ac2b2f9de943c226acf7877ef7924fa48947452350d10480c12660c13f6dda17

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Size 3.6MB
Sample260823-elndhaself
SHA256 ac2b2f9de943c226acf7877ef7924fa48947452350d10480c12660c13f6dda17
MD5 9c5a701e15b6581f92fccf267beb6f4d
SHA1 152a96a760f28d8a3eb77ea8cf76d31f97199e2e
SHA512 52d5821c3d59b806d24400a645c12b13d6974fb8060990568c7b71b90fcc6014f2cccca2652c4f9c11f7f4c0c6b8c7b1cff00d57212289a4eb0286f7f970f161
SSDEEP 49152:Ma7bBtysaI+4TiVq5oJVqpLOhg588FPop13kjF6p1nKdpIIUwmL3MnVRrCj4yuGb:1sr8Hmp118XCj4yuMIC4Lm
TLSH
T1BB067B127A5BACBCD15BC874830A4A631A2134DB1B26BFEF41C856353F6ABF45F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5492	elevation_service.exe
1760	elevation_service.exe
4820	maintenanceservice.exe
2488	OSE.EXE
2760	PerceptionSimulationService.exe
256	perfhost.exe
1392	ReFsDedupSvc.exe
3700	SensorDataService.exe
5124	ssh-agent.exe
5344	AgentService.exe
1900	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2dff6aa6e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ff09e70b432dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd0ad470b432dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006056d2db432dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c22eb470b432dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000565d702fb432dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5344	AgentService.exe
Token: 33	1900	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1900	SearchIndexer.exe
Token: SeDebugPrivilege	2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	2040	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	5492	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3084	1900	SearchIndexer.exe	101
PID 1900 wrote to memory of 3384	1900	SearchIndexer.exe	102
PID 1900 wrote to memory of 4432	1900	SearchIndexer.exe	103
PID 1900 wrote to memory of 5708	1900	SearchIndexer.exe	104
PID 1900 wrote to memory of 2572	1900	SearchIndexer.exe	108
PID 1900 wrote to memory of 3552	1900	SearchIndexer.exe	109
PID 1900 wrote to memory of 2836	1900	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8cb252e72b538df9509079eb790e451709e67e5c90ec0d15569909a47a2bf05c
MD5 c3b4438d9e40920c2a559690923bb25d
SHA1 4a1dc3bba9df5d548d5663e0e6db6e0994132b93
SHA512 801f73fca709029f94a897042167b7752179b7266f29c1c0e80a72a8773217c1fa61c7b54f1df21905cca7a6efa98d54a507e8e659e8fd8ea7e4cfa7367050bb
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnQQ/lFTjN4:E3q6HjBsLm
TLSH
T109D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 deae31de4c13f533f50f56ac26e63d4d1b7d3dfb55cd24f4b3b10c959815b141
MD5 95185e3f019fe68ece91b767bbb00d21
SHA1 78b3f89cd01f7a72566206dc354a01000a417f16
SHA512 4e1aeef931fdf590c128099674686c504fb6a13a3962d38dd56044c4e5935b2f97366f34aa055cf88ed17ec0ca89152bf4aea73394faaa7b7954fea0bbbaa9d6
SSDEEP 12288:L1XLsswWkxy2lRq2czA7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:xXYfDtczArnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T13465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 27e222ca638abcdf1f8a0349acfccec9360ed0e4bd9807b331b22a906b7ef224
MD5 33d5fc466b927ee4bd87073346ff36c9
SHA1 854666663f507147a7563d49242bb9393056b548
SHA512 a6afc0e0ef7b66149309bf49f51243d3327f4db59df00bcbeaf9ce268a8eb49d4d2d0f61ec9c2a76b96228419e473fc49a1f3aec7402453eb9985e9fadb2ee24
SSDEEP 24576:L0Le5ji0hmxLrMonQ/tbw/2Mkjy6Fr7g0oi:LPji0AlNQ/lFTjN4
TLSH
T1A9859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f7f4346b3dd759ceeda2e066d402e75397342fa34e712a93f93500e37a5b347a
MD5 8bdbeb31d8fa60788c23f9f427982cab
SHA1 fd7630fcc350afd306a2ee5a68cb2ea6e47cf1a5
SHA512 662c06c17f2a8e625aeb6dcdf1baa7af0928b0cd267d79123aaf673eb026fd0204e6558e9192e567da9e491053f345f59b8e99e6cd9a5f8d9e3fc070398e4fe6
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyuunQ/tbw/2Mkjy6Fr7g0oD:9/ezSC6vUzPvxHjyhQ/lFTjN4
TLSH
T152755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4855ca9cad48ff824fa8089b854cc29ff7f318204e0baa90496c81547e9106f2
MD5 20037eb31157d913e3c1b2d10a2d2d9d
SHA1 bff34948ee41d6573d75fd01870ff8c9739029d2
SHA512 2fe11cb8016d7e7477c9280b6ba24f5c05d0cf9633a72d4148bcc3f99442a88986f5ffa9d1ffe277787a9bb5fb1e21c7714d80b0c9b67b3d851a09c59c7dd9ca
