf7ca
MD5 bceda8b6346d398555f95420b3238071
SHA1 3419897aaca271d15f32e133cae43e5311550aef
SHA512 4343e69e35da28884a5ac1854e20b05440458704bb30d118fe044d0df4c781d4cc6f8b4a0df2bf8fae1afad48efeb4fa726f269e914dec96751ec2292be0e81f
SSDEEP 12288:ndAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ndAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19255235B594C20EFFCBAC1368CB791B8A3D07CBE9346939A150E2B867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b1da095224555cd4e4a3ee0119bfab5f2838c88ab368c1fc9395f17c51dd6b44
MD5 05a1e0f52bd99f9337ed2d66c604301b
SHA1 e4e8b54ab028352e02db226956c9bfa7eac94d2b
SHA512 60189ac4dda514de03cf2aeb7dbe9fbd18ec062c919750fe3ff41bbfad6ee9366ccc9374468344dc490732e51aaa472e9940a29a76a3bfbd8f90fbfd8021fcb9
SSDEEP 24576:1zy2AfYLH8AcevDN0FImbwQuq3Wia7gD:1XAQgAT76sQuE
TLSH
T18A65014763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5d0d5adbdbc1550971864c582736d547edddcbbb00c83c36ca876ee0e0fc387c
MD5 c524aaf9794667d8accd6f50e0d9461c
SHA1 d36af9a0bfdac20e320723848ef5597742329c61
SHA512 eeaad17bfe0dd1f2f9d146fb5e6e550c073662252ad324a3452a7326872ebecee37c563d98ae1604451e4267b57a06e01fe9b2594dd75239e3028b39ee2e84d6
SSDEEP 12288:spAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:spAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D055235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 598e25ca10572b41814fbb415c52800c9eb1b3de19c29eed97de3a2bc2fccda8
MD5 06b83ca99ae0321afd128c07af91d68b
SHA1 ac37de4672b5acc7c21f1c9290bece3fff352e7b
SHA512 6fe5a5da77e78e3c59b65e7175be4bc6680cb8314163d0cf927a74d818926dad93e80a3a9c879ccd7a72c8cc09f8d9d000ee52f65dcbd64266b28204ce6e0373
SSDEEP 12288:KpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:KpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A110E2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1f33114d46f41464d890e25a835de97fb5262faa5353c9b1ea9cac25e8078f2a
MD5 72791f58678abd490b9b515b83b1394d
SHA1 633461bded7001e889c98377e51f3dbbf3e5f35f
SHA512 9b22933b34f59d21e0525bc7bdb7d31849818f1b92c60c1f6a4764e06f4a211c3cdeb0cfbcbf69a50520bae1fd6e29f8337a5ec86878b64fdcc50719925fa6ba
SSDEEP 24576:Bzy2AfYLH8AcevDN0FImbwQuq3Wia7gD:BXAQgAT76sQuE
TLSH
T16765014763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 28efc4b36f206620ce770a2d2883da8beb2bf67c302eeecb7a4904339e3eb97b
MD5 59977101b7689d962d084159318f96f3
SHA1 4f0fbf22ddf33eea840b41536e76c5c651e70c3c
SHA512 10c748f4f89691b7e40f0a8d085f83cc61c378a06797c7f2fb51e4c5f601c70c6c3b83871f0f8d29c34dfe3e9b2bfd4c6da1abb93e45c23be72a8bdf4ad08cae
SSDEEP 24576:+TDaLl3z0zDQAfYLH8AcevDN0FImbwQuq3Wia7gD:+TuLlj/AQgAT76sQuE
TLSH
T151750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9362460ebdd95ba18adfa620e0518505616042be9ac27783623f673af2f37c06
MD5 80a328aaabe2fa3ad38fbe92fc3fdd05
SHA1 8230965c186bd8b18ff8c2bb50187958591c2824
SHA512 227970e308adfdeebde2f95f7279f980c4a60dc461ecf1e19e3075b59561d100abb68b25c5cea40f8bf1c79cd4e4fecb7f99738873fb0cbf6e98b6a34592a83c
SSDEEP 24576:c3vd9CHKy7GZ8AfYLH8AcevDN0FImbwQuq3Wia7gD:Gvd9CHKyauAQgAT76sQuE
TLSH
T1EF85CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 656ca069cc42a3b468174dfba86a42549c65f79ca3f3420ed0d8a07452f0be09
MD5 44380b09f2916b6438fc56c58e2cdff2
SHA1 7d0bb8408efb19fb1824217756ac4c218ded07dd
SHA512 51e2888b6b2756a34a01067a0ff6d58a5aedc593dc329077ca417c6434e7a6e1081a3f47bcf6dd032dae6a4c03bd6984ec85d73738b6212a7e1e46f2e9f64fef
