0ac482d59d87b2e168156f6b632e5c83c5e7503abd87a3d652de9cfdedb3a33a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Size 2.1MB
Sample261015-3fca2sef84
SHA256 0ac482d59d87b2e168156f6b632e5c83c5e7503abd87a3d652de9cfdedb3a33a
MD5 f133a51b6840f0db7a6d0bc16f175b5e
SHA1 7b878322d463145e430c85e833b33737c588ac15
SHA512 6f3af00336b811df6c1b62fd82650e1c5a74f738fe646cf4d8471640c759c0396d24bbc252c3027ae666910bd27242c908c0f857e0f0e8ef84daab3e2a700216
SSDEEP 49152:rlYAQ/Gg4tSmCS8sIyNjWX6HT1i2vUo3DqqldPx:GDG3/ZDDqIP
TLSH
T163A57C12AA8988F9C159C4749646C7B2DD613C8A0727B5EF06D63E273E3BAE01F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6136	elevation_service.exe
3048	elevation_service.exe
1924	maintenanceservice.exe
5908	OSE.EXE
1812	PerceptionSimulationService.exe
1588	perfhost.exe
3092	ReFsDedupSvc.exe
3744	SensorDataService.exe
936	ssh-agent.exe
2312	AgentService.exe
4408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\da18e590612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084f233bafc5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef96beb9fc5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbd71cbafc5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079dc15fafc5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4864	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2312	AgentService.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: 33	4408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4408	SearchIndexer.exe
Token: SeDebugPrivilege	6136	elevation_service.exe
Token: SeDebugPrivilege	3048	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4708	4408	SearchIndexer.exe	100
PID 4408 wrote to memory of 3484	4408	SearchIndexer.exe	101
PID 4408 wrote to memory of 5660	4408	SearchIndexer.exe	102
PID 4408 wrote to memory of 1796	4408	SearchIndexer.exe	103
PID 4408 wrote to memory of 1420	4408	SearchIndexer.exe	105
PID 4408 wrote to memory of 3616	4408	SearchIndexer.exe	106
PID 4408 wrote to memory of 2092	4408	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f5c8885b136cd73919710388d64533ca2b877f75bcd2b1033be87fa69f69c53
MD5 9416e88113641801b898e8b9be8071ae
SHA1 74f14294d90225e5515b1006d04d43d61a126e8b
SHA512 4ebeb508aa807564f8f12081672fd3f18331c91e198bbdbcf25967da7e1f51402b75c8e1fb820d40b706d7cd9c5ca26c430eb493a390644d88fee05fbbc5e912
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnz3DqqldPx:93q6mjB2DqIP
TLSH
T1D7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5c7bc2aff87369734970cf922fd0fe35a557c2c311224356c8e0f6289dd94de5
MD5 b610bcb17f78395d38fa6606bff72ea6
SHA1 4a541db2e42364d5f41d5617db4bc9f961940b10
SHA512 7df9489f61d5b14b8782c6c90dc538cf0d7d9e146a31e94540935bad13260c873e6ccab4af464656d09b4c771efdb1ea4908ae2f7d0901ae4aa54d76a7358eca
SSDEEP 24576:HXYfDtczAmGEDqHKliE9JdpTCePo9L9QIE:Stc53DqqldPx
TLSH
T1BB65F12877D109FAED678238C9B28512EA33BC554764E7CB03E4A9254F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 61a4e79e21bc01aa0c71cdf3da298ef9c30dd2c627624f78c06ee664c1e784f2
MD5 ec35bf4775130d988cc4a4300adf31a4
SHA1 7860af6f2cde5d7c6017282797269dc8c5c7d012
SHA512 80e7d937b54120c1edb735cc6267e88c817834def4798cd9c15cb552c31866459e8271978eb45c8ddeab0444ae93559809ab7914b03ed44efe3e968697a97152
SSDEEP 24576:10Le5ji0hmxgrMLGEDqHKliE9JdpTCePo9L9QIE:1Pji0Aq43DqqldPx
TLSH
T113859E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ab4bb4718c7dad47c3f441044908c79fcfd80392129807746a811ee6c5c8c873
MD5 4f19d6eb8eaf745d206b1bfed8e4c06a
SHA1 c9bc19863495fcd68c808464f5bc9a7593b01400
SHA512 d050f74ca950674ecc80fb19bcc2249cc84205c0e304aafcb20c9e495c3294056bac0735d558077d5d26ec1f0c29ac739433392cb0ae6ed6c424076c8fbe0b30
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWj6q8wyuJGEDqHKliE9JdpTCePo9L9QIE:P/ezSC6vUzPv+Hjys3DqqldPx
TLSH
T1AE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1cb97ba3c62674757806a1f2d45ca19ac3406a6a7cf347f403fc3d1272cd5376
MD5 2f95a7aa944e4d8ed34ea0471ac6289d
SHA1 1316aa6e0cc6124ee8a6a7572fd23761e727fb0d
SHA512 eee41478714c3236e6a25fb919674b5968143d1bff94d74d6c0577164e44b2a28ef82ace70dd5524dcf50eb36512dfeaa777fb5301a4ad981e9ab02a80359794
SSDEEP 24576:EVbqPb88hv/l+ByGEDqHKliE9JdpTCePo9L9QIE:EVO88hXl+Y3DqqldPx
TLSH
T11755AF66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2131942d01053dab0c6ff12c6a9381283ae13ab2363e09dec38eea4fe5c1e0b9
MD5 8087b0ed31f2c0e3a170ab824034ed47
SHA1 d04d9a8afd03b25f607a6f120ece7798c0f3dc01
SHA512 242d3598eaf28bae514b7f2c1e84ed10560e2f6a8eb0be780de5a1199cd457cd0243e2babc4b25fafd74a11cfbc9d2ed7c908558a16c7091bb220f3de43427d8