SSDEEP 24576:dVbqPb88hv/l+63nQ/tbw/2Mkjy6Fr7g0o6:dVO88hXl+cQ/lFTjN4
TLSH
T103559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 802e16d2a3a6aabf1202734f6620f4a00bfe1a075b713f12b320e70bcfbce9b0
MD5 1bd7e8641143a81760eb7ea17fab201f
SHA1 08bf034e1b0c2e59ccdb662f9ad4fb62fa4017cc
SHA512 3631fc3a12ecac39141ccc5424fe16bc0a515bdde9a21218d43fb9a7aa658a7c55ed8ad59a2b6dd5938c6e0370d99daec81d4f75a1addbaa69067d54824afd35
SSDEEP 12288:fzEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:fzknQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1395523696A14F897FF2B06B15CC284826B7B0DC1BFD4E74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 93d3847feeb89b5e5af16f52d7406a600f264d8ec941b7e1e9d4ef5fc7acb93c
MD5 05119904610898fb366688d449f2de51
SHA1 83b56973f3edf8449d4ed0cb6056d8e37454b265
SHA512 de77ba1eff0f5e77e87cde2d4776d6850d24e0649bb138af4a4255018ac8fbfed467e3b2104c7b98c8969dcddcb39cf3227e1291615eae242f6e0afac205dfd0
SSDEEP 12288:zeBNUbTVO86UPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:zJIUvnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T13975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a516967f296f45b29c7538bb1eb59b14f9647c67958f2955f1867c114f0169cc
MD5 9bd03056ccfdb3242d7dabd72ad45e70
SHA1 349bc25d4dab44212f5499ee5109593b231e0000
SHA512 f0e50308764c5088daa171533c69f81a4f3512a02c741b92d7c4f028c104911387e1324fb80b2e2ae0a4790fb97022eb12d4e8eaf548ccce90e7713c38954cc6
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:TQvGAdlCEL8c/yRNw5C5Lm
TLSH
T134267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4f4b8c5564ad5dba4279769e527d685d8323ec23ba745ac05e839d0cb47ade29
MD5 d5fc0e74ae9a4a2a6c4fd5c332ab47bf
SHA1 556a14735f18f7b99fcd49c3036eafdab545708f
SHA512 1b4fb4d1b92bb483dc5551a2c369dcfb808a770ec11778ff721d7f383cf8d2a38f5606ccf3007818853a769200419dc9da1e94bc1607390b1350d9c6159ec51b
SSDEEP 12288:2AwSfxL/2Dc39DLLmt0LDQewsAjdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgd:LQewsAj9nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T16C75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0da485e8da25957b2ccf1763f5e50740e685188c2b8c4cb4fd7c65c98f450d79
MD5 1020b8d2474402a816a174371184c046
SHA1 12e81cb71e95071c65be7644206a879cc9821881
SHA512 fc7cc42b8be43234701bb28560a3c8628f3837de9622f5f01c9daca11d2337af71abee669c8ce75141253c624466dbd12ff3436a0d9a9fe43515dd44960cbad3
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHKL:IUEtQevvqc2W1cpV2EI32
TLSH
T188474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fde9486c6722c1ce2321dd86a7f27637627deb17b4209cb86e218d8501dadbb8
MD5 8bd4ee6aa6f4cc693e07e19bfaf4d164
SHA1 a1b4ecc1a1daf5ffd0aaf705ed18fa46ac47237c
SHA512 57d18ac27a4b6226963e0cb1d8616600c10c6a107a5aec3a9ad148620603ee3e71c11c2f7c7ad5f592197cbb6a91d4ee54622824a740971c937ff2cc63afeaf0
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zdQ/lFTjN4:toqtVjnmtLm
TLSH
T12DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2b3e96b1a3d2c789f2575ddbf521d439a91242b345088402b052ab2925a00d0c
MD5 4140b5a157aa093e5585bf3e402f4608
SHA1 da771c29a2e8dc9a5e5463388f6097bb878094c8
SHA512 fc6b3a7cdf6baca966a766638cb514abfa45d5d34677954cbe91f17cf7146aad46f5e8b04bed4f393a1060f676cffcbf32b7c47a66b754352086a02192fd6f07
SSDEEP 24576:JAhGLJIFoiwtA5l7S53CnQ/tbw/2Mkjy6Fr7g0o9:JAMyFoiq5SQ/lFTjN4
TLSH
T13435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 39bc6ad66fb3b22684faf52bdba05e0c311a2fca5c3464aa636d47b16c309978
MD5 b2a5c2df2aef15a265d1b7531dbb1844
SHA1 add0b15cc7234a8f243597a6cc086657a9d32a36
SHA512 f44b846451e02eb52bfd51f6fe12f3694f7df79b8c8aeae7e91294f73c94f46ce7a83543d90ead56b5794a1440b3551532dfa72157c4b28dad7b751313391b8e
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+COGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMc:bwuHOWBnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1A965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4401763d90c828e0ea497db7a25bb4a123b1924a826f8a30522b2bdea41fe40e
MD5 a8dae56033df6d44431a579de5590f6f
SHA1 9ca42a296300000fc106df3f4112de306e1a827e
SHA512 945fc5e25174c622a0abb817eb8bb708b5976ed6a0dcd50d78f45f288feccc087b15cbc66afa9cf11f298ffdf44bb773146bc7823519b08ba5cf40f8c0461f26
