c7aca072a3ce176e24fab5652c4d3fcdec58002987cefde3394b0a5a924e9a7d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Size 2.1MB
Sample261017-d7fecawvbz
SHA256 c7aca072a3ce176e24fab5652c4d3fcdec58002987cefde3394b0a5a924e9a7d
MD5 ebac6a9211470b950631bc9e8e9d02ae
SHA1 8c3e361e67ddb3f71e90c80d1af21320a12879f8
SHA512 5be2aeea995cbcbdab25cbd46efd2deed59ad8efd35226e6b7b1f8f39841171ee09ceebe4713fba73cdda879efb23c6fe1c0f86a79dbb5cf9f9093127ad275ca
SSDEEP 24576:xlYALGebrggti8dgyYyu6HwwpG+PZZNzk8jc/mmGEDqHKliE9JdpTCePo9L9QIE:xlYALGgggtndgyYXc/NAuu3DqqldPx
TLSH
T149A53A0E654548E7C25BC47CA246F73299213C8E0F26F59F02C53DA73EBE5AC1A29637
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5600	elevation_service.exe
2688	elevation_service.exe
4748	maintenanceservice.exe
3292	OSE.EXE
3528	PerceptionSimulationService.exe
392	perfhost.exe
1364	ReFsDedupSvc.exe
4176	SensorDataService.exe
3876	ssh-agent.exe
2900	AgentService.exe
4092	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3b2745e8e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9223553e95ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a142d913e95ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1f8d314e95ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c67f813e95ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b495ee13e95ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3271913e95ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3608	2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2900	AgentService.exe
Token: SeBackupPrivilege	1364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1364	ReFsDedupSvc.exe
Token: 33	4092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeDebugPrivilege	5600	elevation_service.exe
Token: SeDebugPrivilege	2688	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 5696	4092	SearchIndexer.exe	102
PID 4092 wrote to memory of 3556	4092	SearchIndexer.exe	103
PID 4092 wrote to memory of 3568	4092	SearchIndexer.exe	104
PID 4092 wrote to memory of 4652	4092	SearchIndexer.exe	105
PID 4092 wrote to memory of 2948	4092	SearchIndexer.exe	109
PID 4092 wrote to memory of 6000	4092	SearchIndexer.exe	110
PID 4092 wrote to memory of 4960	4092	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1612 1596 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1644 1656 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1612 1596 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1644 1656 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 53161aba627c72d273a0d2ca59e36dfbee6014bf16bcc1433ab0eaebc3548cd4
MD5 98e85d738b8463ecea766356e2634020
SHA1 ca348a28bcd77fb69c2eb6ac7d3c96483bd9d2da
SHA512 e0e4b5d7e322ab23ef9bf278a29d55ea61a6d10584400c82656286597e5671f7a6635747cf45f07f758c62d0cb922ec275308d988c1fb70b20a047adc87acacc
SSDEEP 49152:ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxn13DqqldPx:M3q6mjBQDqIP
TLSH
T179D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c3c4bec8693ad9f358c4c53c8ba34e717d7c12739b97b5e1f8cd7395c2400bb9
MD5 dd7cd42e23d61e88a3ac5a062bfe02db
SHA1 bea8ae915feebeff0a002d5a986135ac26f2866f
SHA512 201abdfd31935586c25e6ceb4f6fb4b7c2e6642a7af57400f2ebc02ce5274dc3b55bc1900749ddaeb3294638b305af6dd666734a8c217cd3a0d2158f3f3a24b5
SSDEEP 24576:zXYfDtczAcGEDqHKliE9JdpTCePo9L9QIE:Wtcj3DqqldPx
TLSH
T19565F12877D109FAED678238C9B28512EA33BC554764E7CB03E4A9254F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 426ea62db5439f595d1898b3c2186dfe9713717b1cd6717b99d06280d165894e
MD5 f161fef697f34dd6d4bb38fa92200a84
SHA1 0052c201b983943987edf7bb5630ce3a611d3ec0
SHA512 cb691751dc17f178c7868fd27781214de0d6a89a25f9e96d49b67fcdfbb72ae8ad4176a42d29d9f2c7f48a4b0a33c2471a4cbe8753965397dfb661298e3bd496
SSDEEP 24576:b0Le5ji0hmxgrM9GEDqHKliE9JdpTCePo9L9QIE:bPji0Aqu3DqqldPx
TLSH
T1FA859E16F6748731D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 93eae10d2874c021e216bf31be1c5b194b554f722da25be71076080657384b2a
MD5 33ecc72729c3c707aeb8609ca4fe397b
SHA1 a686a66588e8d112deb7af2b89fef3042865484e
SHA512 60d99735e8a8041d985d8bed41be95c95998e01d00f2146113e284fa1159aac61301fd0be16fd4e1afd0fba138146131dc71f5b3795babc4cdd79829fbe3c325
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWj6q8wyuzGEDqHKliE9JdpTCePo9L9QIE:v/ezSC6vUzPv+HjyC3DqqldPx