SSDEEP 12288:ZgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ZgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18A55235B594C30EFFCAAD1368C7791F8A3D07CBE9346939A110E2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b2d8ddc94e068ff9d61f0549adc8819d8f4e27660e5dc591b9cca71f1ee4267c
MD5 68202b532f9bbb3518f81d6bdb2426de
SHA1 99dd71ac4b8d2eaaac09b78e2a8b0e936e7a6b7f
SHA512 1809837fdd083f8e01891fe77806ebf76b784e08f4420fb30aaadbcdf07820ad259e122b8ffdd5e636451fb91e5d8e52a9e3224d3a1afbb055d89969d62a1c0e
SSDEEP 12288:lWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:lWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12B55235B594C30EFFCBAC1368CB795B8A3D07CBDD346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a23b4d128f24c2d2f387f1afb83628a9fee3e8974a7647eff09bf61eb07d731c
MD5 9dcda6923b2871650249871fca635bd5
SHA1 88d7098693baaae468f81828db72d8ace9c938c8
SHA512 9c99990bf5f2f0efe5ce71717f924f7a4b62dca54836f7a822b05410335fac33237a19d34c5514553829cb9b23e07f2ffc670d06c6eff4d13f2392ab00d79173
SSDEEP 12288:YHAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YHAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19655235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A150A2A897E3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a28df30bfb8e5515a579012f1debfcfbc67d36992099555b0e39e5f84445505d
MD5 eb03d08a70545b4278b805e4803dc786
SHA1 1a710ef71a146cc0aca3651da169e74c87420e48
SHA512 c9b14479a532c4bdfdfd80117aaf7422d0062aa2a492d98a88ab5cdd600213c6944070ed22b7a52a42ad5c70f3234f4695a1dcc21cd2a9cb4ffccbc7cf2dc539
SSDEEP 12288:HpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:HpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17655235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A150E2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9a4df454398ac51dcfc0b615c2f6a7a2d8e55dc6048b67477d4a6e3d88a9a84b
MD5 bc77654c4873463ea168b495432f8c2e
SHA1 57ce8a37b0228e5ae1fffec92615300073d9754f
SHA512 d9fcb85f1b4f4ac9ba5d23f43c9ed375e7c461d5ebf1e69738f0211d2d30ee803f274adbbd92b7d938a48ad32263744012bae6b64ff159b251c33c391726f5a9
SSDEEP 12288:3gAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3gAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D055235B594C30EFFCAAC1368CB791F8A3D07CBE9346939A150A26867E3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b29b53eb743929ea7af4ca4c678f9c52bdb387d5dc14703bef502f73c5506b67
MD5 0f3cdd5b5b223bb4ab5dcb88b0f7eaa0
SHA1 38c03bb7cf13c125b9523ffeaecd9ec78d7a3199
SHA512 207b635d58faa02d9e3e20caf012712aa4aba15d9ed08efbad05a42696e37c37cd42a7e3cc88f4e1222de9dadc9c7ccaa0819c409b9b2eedbba8a345c276bee4
SSDEEP 12288:qRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:qRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DD55235B594C20EFFCBAC1368CB791B8A3D47CBD9346939A150B2B8A7A3E418D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 13405bb806cbfec13f4b23d754532dcefa8284625a15bc68a3bf0519aa22501b
MD5 4b2cf8e4a8bdb5ef5a481f4d2d219c82
SHA1 9f55ced990846b7fb34da8cfa78aa9025bd4dfe5
SHA512 be207f170d892a1dce5488b719da9e9e4e8fe938a025e67ca0f8ec33953d4326ed82eb2153c056c827ba62559aade327deda70ea7075ddbf1ed42fc1380a15c4
SSDEEP 12288:D7AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:D7AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14B55235B594C30EFFCAAC1368CB791F8A3D07CBE9346939A150A2A857E3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 871be149bae736b3d553ad5c27fce16243b6c831eba58ac511ca6b721e6c298f