SSDEEP 12288:N43hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:N43GEDqHKliE9JdpTCePo9L9QIE
TLSH
T10255230DAEC64AC3FBB73A3057B86167FD25BD982C6E768A8B833D01C479479E45B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4e2bc7f99d943f47705d2f9a5258f9bb9880059b6768762f5cac6ce47b4a78a0
MD5 dbdddcda2b4514f40abc7c69270c3635
SHA1 95774583c524a6fe748f83b4458d958b8d9b1063
SHA512 18d5d10b92bc3675aae2798a6626f4c5155ae01d1ea0ad0e83ee1779c8f31e7a4fd83a500a0283b549c236578639f7d061abcaa708312275ba598804413f800b
SSDEEP 12288:reBNUbTVO86UKhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:rJIUKGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1CC75C03BEE28FCD2C27A5D785B918200E77278704F62A3CBD165920ECE235E55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 917c488603eb2a34283b5c624a4f1419c6dd3a6f0167da9b06860bd04d0d0342
MD5 ae7eeed2761670493897edbc1096d305
SHA1 09ebc9e0d8670d467d71ff1a1352b55b5fc09aeb
SHA512 e57f0444117e4dcc31f8c9015a4f6e92cad4e6f1089610d6fec9f7069f6567f277aa663f6b7e44af312a1c96493511d844f012a6ce75ffeb2e426b6fed631dff
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THc:MQvGAdlCEL8c/WRNw5CFDqIP
TLSH
T107267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2cda63019340e5cb3efb2b4176f20673c9f53e299f415def69ba8decf6c6ea79
MD5 af2ad19ef6dbdce7516591f100e4b898
SHA1 f8dcac3c4b09a54d9e6f33e96a62d7189c6530d6
SHA512 3897a58fe3771f08c8610ee38f7014cf826f1bb0a18d418d501300594f2316dd15fabd81e60f0bda67e0f94e80e5065be67fdd424c8de2e2ff383b969cba4950
SSDEEP 24576:vUewsAjIGEDqHKliE9JdpTCePo9L9QIE:cljI3DqqldPx
TLSH
T1A375E031FE75E432C7BB0DB21B35D716682DB9204F621AC3E3E86D8D89741D22376A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bde8cc757cb9848117c3357aa1bdfd6040ce8241e8b53d6051d1bb9840a037a4
MD5 d66305a80538bec115eb947ca339438e
SHA1 5528cda22afd8236d90ef8a2f54d451cadf7acda
SHA512 0a6336368d63e431c9d7321ce5dc9b8fa2728163e7c27e6a492ee6264f77f73a449265f3b23a18be4625b370f0ed0186cbb0ea82cc0097a267b404efc149a56a
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH4D:jUEtQevvqc2W1cpV20I324
TLSH
T123474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2da3c407737917c355068754fd8eb0003259759c28bc37ca3dc53ea2ea751dbd
MD5 bb2b1eae5af299c6f63659bf3b7a73f8
SHA1 e009a80763aec825b4417930dfdf23df2362aa82
SHA512 e5a3023ef3a68cfdca450ee0769ec09d0f0a66f3566551ad2b32500b85cd973677c6a62c4500e01afa1785f627e844a31aba63fd775282c7cdd91a832a19cf1d
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/zo3DqqldPx:uoqtVjnmRDqIP
TLSH
T1B5D58E0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0fa808a400fec1c773d8a356cc530a544237f0ee720f2c38ce037da274058347
MD5 d75de685655d02c8f7d5627bfbfd4b60
SHA1 bb4e7f01f1a2a41519856ab076f6d10eb8fddbaa
SHA512 38aa85e9340ea9ac9fed91d344d57fba1c53d97474d03101e254f1ed19182bb41f4748938847306ce96292f641cfd2333a9440f87b6eeb650842c873aa6df82f
SSDEEP 24576:lAhGL6IFoiwtA5l7S53NGEDqHKliE9JdpTCePo9L9QIE:lAM5Foiq593DqqldPx
TLSH
T12535AD80EBF945D4F5B3AA7899B69171EA76BCAA5E31D20F2150D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9b2ae7309aed621ce99bbca30f4409633fb7a924de2a91f2bc033fb5289c619d
MD5 b57e84d13ef8e94ed28b5d069c3f886a
SHA1 47d8eb0a911d09974004f1505bb36248d56de7db
SHA512 1c3e22cbbef8658c062fa7df9fd7cc2fc8a433d83ed261f54b75394daa35bbbb9a4c502af7e87a5e9c44c324859594e719c13c2f021c67d36553c6ebb9ab8ce6
SSDEEP 12288:vmw5HEjsChNlBFgl0WDm+CphoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5It:OwuEOWMGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14065F14976E50CF9E9A756388697C136F7B2BC012A25D70F0760D64B9F37221BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 93e35f77f2996a961b9a4005324edaee5eccd46ede5ade6e51833f4b63a73c7b
MD5 b50cb438010805a7228b5ad0c0bc61fc
SHA1 b15b47f420caa24bf9b189b17124f66ce69b0df4
SHA512 1258b9343842ee08c70509895ee17969bab9602c934ab9dbe53a88dbd92b3b9c8a8deb66eda121cb06840e88d5e3f10bd531dfdad58cd78883e501a504ce6966
SSDEEP 12288:fUZ1IyYhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:MZuDGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1CA55124D36D521F6E2A36238CAF05206FB727C56273A53CF06523A468F339E56D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4cc1b02d2659393a74271fbf1727f32b8fcf82a4f687febc61a826ae39ede1d0
MD5 de33eabaebd9399f95d2a20815f8b758
SHA1 36ee1251a629280d564afc2ef4b98c17fef21405
SHA512 4b7b8af27ab898abea97e444ffc0b0a36261d72b2153798a43fbcc230157328f809c8ef8b9bec8ca7efa4a84bd598614ea431780c73449c8ef2bd136c913b6ce
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UQ:sQRQyi36YOcPDLvw2gAf+PN36DqIP