SSDEEP 12288:/XZ1IyNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:vZuAnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T18955126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 edac449f0d1f0eecc335288ff79b40358edf47714b8781c3836c050df497ff94
MD5 67bdc078ecb0f2321e0f10d3571f3447
SHA1 8cbd7496face09e426d6ed949dd954a202ae1acc
SHA512 0f0330780b9a14a2591d56e1bdf456a65b2bf7932b84e475cb8acf7967214663cac0ffe3ff539b7c8716527b88a6c0df7e7d8278794bd685879e3e75fcde9c79
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:DQRQyi36YOcPQLvw2gAf+PN3oLm
TLSH
T1A1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7b313b4b929113c6a856fa034067227f291b9def89338bc38fac7f62c4423f63
MD5 319f7b2945c4599fc214376fcd5e0072
SHA1 a16ef988fa9f2a0d36eed60a59ca6e4ab7a2dbc8
SHA512 c7de88d5470d55b2760eed5574b0e3c7733e56f7bcbfa1cac7dadf29d819cc322c5887f8e33a161968d56945225ab8c715bf4acb827de0dcd47d1caaae141078
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:mQRQyi36YOcPQLvw2gAf+PN3oLm
TLSH
T177667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 940af310df2e44d44d52f452d4778fbed3f11ffe785087a1fa28a5b6f86ac4de
MD5 a1369a5b57170bcb12f09a3a747ae2f6
SHA1 ca8b028e0a35e06e3d1a47f61ca72f384b3c8593
SHA512 551b642014004d5cf71a15f9dc2f533a0dc723312945aae937725f5a2e6f03c2fdb1e691aac72faa9b26630eb535453afcde62fcea921c124cec284bd3b4944a
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0QnQ/tbw/2Mkjy6d:c68Qg55nhheWu7PNU3/NQ/lFTjN4
TLSH
T19AB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4100635293f84fafc7d1e39c14688a0660c57106b951799719cf01f27aee04c3
MD5 6116a271176ca9dba28433ba5c0383d2
SHA1 8a65c33b611800dc04faa1cf1ceac479c3147d5c
SHA512 7bda08295efaf65aa3e9d0f0e16326dc9541a7104ee31587a36249719581db2bd6bba38da71257084af17e5518442aca68f5c67e2a50f8179de508585e127289
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:ky5112gYy5azzVvL69nLKnhZXLm
TLSH
T176167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b955fa561d4ab22abca8714cfa3a35522398e7d9639d726cb999d30dcbca81b4
MD5 550a06e67104335bd66bc1de10afca15
SHA1 f03b25c7a222226f78824f41e5c43f83e29c10ad
SHA512 4a660cebc5b601032581f9b9a0a81869c399fbc73a3e5f5fd791c6635fcd3866278a3e586e57b5f27d463e5978956433156a10d0728bf9d3d40eea3545a19f93
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl7Q/lFTjN4:zu6JmVxd2dwLm
TLSH
T1E9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3521471516045a083ccb425c5a57e74547de267af5c481c84460c7651fe1ab76
MD5 46e7fbea99c042b5bae0135742ec0ee8
SHA1 c08dc03d03a2f257ea9b9038fbbef0e0ade62547
SHA512 e5918438e6092d716c7339b12734e4d9b6acc9411d1e4353835ce67a5fef6f17892d3d0e65d58942c07b920f77dd7a7e8cc757c1fd2f70244b260c33a5438b03
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xPQ/lFTjN4:JmifPbRtLm
TLSH
T1B1B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ea0af7e509585c026d9445281c894e1907af6a6b99ecc5aeac11277573626b19
MD5 c90fac736908fb05fd3a2905fad42bd4
SHA1 ea126af88bd9474d6450defac39100100919fe3e
SHA512 21f4505815b56d55f7fe667d87ed1a387b3696c9ab26fc2cd3ef43c5c29397f026b9e7ce968712010487e9b14d82c072c1a9eb9fe57d0a2452f2c6539bb85556
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqAQ/lFTjN4:A5dKTi61TLm
TLSH
T1D8C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 87135201d03fd6833b360fe28b41056ebb023be24fc3f12ae0ede13541f40025
MD5 c24624f8fb76d6bc8c2a2c64f79a515b
SHA1 55f956e279a9f8235dfa1920f731bda8440087e5
SHA512 20db09fc21e8ca82d537bebe521ea99f8e562062ea4cdcc6f1e02e1de235148f1493c9a07d41dc45ebb4da654db75f7bca619ce90b75be4545a8f046f3bd6b9a
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wrQ/lFTjN4:LX2iyphxLm
TLSH
T17395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 167bb34f1d3179ced58504e031ec37b8d1f8b837bae67a8417f2790315f2a9d2
MD5 d196d1fcde6ae5c2704195da2f60a479
SHA1 b8380254d863249ca98249873301dd92910bf286
SHA512 47197bfd22852152b60323eab7d5e8b348d6d4d788ac47bbd67d07705b20e1362bcfdca08e5ba7aad728d6a3fb75a1b0ced64dd32342ae31353469a23fa32687
SSDEEP 12288:/cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:/cnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1CC5523697964F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e5d4d1e7f456806496911a9b5fe00058b81dd42af3e8327b1cc76c7bb26e4c18
MD5 a482c92a4f3944895d7d94973e3064ed
SHA1 744b79f837fe46fd8ef3174742df654614435f5b