MD5 349a2b148a62eba7221101cc3b08a3ab
SHA1 c67510a1fe4a9378225d78471693c2dc0f448b21
SHA512 f1c1406ff39e1645bff4fb1ccb1a6fcec5f897346ebd8e265cce725893a50394eb87fe0664b1e708d451d7f72d16af54cffea85fb6f3ff4bb68e5ddfbe910395
SSDEEP 24576:mfwvUk9RX6wkyAINAfYLH8AcevDN0FImbwQuq3Wia7gD:OMnYINAQgAT76sQuE
TLSH
T1EF85CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bfd4e0471b2bd99ff07d9b1697d9292c2fc18dde0cf329eba9e78384d1d2bf30
MD5 1199a8b3b560fabc74dc2c6e7b40f45d
SHA1 5b47eb33e37c4b9602bde3b3588a4f1b783ce09e
SHA512 f3b8d9dc8c7d3bcec6776b4a7653a652acc43b2b353c46c598b17e5f3961a9499c90884fd424e576034f4925936183ba6810718faafb8342a7f7c55db7cdb16c
SSDEEP 49152:cYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EAQgAT76sQuE:bySzPBqGsQr
TLSH
T11D066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 46be47719e629851638cd874aa75a58e1d54bc4c3323fe05f57ff45aa90c7bfa
MD5 5ddf94c5707b364b78f946d00c68b8a7
SHA1 8a7db0830634d867e24d449b54a2d7ca63f853a5
SHA512 6b146e40798612bba060daf73c2506bf8e3270fef673e9482850627248686d725c375df7044f1c28a419063911fffcea53282d7592235e1692986c2574b1d36d
SSDEEP 24576:G47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYiAfYLH8AcevDN0FImbwQuq3Wia7gD:G47JUQjTirIhCnDHUPfF/0AQgAT76sQr
TLSH
T123659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c013963553eaad915620fb2366c14de95203cefc963291ae9358fa0c3967a82b
MD5 dc923afea52617e8be406b7271620965
SHA1 ceeb4eba7dbbfbf9c3f799f337f093142019bf7d
SHA512 0cc634d9953f52c0915633892c8e2d3ba732346e7d8dd4858640133e55fd9033bd932af277b1145d89ef432c15ef8f6f25a92bb9099bf26dcd4ea0e335c88fed
SSDEEP 12288:Obsf5AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:V5AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10A65010AD29811E9D4AEA135CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 976KB
SHA256 075431c798ffbf6f15465ba80227de970b1f60299ae7c6dc038129e035b6a9d9
MD5 0e4f0eaa8c6dea15625ba4b92c60c377
SHA1 ffadfa2e3a95b795b7f0f7e03727f94e5e186aa4
SHA512 4f7e1037ab3e1a760be2e75be342bd0a9c9f84f9edffec56ecbc4ee44619cdbe02100ea030c8b87694ee92086e33f99e0101afc73fec8b59daeddcf4deecd9a3
SSDEEP 12288:YTLUzUU3f2N0yPhwL+8Cp+AA7EzM6EJII3iCQ:YXUIUP2NhpwLM84zM6E6IS
TLSH
T1AF251810762BC75FC6AD40322E36C1CDAB707D41EE45AB0772C8472FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 350dbe502f81fa7ba661986ce9006bfbcac8ca29b106828cd799c196a669faa4
MD5 4387f9210736751bbed1019ecc13e724
SHA1 f59f75356023ad398c38c7d7ec14028d3369a2ce
SHA512 97625533b90c0681a3b0f4c96ac21d6c7716666dfa4a81496faeaab50f5871812eca687071fe44444b030b87a01ed40659ba7f47c39c885b65cb48021dcb29fe
SSDEEP 12288:0tMSUPIJPm1PBkczyEsGO5EDPnP0uaPEvPEP80Iu2wqftbzcCBRJVcnAiHh1Ptsk:0tM92Q2m2+D/8r0sBgJ783
TLSH
T11265C8815137E38FD5FB6032072A5B4DA764AC0773496F2673C4493ED82BA66B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0fd568acfaaab102868fa54689a7a2b1cd9e5d6cd0d2157fe04e60eb4ef6d893
MD5 ec153d9a727e996b6b00bedaedec3ded
SHA1 727e95b636f5dbf1b6979ef8ae9e6f096f1730ae
SHA512 dd4a609053085e823d69aed0a3a7b1c394f6ca644748fe7ade444a16486651f52dfcacf5b2e640cce3083023ad085af22ff689e7cc04a6721b2d05dd319500dc
SSDEEP 12288:j07hAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IhAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T116552357864C74DAFCBAD135487B91386399BCBC8700D2DB640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 67ee402fb0d3c1d749fa7bc5ed345d25533a1b5cd460b48026be951d4ed7d6ef
MD5 0512839fb8abc93d717b07b45c5fe53a