TLSH
T111667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d47d149083fd59e633c13b3bebc7017fe212808d23c8597f610eaf62d56d10ff
MD5 1ffa66e589680ede8424b4459f7783c5
SHA1 e6f075cf74f7a658155d7c3e066a5a7cbe1c2cb0
SHA512 1cd560041306cea3663a20aa23eaa00803232672be373ac2a7f9311f1ef6b257f505338c861d4c3e1b48677abc26e610f510de74449b0c1691fb806a9e854ccb
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UQ:eQRQyi36YOcPDLvw2gAf+PN36DqIP
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4f43c99f13e25d6d0d0835996074668acdaaef95bd828aa475f08af321529041
MD5 7e2b14452dc33e8321865cee26662e8d
SHA1 2948cab6ee1383901a679f46d3eabbfecddc4531
SHA512 841eca5e135976ac92b7fc572379b2d351442762b2e442e6933d3a0d40add5612fc86ab43ab8aa3fd08316d0e1ce86400a816850a3dc66d74ffaaac134ab4cfb
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0zGEDqHKliE9Jdpl:g68Qg55nhkeWu7PNU3/43DqqldPx
TLSH
T15DB55933B2F20099C44DE1769F4A873196E27C758FE1E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fb4575e244e4f3db1a316146a8772f5a83fb98cb0b38d38b4949003fedbc7eb0
MD5 e2786f4c02e1cb00fd97074ef5eabeaa
SHA1 b04507e444a2210a4067c1810f5088d135a73a32
SHA512 717cf8b1b5412766ad23c14e76d45f54863513821d8a7fecaf526867e5bfefc08dfe41e8c418053d89f219af0d7e0fce2193eed61f0c51f6db65a49e9745664d
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk992:Xy5112gYy5azzVvU69nLKnhZnDqIP
TLSH
T146167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b6a8256b60bf4fa284879378622f47620ae7dc84fb1f28a2fcd1b1fa45889db6
MD5 c91b10e3b1e158d00789be5c72f0149d
SHA1 f641a2fece3c1059fa9bfd43f85e7833c7cb2cd8
SHA512 869b9f7c3bfda06bf0fbaa8552e955c7fb6d31aebeb6ea6724e90b0cff1a6f518f793a5285d4aa958009f530315f1551ca6825cbde6a2ccc9dd07f052688e19b
SSDEEP 49152:rB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glW3DqqldPx:9u6JmIxd2dyDqIP
TLSH
T158D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cb59d67596ac8b79ab6ccd1bb8edb9bbde76dbbe3b0dfcd01f31d799a2ebe1de
MD5 397741d0b30cef5380acc6e1b70f6098
SHA1 3633aea104e7590e249badcec1b6b027b3499efc
SHA512 0d16270b5c4d771eae138b0ae230bf738ab199098cefe35e247c6fabeac286b1ad938b3f1e6e808f983b42d0e60fcf3ebfc5ac905b27a5e74e7b28babf90480c
SSDEEP 49152:+1hpsNoJpF1A67U44CwH7R4xq3DqqldPx:+mifPqRRDqIP
TLSH
T14BB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3da9a44116820bb2951c9ae6a7b3e9c5416c05653bcf41d0dd36af3760f677dc
MD5 a24d8e40bcf79c842aa158c91810b2ca
SHA1 59abf479327f393b5a6368e251a214d695ed742f
SHA512 2676e50ac8c19675813890412656cd21b1e96604ef14ed5990dc1b5828a7220e3d4fb970ff8f3928cd48b48e93febce001a21f475992558a3ef4acf57efebb64
SSDEEP 49152:ISuZQIY0Be2KkRVtOnks6NMHqD3DqqldPx:S5dKqi61rDqIP
TLSH
T140C5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fedb6605539de60076864effd1096443150fe5d3c5f40f154e819219493ec1a5
MD5 60461fa7fc756ba49b1f4b46da3b438a
SHA1 d1272ddadcadbfff35b1349f401ae278333f0ff5
SHA512 3692a8588477681e327c31c334e9025182ca35c43ca32816a518ff5f2d07747a0e87303c3bfe7cb85e0d43a1442d4c1e80d1bf6d51344b676ad3a94e65e926b7
SSDEEP 49152:nhtSn8EApI0figjgiDn0AP5wm3DqqldPx:2X2iWphtDqIP
TLSH
T17295BE13F2D900E8D06ED174C7568632E962BC160B39B6EF0A9076561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e227e8a5b1543851b5f48785ad68cf48e900735bc1127b21dc559cd71ad508c5
MD5 4140ef8e743a320651bf5a8841e82648
SHA1 6ee8add138f6de8e97e4edb220d7412e7ea08b5c
SHA512 f05c14e32e8f495a57e84df62575a2a6710956c3cf9d0be8310885a251fd4c5fbce1d0d2244d95c105d1f8a19a109e132bdba8865d6aa570551a0cf689d51d0c
SSDEEP 12288:EPhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:EPGEDqHKliE9JdpTCePo9L9QIE
TLSH
T16655230C6DC747C3F6632A7187B42267FD297E8A7D6F328B57873801CA7A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 18a3be7de553071cc5bba3f3aa67db41963b48b300c6755d0136e7cddf7825c6
MD5 8c1261ee31609cc65382e73d35338a68
SHA1 76f5b098e4ac2799128a504604a03500321f60f1
SHA512 7cc26c823fc155e8361167612222a12acc6b5df8548ca5b66d7776a10d9495a4fa023f168b6c568d136334d9fc76e78a0bcb51ec998032eb118dac3e7c9dc793
SSDEEP 12288:QUhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:QUGEDqHKliE9JdpTCePo9L9QIE
TLSH
T17455230CACC70AC3F6632A7157B42267FD29BE9A3D6F328B5B873C01C67A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c51bdd62f46e196ca70c14db965aa911a1d260158d8ce82d61cbb904d412e217
MD5 dce2e84414b403d14a8a3e4c8a23dd87
SHA1 06d6a2d89ec50534b038a55d485939872f9591c7
SHA512 2abb7ddbc06ff0332390df65b9f4cabc59e0c1b0032f9c663a949db56bdca6ff640b1016feed674a6d727613e7852600f26c4f14080b89fe7c9b2f16bf7d2533