SHA512 ff408c134569220d6feb0ef6a9ac0a734a64c2d5d5aca9d55b62b3f17ed6dbc60859c69d520bafea9f19ed49841fdd22b6275dda8f893bfaa510891da9dc289e
SSDEEP 12288:d5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:dJnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1A85523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1de9a18ae46376972078b14c8a5583174960d7e246207d2b80a5fb0e82560dc8
MD5 b9180c139067747063c91619d183548b
SHA1 336e855c45cb189f510435181ae20fb98ab72858
SHA512 5630f3fa104974fb8045ce97bbe255bac39b423aa83955e3bd835b2cd4262df2c949b424d228a97f68660883cb63572a289e8badfad9ab4f46c011122f3de33d
SSDEEP 12288:7nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:7HnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1915523697965F98BFA1706F1488381829B7B0DC7BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4bd9b4cef6c3a4c70a48e04faf0f6bef85b0203edfd54e6650633f2fd46a6688
MD5 aad44a75351b40f8f20f328794f72a83
SHA1 0fa3e1f31d5e2c7b6bdb60b14df033abb0218f6f
SHA512 2a657d61fab5854586324aaf9c3981832a243894a16ac2a2d580a145c8638565ceab7f7045e43ee02356835b63e27b1d3abf26b4792d82b043bf24debd19429f
SSDEEP 12288:8ViGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:rnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1FF5523693A69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA9B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2fbf0145908ea464eed018dbe74f7ce5f51d446ff09982f2f2878a61f60c3c2f
MD5 5e33b8335f379eaabdda8bb4d4db9398
SHA1 a036576b2e0f82232e8c737dddbe993b83ecc99c
SHA512 5b4f57aacca46ba91755a4c3bebb110508ece20f43d30590f9b95c4962676f9d806c5f7ead11dffa39439bae264a52503e71f5b7f798e9fec6b4dd4c94fe7ca5
SSDEEP 12288:JKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:JKnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1B05523697965F98BFA1706F14C8281829B3F0DC7BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 40060659ed1f1a64384d8ed467a0f934b5b5e66f384515e951541639c629ae46
MD5 08c42f941051076240c47a8c90d1a98f
SHA1 b5d7331262e7e8b177967b7fb2e07ccdbcbf5323
SHA512 77de3a7bfa49418c009f1c9c28b9268d9cace2226c6a1951b3aa8038823b21440f12633f5d29601c77e37ae49c2baae314a71674f1d0c240f3e05283a68babd7
SSDEEP 12288:N1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:NVnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1335523697965F98BFA1706F14C828182973B0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6c847ca02353536daf5f5161a9ae3803aa0c2aa7bea04d287bcdbb7a6770e9f9
MD5 1a47ca299bf942573d07043524e5652d
SHA1 997a3548f4a367ebb157001d8db6097b358b43ce
SHA512 2b944dae693de11b7627f59d5d695ea687af0ebdb98bfda9fc5a5cfcf98e1644cbec84999c59627a3f495ec3fceb611d86ad881e96ca397d60a8aaf70424b05e
SSDEEP 12288:MBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:MRnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1495523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2fb068797a05f4e665af7f4a58f9416187482d9d74c81cecd3dd3becee5c7ca1
MD5 d2b0797ca01fe67b3e427409f04847c4
SHA1 eb8084663e9ff9e0f1d9314fdda977219f1822ed
SHA512 579878a297ca6c1c26aeed7adb81b48b21f74d9e68493c14f6132e071fbb7cd99ea38d36e8426ae87f5ca1d0821110bab763382d2a9aaab67858fe83cfc0846f
SSDEEP 12288:UiZwbDzzFEoS2cPvyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:3ZM3zFVSOpnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1D37501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 da09fabc8b380c6657b4036751e7d80eecaaec4c60fda8ad297ddd0d5903567f
MD5 35c302d7d21f49d63b5076fb8e1bdbdf
SHA1 3c0642ac1816bd6579cb5521e6d712f34ebe1d4d
SHA512 880b7fa3868dcbb52b8d5aaebc74c9a33c7ad03b746bab82b265aff94eefd662c2b0fa199d6342c48468883ca993513bc9945b11ac264ec636a4172150ba8388
SSDEEP 12288:sQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:swnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1CE5523697965F98BFB1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4fedc66cc420c78ab53ef1bba9335fd2a4fe15abbda55181b38c745c812b7584
MD5 b796736b2e8d85a8e7c35dce3cbeca10
SHA1 25926b0fb395239340e0a16f33699860b688ccf2
SHA512 22ad858fe541ea036fb0aecf7a23c514eee45c94d73b5f1c6463cc67deec7307809d3153798085e6ff3591bed295b39ad32efb58de2e9f562ffcada8c082d8f7
