7782f25bcb36ff95bbaa301aa3143286b3974f0e92d8da42c5ec5f66a1c06cae

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Size 2.0MB
Sample260706-nf634aes3x
SHA256 7782f25bcb36ff95bbaa301aa3143286b3974f0e92d8da42c5ec5f66a1c06cae
MD5 bff68c4f7e9e28d03087acd512638291
SHA1 7d6a3ff212a708aded545ed631ab7cd95f1492c0
SHA512 152ba509d61c7e41bb013eeb9d08168e4b1ab78973a45843c6fad5948669ffdb88fee6ca4c506a25aee48d9011ddb4a5f0a9674ee2bfabd1f89690001c2d2ab6
SSDEEP 24576:ERCeHGWxgRDVHwIpAH1F+Wb31+Awtn743TvRk6NwG:ERCeHGWxgpsb+8MAjDv66mG
TLSH
T195958B13AA4D84E8D059C4748652F97299637C870BE5A5EF46C07E273E3AAEC1F3DE04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5996	elevation_service.exe
1100	elevation_service.exe
6028	maintenanceservice.exe
6620	OSE.EXE
6464	PerceptionSimulationService.exe
4540	perfhost.exe
3104	ReFsDedupSvc.exe
5112	SensorDataService.exe
616	ssh-agent.exe
5368	AgentService.exe
6180	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2e251d23649edfd2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106562\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106562\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000875d6de1390ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002dd4df9d390ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6076	2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3104	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5368	AgentService.exe
Token: 33	6180	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6180	SearchIndexer.exe
Token: SeDebugPrivilege	5996	elevation_service.exe
Token: SeDebugPrivilege	1100	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6180 wrote to memory of 6868	6180	SearchIndexer.exe	100
PID 6180 wrote to memory of 4424	6180	SearchIndexer.exe	101
PID 6180 wrote to memory of 6632	6180	SearchIndexer.exe	102
PID 6180 wrote to memory of 260	6180	SearchIndexer.exe	103
PID 6180 wrote to memory of 6068	6180	SearchIndexer.exe	107
PID 6180 wrote to memory of 2340	6180	SearchIndexer.exe	108
PID 6180 wrote to memory of 3448	6180	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_bff68c4f7e9e28d03087acd512638291_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4540