SHA1 73599d3093d07637584058cbe608d4473a01133d
SHA512 71bca223e3a68956cc8182e2fcf2bfdc226bdda00cc2bda51f3b2818535c0336382abfeb8b25af3a5dda82723a1885e424e71dcda6cc5fa4fdce3be721c9d7d5
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bY/AfYLH8AcevDN0FImbwQuq3Wia7gD:Sgb4mBIBhGFiAQgAT76sQuE
TLSH
T1F565AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 97a292abe954a8e11d6928369c140da84cc0d05ecfdb56ce6d63c49d79c974cb
MD5 fc69ba9389dc073e0de7e22c608935ba
SHA1 83ba64c3dffd9f7948815044d49e18025db4fc15
SHA512 af47524541e9f9ceab51f0143de00f5a8cfbf54e78fcd3d281820868bd3f62df579e6e62e8b0e95fe87b3f731a54cc114f8195a0e888abf11547f54fa5f0b69b
SSDEEP 24576:jG88u8FpJqH1bzria7/myAfYLH8AcevDN0FImbwQuq3Wia7gD:S7ZFPqVea7/nAQgAT76sQuE
TLSH
T18D85F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6a17e690d04527ebde2fc806fdb6911ed19382a62134997232e4f2df9920d7cd
MD5 308959b3df37eaa58247b64208916b78
SHA1 e8d6229fe7d4d1fba6acce12bab05ce3e6b7adfe
SHA512 b9e402686a2986b27dccddd8272d8c4c6cc060416fb0b7f8e08f150025dae45f25a78dfe9c691fc19517ba5920ca68e876c1020e509996e422e7bad1da5a19ae
SSDEEP 24576:9PUr+NQuAfYLH8AcevDN0FImbwQuq3Wia7gD:9JQuAQgAT76sQuE
TLSH
T18C65E12F229C18E5E676E13D89968619F771B866031292CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2b9dbdf2d3e1198f2bb8a1460f7d11c36a5f5e471555c7d40ea7d1546e3aacac
MD5 b465947edf79f764b3df07e32a35392f
SHA1 e8b7f464a1851acace7d6eb10127ea2dd5ca181e
SHA512 0b6137b0c176d03856423339a1bb2fe5bb8d1b922494128c3c3d8abafe348930ddb4a9c68a62c990afd4509a681119526f1af3f41807059d600318f906f2aac3
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+AQgAT76sQuE:ZG05lO43beqGsQr
TLSH
T14AD5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e0ddb794660b684df0ebfa2a9797d4904f3ff7e138b989eeab811f1b84199b20
MD5 d8b3e60461646b8b9db3d30d7a087a8d
SHA1 c2cfceeb21891b912a5f221864d79e25b1f1e2ac
SHA512 1e0ae170c9d70a4ececd8889db9d7aa009c3729a0969b2d7007b7be47226c2887c1f19708d01603a77c0b81f1eec2cad95afe22db65ceb02dcb11e80cc5f2a09
SSDEEP 24576:Cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnEAfYLH8AcevDN0FImbwQuq3Wia7E:Ka5POZ3BJt2pasx2+mWAQgAT76sQuE
TLSH
T1E665AF5EA6FC00D5E5B9D17DC583861AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 893df296f2644d904b0a7a1b3634d3d4955e9a2fe7c04673dbc9a12c08345786
MD5 9017ce51a5a18b9bdbdb9022bbb44fa1
SHA1 ee8c5146c56ffe0796695aec236d04b1de5d8e0c
SHA512 2d3aa61ac5ab66e37e43a86fb3cea1012e363d58427d6d02bb07a8a647e81477c0b6e2c547c60c6ec89b3c348df96cea9e74c3b02b8414ce265c763f723af8d3
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkqAfYLH8AcevDN0FImbwQuq3Wia7gD:vNc/zEOVHFHAQgAT76sQuE
TLSH
T161857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 68403ce41aa06d808c89cbc51e7e3cdd466164764c63062fde10b7c0cd94eda2
MD5 d03b48796889921e38eb3bbe00eea520
SHA1 9103bddde09d01b49a682653f4f5a6617774ae28
SHA512 a14140c771930d3242e7ee106df0255c2ad07baddc8ef24cd68ad80e447e5b0e47e5c11138770e9ab74847a275bce95f9159ed6e73411df54a8e5db1431091f7
SSDEEP 24576:OTkNvNnaFeYhJNtmZBm4AfYLH8AcevDN0FImbwQuq3Wia7gD:OTMwBtOm4AQgAT76sQuE
TLSH
T1B155AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e32c29981492db3c60cdd61544ceaec6658adf5e15eeea82d66e0387cb836ede
MD5 33fae244881d7d68292c56344e650b88
SHA1 9514a55c1b7b8895935cbf0d1f0e27bc3c88d0e0
SHA512 5ea116d29abffc728b8ed771f08331b3848728cc0660e9996dcdeb644dfc6e122059a281b8c509fae8fc9b7818fe1482d11cc26c4758f8ff6f8f07f142ffefff
SSDEEP 24576:CD3FHshBIYQgAlAfYLH8AcevDN0FImbwQuq3Wia7gD:CDVHeBIAAlAQgAT76sQuE
TLSH
T1A875E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-219-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/704-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/704-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/704-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1096-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1096-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1096-322-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1096-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1096-84-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1096-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1440-273-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1440-68-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1440-67-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1440-74-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1720-121-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1720-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1720-129-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1720-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1720-127-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2844-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2844-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2844-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2844-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2844-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3152-321-0x0000020BB34C0000-0x0000020BB368A000-memory.dmp

Download

memory/3248-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3248-289-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4284-306-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4284-116-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4284-110-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4284-108-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5296-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5296-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5296-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5296-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5296-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5296-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5604-0-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/5604-1-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5604-9-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5604-78-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/5692-15-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5692-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5692-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5692-23-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/6064-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6064-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6064-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6064-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6068-96-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6068-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6068-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6068-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6068-307-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6068-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download