SSDEEP 12288:M0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:MUnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T12C5523697965F98BFA1706F14C8281829B3F0EC7BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c0bed7c43969928441eb8ab29a3d953e9e930d76be8c31edabd8fefd7029f7b7
MD5 5f8dfefa3c80c54b5427c4201aabd83d
SHA1 fc8104fd9d36f275d386bae33c7eec35e406417e
SHA512 3e3ca97f9d375a299e2d8540e03b8f80c26adf0e6693022d53ffec35a162df5cf54f93f7de75ed450e2f1b593741ed15b5a67f4371aa0dcda905b01b821dda60
SSDEEP 12288:cyPz5L8NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:FzytnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T10F65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3494167745d84c9e4516722aa590bde28022163c056415376b2b348149f8008e
MD5 5a8d5ece5070d7d677bcd8b7f7a984cd
SHA1 c91a0010033b6fd5b847f73fc84bec53c84f0acc
SHA512 350a460dc426c8c50fd36a436f11cac711aee6c575ad7dc3f4ea57ef4292d92ee0867a99467ec0b8bf4b091046fabf50e6f771dd0a7992892935c964a7f265da
SSDEEP 12288:tQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:twnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1F85523697965F98BFA1706F14C8281829B7F0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e22d3f227a01b8cdc8442aef4485cda457a7cad4afe203c577ee4b2bf8310457
MD5 773a4c11ad4739b496f2af811216c148
SHA1 6289d6c938a1265e8ec04528511ab761da9f679d
SHA512 ee325be5ac2f1921e4ffc058e8e5062f7a6eac5ef07dcfa4490377016fce4dee29a5acdab4614a5204dea4adfaa02caa878a71f031cbfe5e640cbfde42f08599
SSDEEP 12288:vQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:vwnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1365523697964F98BFB1706F5488281829B7F0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2fbba61380aaf38c49b991b7020abf4a4433249bf25f801711ce8dad69295ed0
MD5 cbb460ced6c2e2b6b05987933895a5cf
SHA1 91b52a1ea62a9ac788dbc2b0e4a6f7091f0be363
SHA512 5ae5a7dc87b6d3d8df2ad03a1b9cfc19235c3ef160e303902d5902397ab13fdea9296cac6db55fb733c07eaf6beb00bd5d596a4f467fa77f6e74dec77e5e4bef
SSDEEP 12288:4yPz5L8NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:ZzytnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1A665021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 620202c7e8a2956fff8bac535a616da92687851f2172b9b01ab00ad075611d81
MD5 6723edd43eb57cd071a728149ee34861
SHA1 fcad65b3b3a93cd8a439c08aef826c53d33369ad
SHA512 45ca8feec092933eff22ff522a88fdbbb7089e249656e924adeb537e5c18c2cf830b73418cc65afe6bace94d1ec13e01c1e6f781de614d0d0120295cec33ee59
SSDEEP 24576:ZT0aLl3z0zDXnQ/tbw/2Mkjy6Fr7g0ot:ZTDLljuQ/lFTjN4
TLSH
T1807501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 c55bae9f7ad6227b16c3a860031b505b6ac497c94834ee2ff8a3c022484c571b
MD5 e3dcc5e7ee1c513520a31921fb548da3
SHA1 9f115e3b93a1339359176993801a7462f0d1129f
SHA512 ce3ebf9ca2ccf823fa64fa04cb4d04b3cc5d2ea7de34d00d2e9f569e6347e411f6619cae8c99dfcf7e4c274ca0603e980c091deeaf3482a31336dc7a6bf3555e
SSDEEP 24576:C31d9CHKy7GZjnQ/tbw/2Mkjy6Fr7g0of:k1d9CHKyaFQ/lFTjN4
TLSH
T1A485CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c53bd71c046dff5173254ce2b3a9c42f5e2c41fc6bfaa0e66b0627acf44f405d
MD5 c42aff9abd7c5170bf10126eedc1d1a6
SHA1 f6e51e971ec3506db3529e580243ceb843289a05
SHA512 104c52502cee28d29b936f990d0c514808ee4d87db1d4c7b1263ce6f3f467e93e101eacc07dc14a396272773396b530f0edde773bba2fee8951353ff27c3f9cb
SSDEEP 12288:iHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:innQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1A75523697965F98BFA1706F18C8281829B3F0DC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2f4490f8f9b48330c2a3224139082ebebcf068835db03294b1ddd092f8c73d06
MD5 d9c1d2da0dcaa8792daeb27c47637aed
SHA1 6536e61ea25d27c1b3a6a645a019efafb8c3ce1e
SHA512 2f6819b87ebaf11fcb427df3dfd0d1e8ee159737308edb5bfc26646a021d067a4e487f705b953ebd4248c958e74d8921bd12469cba4594695052f2f88afe4753
SSDEEP 12288:2tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:2NnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T10A5523787964F99BFA1B06F15C8381829B7F0EC6BFD1938F7B481129967D39406CA384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7c1c5a6123bb2e314a551f56fd30ba37b3af7aa45e7a646f62417437d52a22bd
MD5 670a33285301d529cd8d2874a05a8a2d
SHA1 f4431b367b87908756a06b8695995849e9eecb3a