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5112

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-759331733-200834466-1207319849-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-759331733-200834466-1207319849-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2684 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2684 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a65aeb122a7a09db21d7b1c13f8ebf734f2bf4ee56159979704f5be80bdeb8ab
MD5 11e5e4046e8fac3decc5e074195ab2b7
SHA1 808bc4e4e12cd9c894b9afffda8da901348dd8c6
SHA512 3aa018b70c141c3beaf1a32a1e3500ff80b55440f893e0bc2d479f31a355b3f201c6380728d558fdd00a95ca46fc2d5b844df747dce5e5926f1e7b18b288c446
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnpDv66mG:t3q6sjBGDv6V
TLSH
T147D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d19f512043cd80694192ddc15407cdb2a977a01993ac496718bdaee7e8bb7b56
MD5 d8feda26700f852b7a91a1b9ff462eb1
SHA1 8b659285a1125acfb6d8978cdb0e91e96e08eda2
SHA512 cd7a186348c6b83a4832243de6503243923fbb475dd377aa9d4cd703ec0c1e75df4d793cd6915c9ac1bf6a69a048f997597a622f09279187cf4254662f711c89
SSDEEP 12288:p1XLsswWkxy2lRq2czAuXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:nXYfDtczA5743TvRk6NwG
TLSH
T10265F12873E408FDED77827DC8A28512E673B85547A0EBCF03A499651F232D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2dc9475bfd7b70d42aa515d976769f5acff0d5cbee0e6e3aa9b861c933e0a1d5
MD5 dbeb6ef32ea7d24a4a84271c9d4fa547
SHA1 0502e508960a823ca155311e8b81933680a5363d
SHA512 1357b7e2aaef769c8d4654aa05d31958387b50a913640af9b600742fa5052659d77a26f77c8432cd09d8ada3ec55152e520cfb33023689b1a893fcad0b6d45a0
SSDEEP 12288:PXZNYVLeyUji0h90ZD0wxpGZIVuCrHs7XI7vgbrWVQhTCYHvRktx/aICF9flefu2:B0Le5ji0hmxxrMM743TvRk6NwG
TLSH
T15985AE16F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2290510e4445483847ae0b268b0dced6c9f2485f6b2fd60219b22a312313e6e1
MD5 2b7a95da057e2c551a485aad3ff678dd
SHA1 842cc73997dcc13262244cb4fbd432bd3453e566
SHA512 d193b0eae35b37f589ab3f2616915ba83062323c785f2e7f344c93a3bfbfe3e59100db26ffac34dcd9a016088f48b53c93232beae48aa0566ae03f53e9f2b026
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyu6743TvRk6NwG:D/ezSC6vUzPveHjyMDv66mG
TLSH
T1D8755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e983375fb2ea60a4ab612fcd4cc8396e83b1fc81d6abefded562dd00c82c0d7
MD5 229c54a2d14fd364370f338fbd233a9d
SHA1 3a75b31a3e9181e109e336df9e38334838d01be9
SHA512 ec24b7a375d9c2ce4cbe2f8b06122801eadb95c5cd11ec86d5349fd9497891269e2c351a9c94117e3d88fc103e97268d04f95f51674592a79c1a39a2c18c0529
SSDEEP 12288:5VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98aXI7vgbrWVQhTCYHvRktx/aICFu:5VbqPb88hv/l+YV743TvRk6NwG
TLSH
T16B559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 521eee60df0baeea330d18b97800a86554deedbc50370fcfc343295e7d87da7b
MD5 ae659e4f30ae5a03d9d92abf6652e0ad
SHA1 32e007b57c77e4bd7dd32e26d907beb00c72fd4e
SHA512 5f1ae8504854624036cea630e575d9e1b7ce59e6363e5a456a6b1d3a27f5c308436c34f6525ce7dc2ab34a9d1accfe53e503916e1a86c81b3a4d1e67ab98e572
SSDEEP 12288:SLnXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:SLY743TvRk6NwG
TLSH
T1944533087394010DE7B3BDBAE889E0D390A3BF6499C59CCED269FDA158BC1C0E765709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 93a97ae58b583a737de18f29463ebc7236fbc8a8f48fbbe5594e093f6df01766
MD5 70ffe0208c11da2d0e3fbe52f1ffdb03
SHA1 1e40a889d7dcd8afacbfcdf298b6882b21e4f929
SHA512 541196d77b2141a99ea2875a7ad64295bc5baba3bcf2b47c4dc1b1632a81acda7f113c91a70832b68214d40fda6aa56d8a6e249c900590068457bbbe405e809e
SSDEEP 12288:aeBNUbTVO86UCXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:aJIUt743TvRk6NwG
TLSH
T10865CF3BEE28ECD2C27A9DB95A91C240D77278304F52A3CBD165C20EDE235E05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1c8a76cf3d45beb225e9132d75f1b4c53fee208b9487cec0d96fafb3ee52399
MD5 f7d0368801a82c204803f38966cbb68d
SHA1 50df894ceec7be311a892d10b143554b04404de0
SHA512 a2962a249c38975eb69ba6e67ca19e034a97d8ec9b710a2b64b0edb499f4adf2bad543eb81b9f4d28c1f685db91985aaa14e0e241ad41725fb46c88db8a9acf1
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:xQvGAdlCEL8c/DRNw5CDDv6V
TLSH
T1AA266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 569bc7cea89a0c50ff376e1c7b13fe70ee3d12b1a96b8864b35b6766be69c7c9
MD5 5fd66ff9f789f9581f3ce2a08975cb2d
SHA1 b63ffcefeae97969d3868d78bfb23e6e574c4439
SHA512 dc2724d37336e4d6bbad971fb322813c2bbd768fcf3a32b9f878dea78c2c1c2d0bd05e0811dbdcd3f88317087563a15c3b07a2076025e687a0ab4eb9e5ad59c0
SSDEEP 12288:qAwSfxL/2Dc3RDLLmt0LDQewsAjwXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Q:/0ewsAjr743TvRk6NwG
TLSH
T1F175E030FB74D036C3BB0DB61B26C716546DBA204B9119C3E3A89E9E59742D22376F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 694461d0e79e4590f1a8ed84417b81769336f138cb7cdb8ed1abca770e84ef52
MD5 d39307696e70666c8babee636bb1574b
SHA1 e5e353bd4613fef4a9b923da1d730485c6ea7cf7