SSDEEP 12288:0ihoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:0iGEDqHKliE9JdpTCePo9L9QIE
TLSH
T17D55230CADC74AC3F6632A7157742267FC29BE8A3D6F328B9B873801C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6ba2c93c15a41145fbc27dd67f8da84de743b4625f5eb0eb14a392b8c0136f82
MD5 91e33f19a693195f349346f3563eb470
SHA1 2b435dbfc37ddbe7e3a72e214977f625c8982036
SHA512 d58286bbf657bdc2fa227693d86eba34197bbfb570657bd6b40eced3b6a2601f843628a83531964f7d1502dd0f5efc21722fa77f0b9d633de1a692261782830e
SSDEEP 12288:SVthoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:sGEDqHKliE9JdpTCePo9L9QIE
TLSH
T10E55230D6ED706C3F973A670C6B55162FA75BD997A3B63CF8B423C01CE72074682AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0b72eef4fb7f373e47128f4b3c71142ca0d1f5908291495ec9c96e793a46226d
MD5 b2cf5b762a204669927ef68f9e4bdae1
SHA1 979622bc3c272f5a57b73bfd87261d956e59f62e
SHA512 010ff5e930d073720d2937e4c1efb7f8ef33f72fe155628eba235a585bea7efc1fa5057fdd917f9b3fb5756135f348c5ac4e567ace9d209e9320d1780ed446f5
SSDEEP 12288:rVhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:rVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T10755230CADC746C3F6632A7147B42267FD29BE8A3D6F32CB9B873801C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 061b8a8d7b52ade3e330aa4df9f1aff04ff664734b3a45c3635c8a4c75306d70
MD5 2f3c5d6f29a0bfd184c6018fff7aa3e1
SHA1 49cdc813cfd6dca5736dd646690f88ad1a98a18a
SHA512 20c780cec786567b484c74eca40c236136e8eb2d9a8e27540d0250ac387511bd12c960a47453c869ef997a2bdf5275020bce9768fad3b091d9c3c2a3c51e82eb
SSDEEP 12288:IghoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:IgGEDqHKliE9JdpTCePo9L9QIE
TLSH
T18155230CADC70AC3F6632A7147B42267FD29BE9A3D6F328B5B873801C67A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6cabe0aef288871913c4647f1243acd624198f907210c3a336ded4eece9f1528
MD5 1662903f1854ad23177bd22fae9daaae
SHA1 320ef060039a7ec4faf5b43dfdecd87bb4569fe1
SHA512 3e90d9dfa4d39bb23199a98ec26398b103bcff9b15f5e8d2a3612d061e38d6eef9c1ea461ae9c568b3e3db014d584a81d2aa9ae5c95650f7d5c2a79b433da88f
SSDEEP 12288:k8hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:k8GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1D055230CADC70BC3F6632A7147742266FD29BE9A7D6F728B9B873C01C67A439644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0fd70682ea500656903a4bb4fe4fb4c975ba135a075423696f9773a8e207db6d
MD5 d6bfea4a3e7b82f74ab65921cd7dc138
SHA1 ffcc4425c6120a5e12a804e93f1002a9a8db62fe
SHA512 ef1c126f21f5aa838127d7f202777d18a25aabdb88410e1b99e198b49bfd40408749469788a163c0363ff22082f040c2f10fdea41014797a0a12f300849eaa41
SSDEEP 24576:UZM4zFVSO0GEDqHKliE9JdpTCePo9L9QIE:UZM4zfw3DqqldPx
TLSH
T12E750199B39018F5EC67823EC9658916E6B27C5A1B70C64F03E436179F333A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a5777a50cef2510d9a83e6a115c5be0307e711a6b7b1459f129ac03df6772c7e
MD5 55f2d330e51da3563100e44d503e1cd1
SHA1 2b78ae9599284ff95339e3fe4fb432dd64cffaa6
SHA512 062a7beaf83b75cacf9dd123d832635c15afa44cb44e35daef652b1baafc3669c02da70131c957e5a3c2627a702489c3cee9a5d44b4e47fb833bff9bca0b3b0a
SSDEEP 12288:jThoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:jTGEDqHKliE9JdpTCePo9L9QIE
TLSH
T19555230DADC74AC3F6632A7147B41266FD28BE8A3D6F32CB9B873C01C67A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f892a9e5a73decee0fa4d7b4bb16290cf278c0b09226090a758b162b88af192c
MD5 d76f6f105bf9603ebc76b27485f9c7d5
SHA1 0c7efbafa8bee0b389feb4e43ea9b38f4568df9f
SHA512 c37b8fa3796da5fb5c683527208837f97d25677ba1cf3c71657c7543667812dc92a2bbf897e4b08094277610c61c037105ee9839db3ad2de36d403753daff105
SSDEEP 12288:OHhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:OHGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1F855230D6DC70AC3F6632A7047B42266FD28BE8A7D6F328B9B873C01C67A439644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 895d6997269305afc0b2743c068073f6d338765c7355b70e4470e359dcfc67ff
MD5 3c43f5b2f31a922a080d1a160db5a019
SHA1 3423dbdacd715e50408d4159a6563c5c8b2be2d7
SHA512 4851f1d5a1fc1bc0ca3d22b1f482ec840062aaaf73dc24d7e225462abf0973d0744639ce471ed24d416b04416e89e37bc99db47237ce3c2673a71a4e7eb62cc2
SSDEEP 12288:ayPz5L8YhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:HzyYGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A765120B77A221FAE1779234C9A11602F771BC361B259B9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 21fa564362f486eddb6336bf9b987a12eabb66bfc4014c43561c334e9b1a9c87
MD5 bd00d66093fd92cd841e55e8ac41f72c
SHA1 cde87a160240415e95caa80922be23b1b2f49124