SHA512 a973cfdf6c3262e157fce6217c28d3dd61cfa229e7219073374186952a169268cd709db14e13bc806ba7ac83386b30dd929bd4275749ab31d14ba64c8b364cdd
SSDEEP 12288:G2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:GWnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1395523697965F98BFA1706F14C8281829B7F0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 65cf2fb7104fcb4c0365835c8b632ec0664313655000daeb834cfb73cc5d266c
MD5 72f408114a4c251d937e17a0ec4bb5a6
SHA1 d7144b62b4e8103812516fd1453f8bba4ca6ee89
SHA512 ba698721deec5bd9a450c985263697b44c88ee91340ba6992470066a24fae88b86a17b17ee30025128c55ffea9f30dfd7ba53cdb84e59afa835d34e9e6b0b9b5
SSDEEP 12288:zQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:zwnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1095523697965F88BFA1706F1488281829B7F0EC7BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a9524ca3b1fbda8d00cc3b84876799c554aa53ab75b528fbe75cb2b2394fecf8
MD5 d1c683fb84412ea79ddf1001e40e8ab1
SHA1 f6b0870a44f47a243c418ceedc93672e9fc8c799
SHA512 07384f3c0c3986c6d7f8b1f0311622a35c0369553f1ea711dd6b2f3d995a76559110558c380d1de33d450b7572f04779ece7343e9f90727dde80c70beb0fbbcf
SSDEEP 12288:bHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:bnnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1C55523697965F98BFA1706F1488281829B7F0DC7BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b9ed0a66beea86c0baf10ba412226e74d9b64fc1eca0ff1dff5c255f30aae870
MD5 dcf5d3bc1be57cd45ce647cc7c67f79e
SHA1 0ac222f886838b67f090e9c587d6f3c2fb450c4d
SHA512 d0f40d6e169c90883f0cae9bbc9dbd52dc0ae657facc98077332498b5267351b990ca3020eac0322df724d96a523238f7d9b834ee425d0cc8c65268dd85ea66b
SSDEEP 12288:24GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:24nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1CF5523697964F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 551921417aee943f0f80a4059c25dcf74f2905c0783602108d30611ea60844ac
MD5 68983063cc46b332d43d1df127f7b657
SHA1 3df38fab515d7c842f273c346da0c5d03d131040
SHA512 43aa662e95b0d4b540527f8d08263b445b11c7bd111a560abc0a727b47291c96a97478d3f7fb2749cb3116b1861ac0f523003c7bb0f722cd442cb24ff4e8536e
SSDEEP 12288:oKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:oKnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T19D5523697965F98BFA1706F148838182AB3F0DC7BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5c6f7ce0ae5daef71816898704dc0dcba4d6c26d40b4b891d143e066411047b5
MD5 f4240445f38e2329215beba919309ba3
SHA1 efe602c34b4b651f2ad5dcf1e3c22c07327fa47a
SHA512 5b0752f8c4ac36453ab5e6673d1f6c7119a7b8c9bee08f45e9590c67566005e46bbe92b9148d32acfa47cf66c98fd310ef2373f23f0238c43a927430da417f6a
SSDEEP 24576:sfwv/k9RX6wkyAIEnQ/tbw/2Mkjy6Fr7g0o5:bMnYIEQ/lFTjN4
TLSH
T15B85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 797ade4b14e12c55efd3357a14e764831ab1cf45d08639ada1df5437082f4753
MD5 037e559d2f2bb303ac51ebb35b432e6a
SHA1 679513c4e8a7dbc3f99d60bd017a689c41e148e9
SHA512 fa4fc41d069d90d75cbde35bab434ec89781fd4f6ef8942e4c91db593ab3c74566e9c0a6767bf4cc21570b23c752807418f0a4b2fecf428caf50400f1e991696
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LQ/lFTjN4:0ySzPILm
TLSH
T1E0066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 51231c3b0f4aa261367935417fad1f0d7f1bbb54bc926de46056588bc5460d57
MD5 a65c5ee3665b0724dda2e0591e14d06e
SHA1 693130c887a372f16411bf3f6d592b00baf26c9a
SHA512 c1e71ab4930fa5663f3d0af2b07fdff4be4494e47af8cb318fe114be4035f42fa5a97cfc4edd64f2cd74b43274c6dd8cf868ad2aacce169a87f6ce4c7343d47c
SSDEEP 24576:g47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYZnQ/tbw/2Mkjy6Fr7g0oz:g47JUQj1irIhCnDHUPfF/7Q/lFTjN4
TLSH
T15B65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 10e4de8871191083be4cb260bbefa974e15204c467d69d490ad7b6ceac08098c
MD5 9984af62f5fa408a361e0c5c4eda94bd
SHA1 fb3d191915f236758928be9f30589b2f219f5587
SHA512 909c5c57ce1784d313c75ef4bfcd18df28aa0bc7477700a2e75fec1a3474030e7e6bb507f11f685f56048e976eba3b70da2296194b0c5ec6821b9dbe78d002f1
SSDEEP 12288:/ssfgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:TAnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1D065F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 d0e034e0488af909b0443dbfe833b018cc42563af7bc95e78c73fc39c08053e8
MD5 41945ee8fe72ed1e87787945dfc224e8