SHA512 a7bdacf30839d2509497a8de48f97bf689c3193dd2d7f54cad2e82260a168bc2f5919af4d714c9ecb29d324e7908d715713195dff34ece71e78388eae812888b
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHoD6:PUEtQevvqc2W1cpV2tI32
TLSH
T129474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 24ad2151b19782549146d6ede7751d8722adcb6402a1184cc8b4ea87e3426215
MD5 1584ed6e492e5d12eb046ed93265e2fd
SHA1 7a46c63e481feb6dce65a2edf7cdef865b8b1040
SHA512 c07bb1e056ba6682bae4798c9df540a0717ca8d4cbf39f7aed514ff1d1920c046cee8188fa8aac3ccb4d93e3e4cd1b6326ce2e21ffd4f649b333f4d96c5f7b89
SSDEEP 49152:jCbRquA/m2yL5zifFiV+XenmE3/zADv66mG:coqHVjnmPDv6V
TLSH
T116D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d8d0e8a15b35e60dfce5d01e9ca25b5a2d6d4a314eee5484046aa54e1180a25b
MD5 0ccfd4c9c13171ca8e77f52a163a8798
SHA1 835899eca3ef32366e582dfe1d091ec459fbef00
SHA512 2ee94065f8fec9c8b6e7a39b26ec37a83b859e72b05a39dbe79f0364c06b06d1204622b8455a397ac5936feceb5062996f79877a910be5984ba46fc55fc59bf3
SSDEEP 12288:xAZ/GL3IFoiwtA5qy97S9uaYFLq3OGXI7vgbrWVQhTCYHvRktx/aICF9flefuKaM:xAhGL3IFoiwtA5l7S53O743TvRk6NwG
TLSH
T1D4359D80E7F945D4F5F3AAB899B69171EA76BCA65E31C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b34d018e9a67118aa54ea3333ead5b8e57ea45080dff223d613b595709cc76d7
MD5 3ee7418a59e50423c5cb2b8f056041b2
SHA1 ae95a01dd3b5089ce6c67c7553a0a097e947fdcd
SHA512 aff8c6dec64d6d4f788910a3887d847d34ff284d5e4eb17df53eef6d8684f58dbcd7b4532d67434e7c188e715d8df7c23832b3695c9d0a18f62e38588a441fc9
SSDEEP 12288:Smw5HEjsChNVBFgl0WDm+CxXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Lwu4OWf743TvRk6NwG
TLSH
T1DD65F14973A40CF9E9B39639C597C132E7F2B8112A61DB1F1760C65B5F37260AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5dc95426058ca68beebd6894d0a7c2544d76dd1251083d9cfb692623efcf8a6f
MD5 da0cd0dc3787e636da9ccaf2f147ac5c
SHA1 e550d4c078908086f610411361f55a791543d4d1
SHA512 1cf9971bc31fbf0884b4f23a7ca701c39f0c308118b5ce1e981412a5b6e85544b9633b9e02b9695bdb92e63c03b9787357d8ba37398bd376175a085bf6865013
SSDEEP 12288:JeZ1IyAXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:sZuk743TvRk6NwG
TLSH
T16C55234933E410FDE2B3A67DCCE59282D3B37862677287CF126486661F766C05E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 91f7f9fbe2db0b3b06c8e83a3bb28aa1cb47a9db4f9b59708e08100b3b55b100
MD5 a707be357614f02ca65da2b99e9b59d4
SHA1 bd322ffe5a4413fdb40514085ddc6b6081903cf3
SHA512 abd438abda350d80060609d6272c2f8da6dfe9db0411c76d3cdcf706db20b92ef23f22ac81ed6440b4011ffc3be92c1721ed1efcc21216fe837cb3e2e67c6860
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UG:bQRQyi36YOcPbLvw2gAf+PN3aDv6V
TLSH
T1B5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b7ced771e6e6dd66f329f44bd95b240feccd508ebeecf8fafe52dd4d54191dac
MD5 96657aec1dac5143868dbd9ca1a89f5f
SHA1 087fa767e7ee249a767898ebcf926b2bb3f54948
SHA512 0f6c772989026f3b8eb676ba550ae3f09e7f8b1343e9282cdac055a23a3ce3fe78ceaa230b1c7ab738ed81c237c294729ea66aa4ca4ab94fd3ca1f9712198620
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UG:tQRQyi36YOcPbLvw2gAf+PN3aDv6V
TLSH
T160667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 966f105985960c74fe840b968a66c8e26e02294a2da57e5a4ef8dce0d3fa7e6c
MD5 7e00f0ae6f5b6ef8a7aa644f2f48db5f
SHA1 ffe472970ff0873c6214757c744589055feb7bbe
SHA512 5ed2483d2e4c11c40aac81d9e9c81c5e8745492150f06b76509011d0a880cd10c7b540413b259d087c27de3432456b796cda406b7e8815b9ac80cf9f6e2db300
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL00743TvRk6NwG:L68Qg55nhceWu7PNU3/wDv66mG
TLSH
T1C6B55933B2F200A9C45DE1769F4A873196D27C758FE0E7DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6720223948cdf39c07369d3ecc8ff8a0314ef7f7c6aa1520a67e0707bc824f72
MD5 df8c42f4e715e4239fa743dbb0be59fc
SHA1 4bb3be689e6befdca3547a8866e1a8b05842da24
SHA512 bbe54b2f5cedff50b5401ef6c492def1edfc84105e9f83702548b1b3ce5d1084b610426ed53b53bf77d4653af1c2ec6c76ba1272aeae998a71ee1c00a47a1f78
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99o:Zy5112gYy5azzVvt69nLKnhZ1Dv6V
TLSH
T10D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dfcec5f6726212fde29c197af659cce6b852dde766d94240cd6f11a2780f04a2
MD5 f3373e9606f3a99f66cff5efbb51f27a
SHA1 92a595ef58f98aa9d61899c550c6795562036ef8
SHA512 c04b09c3dc4fa8caec4410e89871369d1152401b9633f4f89c34e63d10e885c38814535be91990b01b3373b29ed602f3991fa2b17c6101d60f3595da558cf794
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSDv66mG:Ou6Jmdxd2dSDv6V
TLSH
T177D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 684420fd040f49945d9460272ccd6fbf79c3ba50cab83d98b736090597e510c6
MD5 6c5ac13be4d666ab1bc1393b1f4c069a
SHA1 6e61fddeee3cf214f84760f45d8bef6487eae478
SHA512 3ac7217fd9c6e177be91fffc729ff6a26f45cbadec06b42b1fd731194294abe3090ca0e13a73af01919e4e7b498cf6e2ada5b4e0cd9ed22cf200832f615ab59d
SSDEEP 24576:Jhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx39743TvRk6NwG:L1hpsNoJpF1A63U44CwH7R4xODv66mG
TLSH