SHA512 2c2e705156d20e9d3e57d03f7d558e23e6126d631f738cac83f626122859b92c6e1a8d56b3db260bb3b84ddf401b47c2aa8720f5751ecfabcf3395e465e0078d
SSDEEP 12288:FThoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:FTGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1E255230DADC70AC3F6632A7147742267FD29BE8A3D6F32CB9B873801C67A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0b38a4a09130c08f21ead862430bcad514033b5ed92837803813d9e8ffa39b01
MD5 1495023565a824188b49967cb4ed739a
SHA1 d550e9c6a63f3560e94053ad1e220a9f35e3d203
SHA512 061a6483774fd923a369ad9f2acefbccd87cabc57dc9a10f5f355f54c4881b1f44f8d11be388cc6cd21669b03919a373dcb2294565c92f3d4258428e54387b3b
SSDEEP 12288:UThoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:UTGEDqHKliE9JdpTCePo9L9QIE
TLSH
T16B55230CADC70AC3F6632A7157741267FC28BE9A3D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2d72e15ea6b8548b3f5f0b1e15786e8724cbc645dd8aebf1b858b9ca82806ef2
MD5 9c4063ac28fb2d09494007cabc05e907
SHA1 35ad8e439e8e7d82fb96518c58f7d5de1fb45c92
SHA512 0e70e2ab67314012d7986df86ee9de2e9fac9ef2022c69dd71cc4577ebe20b27fef887a23bca10ceb8cda4ec5cf5c0b5aaa69e30fa4545269d3a8685403c14b2
SSDEEP 12288:7yPz5L8YhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:2zyYGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1D265120B77A221FAE1779234C9A11602F771BC361B259B9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 65922fbb30b26029f8d2acc89fdb1e175a7ef4939d97e0ce6f1f89c85f38cf2f
MD5 08ba09a1610ae408025f03b0b8e8589f
SHA1 f6884823e955677a2ce87ad847ddb355e2eb7d47
SHA512 6ff5dcb19320e87097e549a0ff2dbf62c3afa72adaa5c0c82c88a15081280a9b55a67485959dc62231a2d9d4855f342faa39c1510af710187f05ccecaecbb9de
SSDEEP 24576:nT1aLl3z0zDSGEDqHKliE9JdpTCePo9L9QIE:nT4LljJ3DqqldPx
TLSH
T193750198B3901CF9ED67823EC9658916E6B27C5A0B74C64F03E436178F332A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2f2972cab2b4537704835f71a3a90a3110e4e6136501a483b72b4840a6ef0030
MD5 be71dda88dc9e4efe3c44571baa310ea
SHA1 f8ed230613b6427d4b5dad2b1287295a59094a54
SHA512 79e1e53f5bf5d58f49a5304294e0aef3de7a478051ac14b70ebcb2d75f0d78e25bbb94a0d484d9f4ed9764014fcde397d020358ba516b69b1e25c8fcdae02351
SSDEEP 24576:X3ld9CHKy7GZeGEDqHKliE9JdpTCePo9L9QIE:nld9CHKyaw3DqqldPx
TLSH
T14A85DF90F3E414E5F0B79A35C9764512DA767C9A1B31DE8F03A4261A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 13814d63519213c5825bc13334ea541af4f25d7a816cc1310ef42e67ecae533a
MD5 68449cfdc34161a1df4ea9da0f4c32ba
SHA1 c52bc0fdaaffc6ff186546b117aad76c197b42d1
SHA512 1b3868a7dbf5c2f38b703c2dc00812cc4f734e180e1ee23831303fd0e4d51379fcd1900ddddcac7125a26d2acca73d12474ce1b0b5a2d0660a2acfad9bc4e256
SSDEEP 12288:jChoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:jCGEDqHKliE9JdpTCePo9L9QIE
TLSH
T11455230CADC74AC3F6632A7197742267FC29BD9A3D6F328B9B873C01C67A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cccefdafaf96984538b1e2a871e70652b24fba7d42ac3c51fe96db1595501cf3
MD5 8e8d82d47c42ccd8eddbe8bf1f67849c
SHA1 5b751e5fca8c816d18e74104bb5632cf36878744
SHA512 5a95760e8f23ce3cba38dbb94277afc2ff911ea8b121fa3e74762078e4340af7673532e98cf3e1c5767cbec584f809541c51391bb8cd50dbde1c7cddb829dc3f
SSDEEP 12288:c4hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:c4GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A055230C6DC70AC3F6672A7157B41263FD28BE8A7D6F328B9B873C01CA7A439645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5a08760be9c42240ffa46555d383a2f9ba34eb11ffdf76fc53bebdc479821f13
MD5 0fd49bb268cdf4ca1f470742d13521c7
SHA1 804170c0a08bba63a6288115cad06b850b74e743
SHA512 665ab150aaf10f5bb680426cac3d164a7b60944beb11991acec7896c2a980f4d77864dcd48d6167a189e3eb588c4346edff276b88ac47a09031addd67d35639f
SSDEEP 12288:QxhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:QxGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A355230C6DC70AC3F6632A7147742267FC29BE8A3D6F328B9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2c05584b6da42228bffc5a1ba3953c93b33530a54533d1c79a2b03fad04b7042
MD5 f5e33b796c1c83687822b034b4629e78
SHA1 befce35f47ae925fc3b6ce5d83667c06fb2e4862
SHA512 b274f7d27402311390a7484df4716f21a089f6b7e26255c44392715c1a63be06752ffd9f032ec11fea0affe4aeb69319e9b6c08314762c021681703b88af9717
SSDEEP 12288:VThoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:VTGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A655230DADC70AC3F6632A7147742267FD29BE8A3D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 639f79766821e3dc5430fd893fad62d55a21cd875022634fd1392465d8ff4a56
MD5 6c959764d40522fe318ce637b1563400