SHA1 032822d246de4db08702a90ac8b8c690f0a0fadd
SHA512 648f1711ab9c1f6cdd8a12c85cff9f411cfa46d19fa3d208b0baeba61af651c5ae50751f250eb8f9db3d07675aa035ab7eeb7bfbc91fb550b7b840f91c1f144f
SSDEEP 24576:J2HpUPxBtp7hbrvKp/KIrrydHudg5RJHMvWU5:ipUJXLKpiWuui5rMv
TLSH
T168553841B62AC79FC5A950325E32D6CCA7707D01FE056F0773C8873F9476668BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 acf69b12027a29a1f00fb3738eca89366fa5fdb7fcacb575e34afc8f7f3326dd
MD5 19f59d12725fd6ab6134548c425651bc
SHA1 6d78ca260a7c488a4053c74032c98c951cf7ed8a
SHA512 3fe0d68d2f08ad7c82ea4f10b86b343d952199183d259f920950f046a40f9785e4589dd8d2ee12f7b52e561f37f98a3f98eb74b3b9f9a3a1a57ca2d4ac4477c0
SSDEEP 12288:4IvLC3OmI8A8mAx0Wz8QktxRCTQO4rAdI29bWp:4IvLYv5iuCp/A+2dY
TLSH
T124452A01A5A7E35FC9FD90374632C68DABB45C03BB453B0173448A3C9877A7EB5E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8b55a7298cfab2352355f473ca105056f65ffaea1d8757cf1fb42fbe73a60275
MD5 ab5110c4af1227ea1eeaef9bb7b178fa
SHA1 999c5a330191c21ba404644cdef91871c40a7821
SHA512 2d5b029ab7584bf63481ba62c1a4ac64486a8e8577ee90a691e6c17ddec057f43dfe6f84117698c2314e06e961692f906a5491239ba721240e4176dc957a2ba6
SSDEEP 12288:r67IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:yInQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1FD5523656668F94BFA3B06F058928111673F0EC5AF90D3CFBB082269957D3C40EFA749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4811308725a4457549cb169d977607b4d19afc2fee5a97145cb80bcf43524620
MD5 2eda55171f29b377856d62568da1162b
SHA1 bfc50609258461e978f062cb3800c339658fca01
SHA512 1e56ea739884af7761264a69f96846cfee70f7761cc445222c510dfffcc56d46d47da2d7bf387cb334913dc91eb2ef06da4e5c6c7fbe0908e9ceda05d3b4b44a
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYunQ/tbw/2Mkjy6Fr7g0oF:/gb4mBIBhGFZQ/lFTjN4
TLSH
T18665AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b7031e85bc77b357be19ef04e67540acad1bbbc37a27587da36e650f8ba72f1c
MD5 6903322325257afa8beb5bf23b0314f6
SHA1 048a488ce62ed89dbf6e8d2e84afa74f68c37ec1
SHA512 af27f708430229dbea1aff2bb8580d17b74a7c8de0732e427207a627bd76378fc66656d5fd92dcabd33475169e6195841972bc720f2f7d3f87647c8808ccefd4
SSDEEP 24576:7G88u8FpJqH1Qzria7/mpnQ/tbw/2Mkjy6Fr7g0oP:a7ZFPqVva7/2Q/lFTjN4
TLSH
T11C85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a50553333c48c1d6b790bf1a25c402abfba99e899f465bae830150bcbfdd5609
MD5 96f6fce2c01aea9301ee08d79712de62
SHA1 6dca2184d1e6a2f435ff82de655d7659a72835a4
SHA512 8ee154f97b4d508033c5278abe0b826256f7964d0e1c3e474b0d8ba814440680c333a5c388d425062a9e0195d32a48a4f9cb2a2dab59fb1e4297adeac88ef008
SSDEEP 12288:NHvUrBFrEjwaQlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:NPUr+NQFnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T11465E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b7cfc22b8fe843f6b6fe34ab2d7587c55d891904f3992adb22c83e89e744b2f1
MD5 0164e55fd6608b18dade51b2fe65a472
SHA1 fc56bdcdc66893db3eacd65bbfacb8f2c75aa443
SHA512 7cfc56ba0bccc2b605328132c01c4c5a7f7866e3dacdf2f0ab51f038578eda4af6222a1cc886b1e8024cdcb60b99450249999861d01e0661c90173621745ee52
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVQ/lFTjN4:CG05lO43bvLm
TLSH
T1F4D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c6678c0e7552371dbb4f2ea7b74f5e565b1f3e5fbe93174e0401b1c1a9c9b44
MD5 f935fdfc7fe203792d500594824ec8a0
SHA1 88f6c29b5619c12d395dee81b0895ca767db73c2
SHA512 27bee3cbd8baa48b6c9d29283a2bf20fcbcad7e5872dc18092a410a6f419eeb3b1c1628227d5b7ca1d5a36195d7ff75e22ddd2ae9348c9671b9e4f66a2714396
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLnQ/tbw/2Mkjy6Fr7g0o8:ka5POZ3+Jt2pasx2+mNQ/lFTjN4
TLSH
T1B665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b44eccc6737500b90fae6de3b37c2105153498797165046f564570ebc651fbdb
MD5 b3b5d496ad9f513de0e105b6c0eafe17
SHA1 e8c0e2c7bece414d5b9b4a502b8d57fc0011d851
SHA512 7059148165a92ef51d7d7cf1502de3efc9eec4f671baf5794587465087adcdd99640aa4be616dfa64d65e28a5209c1e82f0dbd4ee3a67b0a1cdb72bb733e594e
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkhnQ/tbw/2Mkjy6Fr7g0ol:7Nc/zEOVHFWQ/lFTjN4
TLSH
T1EC858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1385df832e72dc219ee6c8dc9440368003ed8f7777f639f6272e219c8a29c595
MD5 78c2ee2258f5b27a34333285d6b64396