T184B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9af5634dde6c17566689be5f91f5d3d3bd840a9d02f8a97000597cbeff6d63c6
MD5 cb62c6fdd474fcfbf35061fef3ff156a
SHA1 b006dc2d906dbbe8d14a7ed41b79c33b73c13de3
SHA512 f60fbbabb716e3ac8eec7334ecae9edc5da9c1df3950d53bdb82f9733c18b37d3f169eb941e0c07d5d09550d80901c9428aeed64d12de7d46712e50e5e362ed0
SSDEEP 49152:1SuZQIY0Be2KcRVtOnks6NMHqZDv66mG:b5dKii61ZDv6V
TLSH
T19EC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 af05e60f91b5d4714c6a5dec7a34b192da21e6166622d30b550f24987845921c
MD5 ccf14c22b02c0370f984a4b3f1966a25
SHA1 4ebb067bde66020f18898c64a172a8e5ccf7d999
SHA512 434f755432bf935253e1208106cd2980b94aaf091855b0f773f2459f0cfd4fbf69e01540b6fdb1115bf4cb07c6e454c9c944c97384a67b8d206d96a4a5282637
SSDEEP 24576:fhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QL9743TvRk6NwG:fhtSn8EApI0fig3giDn0AP5wCDv66mG
TLSH
T1CC95BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 afd93188a57667c344e57965721f875b9d347a3860c4f98fd18c5ac829b8be54
MD5 5c14062e1be35e96c771e6f6ac930c91
SHA1 b8c07ddbea12f4b1b21fad66a2bd4be2742b8eeb
SHA512 780b9b2f319ac0b525a11ed23c2ad251e9f6b798c581bcdc7d55ecaa89137eb1c5fea6654889fb34dc86be2be6839139dd2f5cbc8ccbe558ca9b6d8284e5889f
SSDEEP 12288:bvXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:bw743TvRk6NwG
TLSH
T1DA4533087396020ED273B9FAC88891C39093BF66FAC65CCEA75EEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b2df59f928691d66df590d2b83c95d078c1f1e2db7571946a02f4c4d85d95708
MD5 b233afe6d1204d8fad3f2bc4f07bdc38
SHA1 8b77f3b047b81e7b9eb5f824924235b39c4f3851
SHA512 790e28ac0c80732ac8fbb8e3fecb291b87c54be1490f0e2448fb418fb42a56e7f8b6353c5183680d60858eebe8133c0543a41ac6e15fda8d903208f39d419ecc
SSDEEP 12288:fsXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:fn743TvRk6NwG
TLSH
T1034523087396020ED273B9FAD48891C39053BF66FAC25CDEA76DEC2159BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 037abf09827d694d0b1a2035edc777f41946dc0d14e702afa7520f1f6090d4db
MD5 37f2308bca2638654d856b00e498d6bc
SHA1 95c74754e6ecfa79794b46d4bddc1ce4b6b18df4
SHA512 fe86dcd89c72edab7b6e77ed65343d003784060ca3f307726afb39f75f4bf0a438f9b2c4b19292fbaa31dd2d32253f53c534d2c0583a9bd1355af7fe30ae6ca3
SSDEEP 12288:wKXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:wl743TvRk6NwG
TLSH
T1664533087396010ED273B9FAC48991C3D093BB66BAC65CCEE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 750cf1c4aa1ab1e54b2a31c6383de96bf2bd738f99ddac32941a22b1678d6ee5
MD5 0f883c8e96baa309c4094d90fea66735
SHA1 7997e78e8a87294ef57f7c54f3e72e279dbabe41
SHA512 a50b7b9597ecb91e02ebaaa22a7c567ac85b0dc0dfa4b48a44f39a8e44653c1a0e307398bc42234da97aae32500459c988de88381a21aa566f097cdbf98bb2df
SSDEEP 12288:dVVXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:m743TvRk6NwG
TLSH
T1AD4523043399018DD4B3F6BAC89591C2D1B3BFA5EBA29EDF97159C650DB83C06A34F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6be8260454a0548494972b709687959a95c5ef681bbbcfdc27488c0448a5ea8a
MD5 814a629c1b865dc1cd0a27b438a19f5f
SHA1 db5443a4942f7dd10afda5b7a789374c048ba447
SHA512 089c435a4a5c4aa069916e11140c482ada4c498b7f86043dee409955b84d247532f3c96d9b004a8aca6d5089175bc66799757aff6e371a424827e322db0b538f
SSDEEP 12288:YtXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Y2743TvRk6NwG
TLSH
T1624533087396020ED173B9FAC88991C39093BB66BAC65CCFE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f25cb7fe113f789e144459a7a17026289e029e8244df13eb1a93ee665eab3033
MD5 b215f55e36c21db86f58813762fbe8db
SHA1 91e7a62e3c8ffc87b546db7c4d2d6c37f36dc859
SHA512 a0e0ba7f5394be0d651a539c132fb637a56b3b99b5a9f9fae8545ce5281de4e75e112bd27e569d5ec5f09f8bedea04c54386b8a547a16e449d1718a9085fa0c2
SSDEEP 12288:iYXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:ij743TvRk6NwG
TLSH
T1974523087396020ED273B9FAC88891C39053BF66BAC25CDEA75EEC2159BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4e36e36f602c0eae0c06622d8e4fc33f4da9fa76142f9e1dbf74e9f403f77e9d
MD5 4d8f032b374ecde5377e010c520ae17d
SHA1 305a6d0fa4fd74502b38e6e3587ba0322eea53ea
SHA512 e03a15daf0b95937daf45cff159d349b926103b5fa01dd623920342140b4a2e651298107e2bec2bc6a3540630b24b3c99fd5f9f2097c86e443ea6a580891b580
SSDEEP 12288:nEXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:nv743TvRk6NwG
TLSH
T1454523087396020ED273B9FAC48891C28053BF6AFAC65CCEE75EEC2165BC1D46755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2baad3ade48222588879e6b3d5302ab73ef74e3529d69ded9c9cc21df7d1562a
MD5 f104f463d69afc141b6556875426c086
SHA1 5f90e16e65a5f2a99dc1574c7b8821f275aa6e92
SHA512 26de569d5c968ac729dbf10677764b1884df998225fd23cc5d29bd323bb9ab31f7b4430cca16f033e1538a15f4986426cb81c8e7f1a84b0532159a94d1eb80cd
SSDEEP 12288:6iZwbVzzFEoS2cPvyMXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:dZMRzFVSOH743TvRk6NwG
TLSH
T13E650194B39008F8EC73817EC8558946D2B27C5A4BA0CA5F13B836665F773A01D3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 78501d495c8a5d02a662d04aedc2c1dca1a9db05ba89e747979072b1274ae45a