SHA1 0b44decdbd91511f8305c59ccbbcc14e39cb5e67
SHA512 3c60503b5eb4b12a5f617fb8ed83700a653dceb1e54fd4732726df4bac12ba80885e0ac9625f8e6cdd54b6aa4e7864992ec1239390566c80fc64e8b7d540bf60
SSDEEP 12288:eChoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:eCGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14955230CADC74AC3F6632A7157742267FD29BE8A3D6F328B9B873801C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ae35dfba1e67b223e8c48c285e5137af905392ded6aa66bcfe46140e44e2813b
MD5 ce5bbb644f24aaf69921e090f59597c9
SHA1 ce85b2cd9137d08a4de6a4509bd6461912e0856b
SHA512 a5c5c6abe428267fff1e2675d0449ceeaf2315dabecc549a01a220fc607a6fd05deb9c13eaabbcee9f84c34c18ee050248d1f5b56c1e8b5aa11f4daf4af5912e
SSDEEP 12288:s7hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:s7GEDqHKliE9JdpTCePo9L9QIE
TLSH
T19855230C6DC70AC3F6632A7157B41263FD28BE9A7D6F328B9B873C01CA7A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 41008354a9b382d18e937d4f0c27b17a6e1c45b676b8ba1b4a879f52447def19
MD5 3e45372ebfca781c7e318f442810ac09
SHA1 cfc77168c97cf99f995da4c0aaf62b0640322854
SHA512 1edba733b3b68d98da586a74ded05f71efcdfa79ed6f3fedd8cd6b5c12670b29af2ada669ebd2b87bb102ed1f94fbca6278f21651830b908def366f9c5e23ee8
SSDEEP 12288:oVhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:oVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T10E55230CACC746C3F6632A7197741267FC29BE9A3D6F328B9B873C01CA7A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 bceb2b3bb6b91274fcbc06d8a043b2f9f06272d9222b56e167556dc00603d9e5
MD5 78429d2a9449bd01d51f37d603134ec3
SHA1 e79fabb61f8086fde44d2b33ede746c623e631c4
SHA512 6b8560eef58ba4b3fc95c6298a33de4038e3a578d575ad1a7c55a185de99331d65764b249baf2faefea8f604b8e2f46f958d3165ae9dbc3381d9bf05dfcb5a92
SSDEEP 12288:gahoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:gaGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1E455230C6DC70AC3F6632A7157B41263FD28BE9A7D6F728B9B873C01C67A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 82a9d1afbba2832b368783c069caef57fdcd793fac6e2e414cb2c8755dc29640
MD5 2754010579babd9de87f41c643913de0
SHA1 c7b31e2da499929eae8fcf4b4fe827244c475100
SHA512 3a60b1d8ca289bca4f434ef8aac214232381c4704a2172daa5ee37caf5484bd3eb9186d6aef37b076a8be3e60a97a60c40dba771b8aab6a22e6b086f13d139ce
SSDEEP 12288:oVhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:oVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T17055230CACC74AC3F6672A7147742267FD29BE9A3D6F32CB9B873801C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c62d7d90513064bd32d6e98bccb2695f8f01f6053cbf7c99c11179a568d01ce8
MD5 90ab7c530ebcc5e5f1e066a027cf306c
SHA1 7ac67591104c283bd6c5c6fa671361f411f26984
SHA512 1ca0898425d4c7933128771ec0e5a01458a90ca2e9a3686022b534def5493902689833ccc6d5518369c01e5ddb0f1fb29965303e7adbd5602996a32db89633d5
SSDEEP 24576:qfwv2k9RX6wkyAIXGEDqHKliE9JdpTCePo9L9QIE:gMnYIX3DqqldPx
TLSH
T1B085D02DEBD844D6E1B7923C89B7460AF6B178591B31C2CF029A636D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f2edf5ff59be04ef1ed95c4461671ecd3fab9a8382acfc9f8d15c951fc4b7a3f
MD5 ba97758e872e16d03f734ff0bce0c0b4
SHA1 4c14ad48f885ec5faab0da6a188f707bb3147cb4
SHA512 21ad6e0b7dc6a7e7127e9d48059c260a48d96e73b1183b7bc2355a05641b0f765d3eb3212e8414099681873aef957dc6b5c0eb19155ea08511f264664cb2bb95
SSDEEP 49152:lYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0G3DqqldPx:UySzPaDqIP
TLSH
T17F066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2e07630dee3ca6fe149e1514de024de8800b3fe6ff64a4da4f8542efa8f83f8e
MD5 0c335b197732cd0b8dea1aa5e71e6fe2
SHA1 bcc6f611bae18a60c3e89c4157c174d90b9bc620
SHA512 28d2c7a4635001c2636182857dee0e8cdf7978791d0a354642cb457a798a145e1b6eac1d1553a95ccfc4111ad1ea44f7520bd38029506b5c880265d26fbbdd6b
SSDEEP 24576:y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYEGEDqHKliE9JdpTCePo9L9QIE:y47JUQjqirIhCnDHUPfF/W3DqqldPx
TLSH
T16365AE1EA3EC01D5E1BA927885154A1AEA71782E1F32CACF12B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 730d7363cfab3573dcd9719ec891618af6b75cdca667280d4d3c573b39405804
MD5 a518874ee541730b3bf29b47508b3830
SHA1 389d05035860398dd7b2c44e038ec136e5b76792
SHA512 689e980b140c3cd6a873a18fb9315561a6ce055859740af67572c0b1b734d1ed0634e7f2f13a66abaf16be11c89b8f5d80c84e5647c9b4f60c74c631f3027bbd
SSDEEP 12288:DmsfDhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:ZDGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1FF65F009D29802D9D06E6235C7654642F7337C6597E2E3CB53C1F83E4F7A5A0ADEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 8d865d756de84828cb56472eec4f52d5311ea4d73902cffde55baea40273f03d