SHA1 9b6b27a2cde1352f1f32eb58f216c60ec6be7988
SHA512 f6f8192a7d6af650830cf406d50483c893d024632b3e94b0c4f2860f311b05827e5b5521148b89ba7b7dbd35b9977139ba1c50773b164e3ebf471e788351b92b
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmfnQ/tbw/2Mkjy6Fr7g0oM:m8MwBtOmfQ/lFTjN4
TLSH
T16255AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 170b6394324b07f348247528382ec6b5772965a06324066e2b948821be4281b7
MD5 1af16256b5db244f7046f6f7c466fa49
SHA1 9ee13fe3d9865b52ebf79bd1d0066a669ddb87d6
SHA512 ba4053df722a2adeb5626f6a139608fcb033bc26d638e1145b5d28b74c3fa32a0fc3ce6cfe6285e3424832abcf25b814f3a588d1ca9757b7d0ce2d95ae76475c
SSDEEP 24576:ZD3FHshBIYQgA8nQ/tbw/2Mkjy6Fr7g0oP:ZDVHeBIAA8Q/lFTjN4
TLSH
T1F375E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-79-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/256-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/256-310-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/256-84-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/1392-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1392-329-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1392-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1392-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1392-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1392-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1760-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1760-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1760-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1760-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1900-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1900-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1900-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2040-7-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2040-1-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2040-77-0x0000000140000000-0x00000001403A0000-memory.dmp

Download

memory/2040-0-0x0000000140000000-0x00000001403A0000-memory.dmp

Download

memory/2488-294-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2488-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2488-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2488-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2760-309-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2760-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2760-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2760-67-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2760-68-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3700-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3700-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3700-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3700-315-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3700-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3700-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4820-38-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4820-44-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4820-47-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4820-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4820-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4820-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5124-121-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5124-115-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5124-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5124-114-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5344-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5344-133-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5344-135-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5344-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5344-127-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5492-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5492-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5492-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5492-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5708-328-0x00000266A9FE0000-0x00000266AA163000-memory.dmp

Download

memory/5708-397-0x00000266A9FE0000-0x00000266AA163000-memory.dmp

Download