MD5 e03cf908b47b789e8ae60b8fcfc3d3ba
SHA1 4e9aa40955f6423ef298424dc3da4c3762602816
SHA512 cec084dfe05a2eb0cbb7b07aa519911573d4319d093b566b9774361ff6d9800025d9c01e3aec01ef6837511aa5b4d77cd35afbecafcc54e505db4c255e5e9476
SSDEEP 12288:GzXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:GU743TvRk6NwG
TLSH
T1B94533087396010DD273B9FAC48991C38097BF6ABAC25CCEE75EEC2169BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7b683387286e0410203a61ed55c4f3af58e7a79db4e8134596398ffd511ddc7c
MD5 d20343b1edc3a559d8c02e0a940da81f
SHA1 4b15e1f55c7421acae57e3a982241c9b3a925086
SHA512 bea372e9a010b95da4cd88c89645de7ba4e2b172f2b72c40882a019ba21b85ff6a61c27d7c2211021afbbb7ba064ccb09f14610548f57d8c3ed40ecfda040fb9
SSDEEP 12288:o3XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:oI743TvRk6NwG
TLSH
T1A34523087396020DD273B9FAC88491C28057BF6AFAC65CCEE75EEC2169BC1D46759B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 54fc99a679e559e8fb34f760b5cba9bce239552deacbb69f79c082670f7c786d
MD5 c45bb2ce0fa8229472fb0b3495c3d1e0
SHA1 b542ce12fc9c1a60301dbd3bca4afd81a27e6917
SHA512 5643aba88c41e225c4e30a26cb9b2870abc69625c858ace3e8e31601042ed6b6fdfe03bc71d54142cc9c761d1afa22619120ff349b1cadfe98fe5f6285e0d99e
SSDEEP 12288:oyPz5L8AXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:pzyb743TvRk6NwG
TLSH
T16155120773A520FDD1739279C8925682F372B83657608EEF53A446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 31e32db45639cc6851c260852eeec286d2c801898fe30e66aff0d987f9af1300
MD5 6a483af3b27158fe7dbece1c60598e7e
SHA1 98cca6bf7a259ca58078bada594d99d652648be0
SHA512 38a5ce6a891b311a78ea8f8ce1fe39f84229cd37acd1bcfb7f196b3a35639f17f734214f84f4852e44acbfba14b05f3d1e3bd6fd07350861e8938d77b344ea8c
SSDEEP 12288:qzXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:qU743TvRk6NwG
TLSH
T1B54523087396010DD273B9FAD48991C28097BF6ABAC65CCEE75EEC2069BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f1c5fb2c06d410385ce0ff86b8a3c7bc6a2bd227ca52d1164345871dc2986291
MD5 2ce54a0a6a300084f43f2731eaef3596
SHA1 200ab2ec522aee9435e4d8a3b65e6862780a272b
SHA512 d6f5d38d1411dfd72cd8e168cf4bd399017a9ff5c09453b928b77ff39a6d155f9100ea7d3f30812bd5f54478d3fa4fd7725d7c9eb0c3f675dcbe24e5a29469bd
SSDEEP 12288:wzXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:wU743TvRk6NwG
TLSH
T1034523087396010DD273B9FAD48991C29097BF6ABAC25CCFE75EEC2069BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1f716390596222e039965e738c9054f6e49769cf5e504c824e5e9afe48f33762
MD5 4f5def53c1a7576661cbd2949d7e57dd
SHA1 839eae8fcafc690517363a601e222d6664efd37f
SHA512 8a202f9e1c3288a5b46cd77989aa664d2a6c15a1274ae23049a2face4a1546e51854aef69a32058cf2d427b66efce240f2910d12368a7bae780d4fa49519a5f9
SSDEEP 12288:QyPz5L8AXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:hzyb743TvRk6NwG
TLSH
T1DC55120773A520FDD1739279C8925682F372B83657608EEF53A446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f305ee1fd3a30d5d8a4b963bc46af095faa134f0b96861fd3f16c20e97f164fd
MD5 49599f510a70e5d955130222b9784f4f
SHA1 d33b84a2a0d3545ce4843fa52b5d1bb3d87927f3
SHA512 b574f97ee80f0ba76aea237a6078a06200304e401aec2e6d7fd8d0b83fde7243d90c7854e0bea12e881fc7b50b6738a59d2c6b38b70f81e726e7e5383cf05a22
SSDEEP 12288:+Cd9CWYoaLHF3z0z04PDvh6XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:vTDaLl3z0zD1743TvRk6NwG
TLSH
T143650194B39008F8EC73857ECC558946D2B27C6A0BA0CA5F13A836665F773A01D3EF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3e56ef65eff6a54b6ec0bc5a6d2faaf74e9269ad38441f488d1fe401eea7ecde
MD5 3e8f776ba45b1b29aa6e5fdb93599ed3
SHA1 032221a51aebcf66ede97fa5dec5a076a130d6aa
SHA512 85319d5d9ae5dc014f865d514e1a55877e65890f7036aa33e8dd63e657cff5c72845023bcebdf61f000578485251ebbbb362002f779cd2effb77fc19cf4b3329
SSDEEP 12288:Ai4e7KRdTfgwCHKy7GLbbdIvpXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:A3vd9CHKy7GZR743TvRk6NwG
TLSH
T1F675CF90F3E410E8F0B39A35C9765512DAB67C5A1B61DE8F03A8651A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 00536634121b7373dcae552cf3773eed662d11d537fd47b382086754b9af0daf
MD5 d7c80953ca8876c48d2e03bfb1a94884
SHA1 a6a7105fe31fcbaecf5130443d081cf7624dab5d
SHA512 08c94f2a6f5d0526c964c495872b3ab21d865db8aa4b45adb44f7c0e605cd308e88ff83d2654547202fa5b6e253c047b0161304b7ba3f041db30c3d4ff713313
SSDEEP 12288:hqXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:hF743TvRk6NwG
TLSH
T12E4523087396010ED273B9FAD88991C39093BB66BAC25CCEE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c3c0478e0547472a0950e4e9edd22e8f0158888b331bb6e635396f83835feb52
MD5 9c9ec11b32f8c8ab03a5f5567cc9bd63
SHA1 05711da0bddb6116db3f0c135fd12529790e5fbe
SHA512 b8617d54c78aa48f051845e94d8ec15bffe3edf01e0cc67ffc254a56ba3022bf3989f53550bc7b3ff4cecfff3bdf96ba7c8122ec96f5d0816dc46912005d8adc
SSDEEP 12288:3gXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:37743TvRk6NwG
TLSH