MD5 e6a56855314b3e367adb11db3aeb0053
SHA1 24ab9a094ea002811b69298eb3d6fa28c3829946
SHA512 386c53e6f389bfc8e12a92729985f5e2b894ea37ca9ff47d1a4096af2836e0122f505b0ef3cc67063331e69cf53125a7c44b06ee1e5565c9c299bed27b1349d4
SSDEEP 6144:0sBC2naHTyO0rXkDKLhndotMxcEUsU3f3kjm76uRH6qRl/xI1z4EmVWmBrNyDyq3:9O0z5pU3fVPRHxPx/j0lIqGienyfRDJ
TLSH
T1F23517007666CB4FC6A940321E77C6CCAB707C45EE44AF0773C9873F9576658BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4b90d1e95425d948a3d37c7d388dc736853379d9cf321270b51cb9accc0967f6
MD5 feeadb0483380a22f60e3fa76b6d2a82
SHA1 0dd27530ed527e5cc1288511446859da42b69aec
SHA512 d89e076414332e3eacac231ec6ea181efb2c254adc2cc92f1a8b8a4212b757bde5d24daa5ab433b1acb9967922abed5abc809f54a95bd5c58b265b1dacadad6e
SSDEEP 6144:OQFrAFaj2jnYP9Fu5qDdZk0tInWtMxknWtMxuhsycmRzexp9SEGWLoR+k:BFMFiioDdZks1xpcTIoR+k
TLSH
T1EC75F941A537A78FC1BB1032072A5F8C7BA4EC0BB7456F127389443AD86AB15A1BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8c482480f84244e8c7c8f26d0ea8513134d7895e7b0628bfa35bed3a3e80932a
MD5 5e87de1298cdd7d56596b39219d30791
SHA1 e0f3f92d9d2cf7b26b0606b57c0178a5cc37ac93
SHA512 b24c69200e12b17d93163a93b60420a0688ab9e737b718a0108e10b3b4982d57491516ed6c121cc1f604766dd8df0ac6fd487773e07e421676872706b280b28b
SSDEEP 12288:A67rhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:LrGEDqHKliE9JdpTCePo9L9QIE
TLSH
T16C55230DAEC64E83FAB73A7047785132F92DBE592F2A61CBD6433901C5758E4AC7B510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 06a13a04ed7fef89700f530f6a05e46e9320dd25a7ec0a44a1833d68bd818afe
MD5 3f4782bda0d80c2a7882209b7a7f1785
SHA1 ae2c22b6ad5b793aa8a922860afcc48895c6840b
SHA512 76b1781f8deb698524ce14833eed49d7f75f77c40775108aca04ea222679401822ecc64a80809093be8603497201cbbea06b59a203e6076657fb0e0c79b458dd
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYJGEDqHKliE9JdpTCePo9L9QIE:Mgb4mBIBhGFE3DqqldPx
TLSH
T14265AF1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 406e2d9c642f081698eca920a388c14243e8a8e86ec141b729fb3be915b4fbf8
MD5 61ecd35d77d31d1b3ccb232120484220
SHA1 2059dcad0418d18c1d5a01a1bb7d77d8b21c81d7
SHA512 d44d53355a67fd04cd18886677013bbb5b1527caeb29e21980f8c2049479b66f1955f55f662ebdea09a03021b0585ee10e9643ac223d0233b511782dc9962d82
SSDEEP 24576:sG88u8FpJqH1Ozria7/m0GEDqHKliE9JdpTCePo9L9QIE:P7ZFPqVJa7/R3DqqldPx
TLSH
T1D185016576E102F1D477D1388A824663F6B2B8251364FBDF07A89A511F33AE50B3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3d6efd6a91994e5956c511acaaac8082eed27a45bbfdb8174d5286a275e12a7e
MD5 bafd829173320634005db762da3d2a77
SHA1 111dad5f3cf79f3ebf6c5532b4d027411757debb
SHA512 e6b93752fbc73937b84590c5eba0537bff3fa5df1648d1cfc17ac790245710b8749e5177b7f825a0f7d65cfa63d90c160cc255c7c5e2b50775ade5685f267531
SSDEEP 24576:cPUr+NQwGEDqHKliE9JdpTCePo9L9QIE:cJQw3DqqldPx
TLSH
T12865E11F26E918E5E676A17C86828319F771B8621712A2CF02D1517E4F77DE8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 946f0e9cc0263828f0c51038ee635065d788f4e786a12ad0e9bc03f8a19c3397
MD5 a119e0129cb1deca26fa1749cd1825a6
SHA1 c802d5687d85c2e5debbda3e442609ad28a6a909
SHA512 d3ca6c7ba94ec03ae8f3d8a03f97c7a7c58dbec1e2100ba672dd783a94137876a491062ed603db6b0902aa892834ed4553ba2b263594c6ebac152d5db060515d
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjg3DqqldPx:NG05lO43bvDqIP
TLSH
T12AD5CF6E62EC11F9D1BBD17CCAC6460BEBB23815033556CB02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 74ccf8ddc6b8cef325049882b30b5551a3457b3de8d837176cd7eaecec7cb03e
MD5 63453cecb46a69ee6db91a221f0a589a
SHA1 7679848c32d0a77562927ce456f87d5590bcacef
SHA512 3add5131d90f8473c6234108eb69d65909daa6cc8a0c131b46b6de47163de294df94cf26b3954d26a8bbdcdefb017b8bc6001c1447eb28c1c5ecce25e761abea
SSDEEP 24576:+fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnGGEDqHKliE9JdpTCePo9L9QIE:ma5POZ3lJt2pasx2+m43DqqldPx
TLSH
T1C265BF5EA6FC01D5E5B9D17DC583461AF5B1342613329BCB022142BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8e35835801d3665426c27992b4c01c57bfd2418cc107a86f5940d95f7d711e46
MD5 32a7670b5fbbead4b952c610c09db4c6
SHA1 1c058b87183b3015ca9f6520f0d1b91e187dd0f5
SHA512 a9d636d5088d6649955f7a36d1ca21b85d3c0c7fd8836d5cb1f41df6e42a86a1d0e644662b07efee5f0c74631edb94365b3931d808e02923b8c4a95a5c2bada2
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FksGEDqHKliE9JdpTCePo9L9QIE:cNc/zEOVHFx3DqqldPx
TLSH
T14D858C1A23E901E4F1BBE1BE89779546FA717869133486CF0291851B1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d1206f3369413f5bc499eb6a0aeec1e6cfe3977e1f832c4fcc93369dd137e9ca