T1F44533087396010EE173B9FAD88991C39093BF66EAC25CCEE76EEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c5207e38f70327d610524478f6f9f76f68d5bbbca04daf7d15afcc98ddd31e50
MD5 5e67afe8ad26e61bbaaa4c30e925a907
SHA1 ae1f0835b8af82f174044e89bb194dbafbc40e5e
SHA512 409640025bb0c6fd53653f8cacd4a5c678f67bc83fef7b2aed58b1d7c0d739db92341396979b59aff7fc133f341e4c859e8d674905dd057a4b47d4947794e9f4
SSDEEP 12288:CpXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:CC743TvRk6NwG
TLSH
T1424523087396010DD273B9FAC48991C39093BB6ABAC65CCFE75EEC2169BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 82ba5dc4430bc9c8965f5cdf68abca778a679874042dcda5236709075aae8a89
MD5 729581a7472df719e611796e298b8984
SHA1 a2a0046d6a05d06e808d3129051253332feec1a8
SHA512 923d00254d41d6cbf1656287034c3431ce0be22238b879a08b16bf83b3904d5e34bbf8b1e0d33ba6b785f9d88cf962d85c3312d1356a157d8d1f9db141730b8c
SSDEEP 12288:qzXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:qU743TvRk6NwG
TLSH
T1514523087396010DD273B9FAD48991C38097BB6ABAC25CCEE75EEC2169BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2b30669a87a2818139046a869353c9cfedac9424efac4aff887fd51c53fa8677
MD5 d0bf611e429fc48278bbd90874eaa6dc
SHA1 109e3948f8bda026bf2e382d1f9ddcc486bf4f8b
SHA512 c3936344c7ff1e01e105db17f29ed1196431df7db90ee129be599d74fb9906226d0db196cccfd3103d2bd3ec27942c10b911191277b040718d9cea513945864e
SSDEEP 12288:oqXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:oF743TvRk6NwG
TLSH
T1114533087396010ED273B9FAC88991C39093BB66BAC25CCEE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a4a85f4b0f9bb4f6c6eeb205cf404cfa13c9e71429510c3fa32c9ffe8c06cc8e
MD5 8dd22f8e85821f194b7871bbf413f9f8
SHA1 953daef2baede30f0cc9431203a5a7114515035f
SHA512 e54792240678063974c292b5b135f0a7f2ebfce302a5e482fcb0883b3d811ff58b51eafca227a84ae7d505d7dbdd31c3898486280c708e7d18eed4c459b42df0
SSDEEP 12288:srXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:sc743TvRk6NwG
TLSH
T1544523087396020DD273B9FAD88491C38097BF66BAC65CCEE75EEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 544b85e3809605f66d48f44fef5e25227d2b0953bf1e4c5c8761b7bafec138b2
MD5 257d69c809fd8eea5f3f8f5fa2dd25e8
SHA1 edf5e1a9cf566a7997319088567657048202e5d6
SHA512 47fff534fbe14b848d28f822a309c5863cd3d8179320c8de1a19a277c7755e6d7a9b84cc137de1fa30a587998533aae419ac69455bb049209a97dda669f4924a
SSDEEP 12288:btXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:b2743TvRk6NwG
TLSH
T1DE4533087396010ED273B9FAC88591C39093BB6ABAC65CCFE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3087e7918d3766ba72397074d7f367f8dbc5bf75dbce23b01beb64d271ffe229
MD5 1ca9b92f707c057422fbf5269b417ed1
SHA1 96dd4a6b0215e1b6ec4e6b7a78d01239a0d7030b
SHA512 67f4ca25ec5d18d1206eb2486147a4b976add0f35572986807f77cd7ccbdcee1c1ad65557c55d203cc22397c20c4014473c3db58724e1acf28670cf663ea9403
SSDEEP 12288:oSXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:od743TvRk6NwG
TLSH
T1214523087396020DD273B9FAD88891C38097BF66BAC65CCEE75EEC2159BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 1cf446f58352b9f056b56af438e62ca5296f849319adc5b523600421703b9e55
MD5 4b0c5ac8c63858fe3e7eee4af8a800b9
SHA1 adf309af8f11bedeba370dd03ddeded64da8a133
SHA512 ef2e5db9759b1549800b39ce19208ac8dc2a8eb9b3154ac2959c13bee4ddd7e2a07a420f4bb584ad05fb3b66dcbd8b2d93afdaf7be5018031fde28863539ab99
SSDEEP 12288:TtXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:T2743TvRk6NwG
TLSH
T18C4533087396010ED173B9FAC88991C39093BB6ABAC65CCFE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4e6e35a69328988ee17d189744d6d98ec8a9e20b9fc978ac9223b6998f372c77
MD5 b7f67a14369b0823b5a4d3c140e66b46
SHA1 9e328bdaf968884aab13108668d418935ae5a05b
SHA512 6cc3cb475370cf445d91e29b8af4d2821b669fe9a9d72696f6ad672fa260e9c3c9110b8556ae22f816d123340f722336f00fa14b23836048432f41d7c4ee2b77
SSDEEP 12288:efwvD5ur64Lk3tRX69qkyAI5hXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:efwvUk9RX6wkyAI4743TvRk6NwG
TLSH
T1DA85D029EBDC04E5E1B7923C89B7464AF2B178691B31C6CF029A536D0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4bdbe803631f59db1dc420976287da8b2994f58cbd17cf34520ecb2d2a689a96
MD5 8141625098d0c5740f1fe5da524d1adf
SHA1 2539fff874cbb36969154502ab16c445db2115af
SHA512 23e8f1e3ffaea343d558a37e0d70247c7683653e7ad19e2b4b5f691a30dca24c5d73ffbd77838cf2a0fcf15a138f31126ef817821aedafcba30563224c4064a9
SSDEEP 49152:pYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iDv66mG:kySzP6Dv6V
TLSH
T101066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6a5a72854d218e360a2eb4ba40693976fb643ba74dc65c677635bfa7ad9e28e9
MD5 caaf3ac10510bfce57c08e78ad25582b
SHA1 8df93e9174c6db9e233e3970e1c63eae338d70d9
SHA512 40fa4c7960a804468d18a713f7946bde614c916f154ef0256a582a561b815c811f7e3086f92b3d5d944dab2b39a4d37542cf69810c53645cbcfa88e551f9ad40
SSDEEP 24576:x47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY3743TvRk6NwG:x47JUQjTirIhCnDHUPfF/SDv66mG
TLSH
T18365AE1DA3EC01E5E1BA927885158A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8aba147b16a3e76f74835e37bbef2f5bba99effaed6d59eb8f2286b3cbd355c6
MD5 766e5476594b526e09bb8f6e7e78ff57
SHA1 df02937d84be1cfe6a307476656f7cc34d857f72
SHA512 2b5fefd806ecd2f859e37bd42fe0645e7e05c924cd9328fe05b977fb2765578e7fa8b90434780926ab31e8e9f854b7c32191591742c130c61ca840b66de9523a
SSDEEP 12288:ibsfjXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Zk743TvRk6NwG
TLSH
T1BD55F019E29802D8C06E6279CB458681B3737D2597E1D7CF52D0F93E1F792909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 892KB
SHA256 b8de58d3ad01f3402fbd07e912ab49e79cdbb57d62173a85f9c15757d931b78a
MD5 7937ad1c84d405da1b8ec2fd323f1b8f
SHA1 026663ae026f1dde87f12e4c0ab82789aa66b85b
SHA512 9f83f7848f79062162e969b1c93fa995bd999ed52e3ce1dcb69bf91285789969f3e210a306143b167683fe13c676e7ba7f4bc9cd78c424f16bd19c9f5abaf85c
SSDEEP 6144:hsBC2naXYW/Kd0k8dEotMxT6ZkU3fdkWM0kkPtnKTSIPPO4o8sboApH7CdpTCah8:m6rCU3fTM01VnKej7yOIaSlR8RfiN35
TLSH
T19A151710B666C74FC6A940321E37D6CCAB707D51EE44AB0372C9873FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 338KB
SHA256 857c15b1fd37715a85111acdd07d786874cdaf5ccc155f69fea2eab433271bbc
MD5 441d0980b0967e16388d8368021b63c0
SHA1 772e2b68e37bf6283466d8360f88b481c065a270
SHA512 afb43db56deba0cc26a157ec5360fa405856671875319ce20ba2503596e386e3b40c60532242a6b08ae62ea8689680a1532c45be92f486beacb4208b35a1f877
SSDEEP 768:LelTPBlTz2+EQMxzEE/TBEelTPBlTz2+EQM8zEE/TEdlT+6elTPBlTz2+EQMxzEW:lxhs8kSexFRs2Exd68+0yf8SPaYx9B
TLSH
T1DA74A500F721F309C0B751B29D65C69FFA38F816EF5643073AC81B6EEC963426679692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7c7631835aee7cd99b965c60d3e63dae863de2f400ec193f0da2a493a57098a9
MD5 ec7c458cb8b7b78af0d3a8b86e2e342c
SHA1 3c733a4c5fbabbd7124953cb79cfc02f34dc5b25
SHA512 62761bf34b57844052fffcaa3e0f2ef0aee546fdc5c8cc42377172da182b74753f9952a841e0fefae5638becd9254a2ccad95564621a9e430a73e886485ecf96
SSDEEP 12288:Tz7bXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Ds743TvRk6NwG
TLSH
T1484523147399050DE5B3BAB9C48DD1E2601BBB759F808CCFF619A9A168BC1C0AF75B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 44366966f90e13f647781e355a30496fcb7c59412c5ecb4cdbac94dab8b6fcef
MD5 324f23d0b83d63aba6f6c72a044929aa
SHA1 2e43007ab226b14f17f544948afbd5521a003209
SHA512 7de7223cb66f5e6c74c61a2043964aff9dd19b9d909984da2638cf5bd7c877ab14634f00696cdf7cbbefb1fd4eb2f4a80356ec6aa3a20ab2bc61a383c920e630
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bY6743TvRk6NwG:3gb4mBIBhGFEDv66mG
TLSH
T1DA65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D6DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 311772ca3a1f824cbf6776d731615b050a125380a89246f4698ca55bd2533eb6
MD5 3d43ebffa32deeaa566e301b9396edf1
SHA1 3ab1d59398d037b55d7266e419993c3ca9fb1b12
SHA512 0975edc37e8b8e413ff9d2e60f5b0f897301c7952d0f473923478002a39b5fb8dcf51d5e8abe3633578e1e080e2ea130dfd670165609f4e8cf78281f4ad7cff6
SSDEEP 24576:OG88u8FpJqH1bzria7/mH743TvRk6NwG:F7ZFPqVea7/7Dv66mG
TLSH
T17685F16577E102F4D477E138898646A3F6B2B8250364EFDF07AC8A511F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 92cf4fc4b61701b839224a65049e78bca4dbcf47815616a77872309d0ffd69e8
MD5 d12c929bb8e193a1b7ba28b79381e65b
SHA1 c4d92c87d1cc4cba7ff8173608edeb9d65f92eca
SHA512 1f3cd5d1fb7befd76301a3b62046fc84919203670419a4680186d9da2225ae91666339814405f5f9b12ff038f60d575561e2ca00bacd4b4d13cea600877c6b26
SSDEEP 12288:eHvUrBFrEjwaQoXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:ePUr+NQT743TvRk6NwG
TLSH
T1EE65E11E32ED08E9E677E17DC5828649E772B4621712D6CF02E0817E4E67AD8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 86959e3f02147998c9174f007503c3997d36477d2093187d4d52f5c3534ad3d2
MD5 60d89f71155199214ed9e46dabf13af3
SHA1 4de0a88b6097efbe1146f4c5c7d518f361066dec
SHA512 2fe2d30d2aa8b041fed6b3b210ee260c8b21bbfda24c78651922a3b08102cc290d626af4684bf493690d3a56a283076bc9696d317599522018db5f25685fbc8b
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYDv66mG:mG05lO43b9Dv6V
TLSH
T1EED5CF6E62EC01F9D1BBD17CD9C6860BEBB23415032556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 514e73ac4da90adcbfbab36e380a30cd4073a1cd64bfe8e53d78199a2bbe3f88
MD5 b2e047ada3ba7d10b4bcf6e42ea27b20
SHA1 d25da05510b33ed09cce234612edc249af10c186
SHA512 f5b004354c07bdc523b1051555a104a34a9fe22d72d1051fdcdc2e9ad4aebe4c7edab1157615132c936f43d9c734c3ff0a9e326d04a026c754e46d863968cb8c
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnZ743TvRk6NwG:Ia5POZ3BJt2pasx2+mwDv66mG
TLSH
T11D65AF5DA3FC01D5D5B9D17DC583861AE5B1342653329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d837f43d470d322396c46c7cbdcf888b2709d13a4fabda03ffbf2326ff6ee905
MD5 dc80e03e2dc232806fe1b46d19a78368
SHA1 5a1780849b7fc17742cf6c4ddacdc39c52a7ae01
SHA512 f2bd6f289281adc77f031cf0a08e1eaf2d97bc1fb5a3c3838a64ae151d5c76009318219fe9f76b72ecf43cae10c27bc029aa3ce83774806501d1e12cedca72bd