MD5 1c1a71a1a1794a6d2b1fb95ade39a04f
SHA1 a730d36c0c8ba282c691025a7a197369f020a3f4
SHA512 f39feeaea619dfabc509b46472a3457f1f5068a6f1539a5ed1a345b798979f62846661b23ce7a8d3fa2bbcca46026405933bde1381d412d7f9e58f9cdf878c42
SSDEEP 24576:izkNvNnaFeYhJNtmZBmaGEDqHKliE9JdpTCePo9L9QIE:izMwBtOma3DqqldPx
TLSH
T11755AF2EBAF806E4D1FAC6748D238512FA727861173253CB5390C13E4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4b206e7f5790b3d271c0ce176ac79e51edb33c880590567c0dad0256b168c522
MD5 87b6d2b7360fe52b7670282c71c83288
SHA1 cf8b3f9ed28b933ab6ccd420c09f6cdd88158133
SHA512 ac199da17a7cbd9987ef6996b4862238b1cdc0d7842388bad51c325d11ed321da6e6df95b1e46b44c349807448b0e22b8f37ccaeb6656d3f8776456df51db15f
SSDEEP 24576:aD3FHshBIYQgAvGEDqHKliE9JdpTCePo9L9QIE:aDVHeBIAAv3DqqldPx
TLSH
T15175E13DEA9C04E5E57BD1BCC6638606E77138A9032266CB02D491B55F6BEE43D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-114-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/936-368-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/936-121-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/936-115-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1588-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1588-84-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/1588-310-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1588-79-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/1796-378-0x000001B880670000-0x000001B8807A0000-memory.dmp

Download

memory/1812-294-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1812-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1812-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1812-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1924-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1924-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1924-60-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1924-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1924-51-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2312-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2312-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2312-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2312-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2312-139-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3048-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3048-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3048-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3048-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3048-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3092-381-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3092-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3092-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3092-366-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3092-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3092-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3744-108-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3744-364-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3744-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3744-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3744-102-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4408-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4408-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4408-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4408-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4864-314-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4864-1-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4864-8-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4864-77-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4864-0-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4864-7-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4864-309-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/5908-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5908-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5908-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5908-252-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6136-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6136-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6136-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6136-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6136-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download