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fk/743TvRk6NwG:eNc/zEOVHFbDv66mG
TLSH
T16A858B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f839d74258216403dde9b5ac9f03e4a30e982d5be804c1327f04b7026f1e3da6
MD5 f3578897f6f2e34d6fb4732708275294
SHA1 74256d00c517ba84c6ac75c76eebaf74936e4cd8
SHA512 feed188b8d725d1b4de7cc27c5a82e91facded1a865aa439c10407e1f7b15c5a3f9453e9d79a3fb4920ec62f0852fefb669809eb3dbcf153d45f717956cdb4c7
SSDEEP 12288:RQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17YXI7vgbrWVQhTCh:RTkNvNnaFeYhJNtmZBmd743TvRk6NwG
TLSH
T19755AF2EB7B806E4D1FAC6B5CD238512E6727461173293CF5290C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3cda63e8901258789297c3fad8b5c791f6a8dcf54fd067644e8e8de81519aaf7
MD5 51bde659ad3d7bfeea32dba865a2868f
SHA1 298c5c6791e8c95702ad0497fc7a4416d1e6fb4a
SHA512 58d1630bf5aa02eb3885b0cbddcdaaad0aa4ccefe900bcd364c3e70bf29a8696b5ead798ea6462856edf92c609d597640c1603f504e11e0fb81551c4322027e7
SSDEEP 12288:WQcMxWDXN1Dp/fshBItT1IQgAPXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:sD3FHshBIYQgAQ743TvRk6NwG
TLSH
T16375E13DE79C04E4E57BD1BCDA538606E67238A9032269CB0294C1B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-427-0x000001E195E00000-0x000001E196048000-memory.dmp

Download

memory/260-387-0x000001E195E00000-0x000001E196048000-memory.dmp

Download

memory/616-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/616-365-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/616-120-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/616-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1100-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1100-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1100-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1100-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3104-401-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3104-95-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3104-402-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3104-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3104-89-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3104-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4540-308-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4540-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4540-78-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/4540-83-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5112-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5112-366-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5112-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5112-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5112-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5112-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5368-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5368-138-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5368-127-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5368-133-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5368-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5996-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5996-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5996-23-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5996-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6028-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6028-46-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6028-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6028-58-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6028-40-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6076-0-0x0000000140000000-0x00000001401FE000-memory.dmp

Download

memory/6076-2-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/6076-8-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/6076-309-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/6076-87-0x0000000140000000-0x00000001401FE000-memory.dmp

Download

memory/6076-7-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/6076-315-0x0000000140000000-0x00000001401FE000-memory.dmp

Download

memory/6180-376-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6180-369-0x0000000002F30000-0x00000000031CE000-memory.dmp

Download

memory/6180-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6180-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6180-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6464-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6464-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6464-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6464-307-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6620-52-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6620-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6620-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6620-306-0x0000000140000000-0x000000014020E000-memory.dmp

Download