TLSH
T1C2755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 53b6cc977076755cd4ab1e9e0e23757d9bfac4defc6f3d938c52479f8583fd0a
MD5 5e361dea5dcec59ba593545484bb5b54
SHA1 1724e2776c00911ee20758886f8a067949ba2843
SHA512 78922437d782808501f679b1c1caf2bf97ede3cc0686e32a20b1ef307e390244baa150d32d7c577f74d21531b8851c3c1fb4059bb779208a08cba7dfce30e468
SSDEEP 24576:KVbqPb88hv/l+BYGEDqHKliE9JdpTCePo9L9QIE:KVO88hXl+O3DqqldPx
TLSH
T1C8559F66F5B48331D073C0BAC5D2A69AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 884b7e6ad98499f9640ec6ad824e29056a9e355908d1b12e0033e64de85bbac7
MD5 fc4223d3e18e60fbbf57c443f4d946e9
SHA1 1e855d17f1ee55899c0b483afae44b2889f7e546
SHA512 e0e92cf5140da6967c328f9e492f769d9bbe4c5e8bd884647ce4ff45e2bd3b98aafe4788054b9917defe223be38ba09011debe50e9509cbb9ee3a82627c3e564
SSDEEP 12288:M4JhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:M4JGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1DF55230DAEC64AC3FBB73A3057B86167FD25BD982C6E768A8B833D01C479479E45B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 524867bed49734fcdd31176c5173f13f03dfb68a60846baf3e3f8a9a7f37620a
MD5 cb1408d4fc2983f5159fef162a1fbc77
SHA1 5b9d4a1e3c1a8c6709522ca48be33f007a79e7a9
SHA512 f31dcf2537355ad92bd88f19239e68c71d1aeb0b77af14eecdba4e45ae24abd2c6f95e8a1f62c3b5e228eaf3656c5b57e6a3687811fddef3c66a27cee2483f68
SSDEEP 12288:2eBNUbTVO86UAhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:2JIUAGEDqHKliE9JdpTCePo9L9QIE
TLSH
T17A75C03BEE28FCD2C27A5D785B918200E77278704F62A3CBD165920ECE235E55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 245639ea9f18df7bb89fa6a633221344b5f548be451cbd167b295d4e9c3f2fa1
MD5 704ec47786af73b848d680e51127708e
SHA1 0f7460b817c9f81332a3ef2915841a17b8ddce01
SHA512 fe84e361b3e1da4d1cfd500dc606df72871bbf8ed9eb7f4ee4377f08f1479471ee7550ba1cf872234f93ed80181b2611e84eae33ff13068cfce9f323ff7eb456
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:EQvGAdlCEL8c/WRNw5CrDqIP
TLSH
T139266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 27fe9f7ca0a44795ae554fee9671996cf39d9e486d2c6d9d85286d684880003f
MD5 1589dfa4e191827106123c1851c7603f
SHA1 2827b30952754713d8fde1f0e22336b29ff75d1d
SHA512 e5f7046c64fa23326036c9484978e821dd034273a21148dd23feac06efb9665700f94eea9d98ed84790f00db626fabf3005eb08c327d9406ece6f12c3e7b4fd2
SSDEEP 24576:zUewsAj+GEDqHKliE9JdpTCePo9L9QIE:Ilj+3DqqldPx
TLSH
T12075E031FE75E432C7BB0DB21B35D716682DB9204F621AC3E3E86D8D89741D22376A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f53ccb15f45dc9e1ab5248df940da46f33750939476b7e3e1d08c15bac3603aa
MD5 e2147111d2b2d55ecccfe89994b7bf6e
SHA1 603bb61296c9e7b7a6f7c630ed521bbcb81f1890
SHA512 d91dc62b931a95975ac0adfe11873fd9faeaf231c5f8707d1514a5140ee777010ba674eab61bc235441f9e54d1cb0697c736aced9e7bc0427bf083b2acd649e6
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHSD:aUEtQevvqc2W1cpV20I32S
TLSH
T1D3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 248f068cbd9ce6f699873e397a65306fd7637c14fe03e5f5655a0accaea68409
MD5 683a0345627c47bca07f1238fe3956ff
SHA1 664408a42dbe8e65769db35e9b9a7099e15f828e
SHA512 78c8bd56a0eb7b16bb2e455dda5f55446ebe02027dd0f0667f123181c8b2ab0e08f433fb7f207b8c7004e747e75e095cbea230f0a40edd8e139c4cee7931284a
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/ze3DqqldPx:boqtVjnm3DqIP
TLSH
T1B1D58E0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 251ce7423e22fa30ba25b02d490d8d798cd479bfdad2a5054f414d3f6693287a
MD5 29f0f792aef5076e4bc84073ca2faba3
SHA1 6635ff491d0713f2724e8ab72cf08f25a38dfae1
SHA512 f8dd0716fd58f495e4b2aeb3b62b7595ceddd089f23c662d6503131f02be3470f539e3ed1656eef06ae7ef70f3dba2e2409416cc2338df9d395b0874b4a96c42
SSDEEP 24576:NAhGL6IFoiwtA5l7S53HGEDqHKliE9JdpTCePo9L9QIE:NAM5Foiq533DqqldPx
TLSH
T13235AD80EBF945D4F5B3AA7899B69171EA76BCAA5E31D20F2150D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9602989023954cdb91d9ba3107aa78b402652d269653176c920da68b1b54891f
MD5 98f7f1bc3434ab85bed0fd7f091a9b71
SHA1 768013861fb421cfffcd25879144e941f96a3999
SHA512 cc32072f61f25fe1e2f1542ec547240e6a754c0f1d46089b6083ec88276298b4f1db79668ba90e7e6de4b5e631c35742a384a8aa412284289f9c4a42df0c860b
SSDEEP 12288:Tmw5HEjsChNlBFgl0WDm+CThoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5It:ywuEOWiGEDqHKliE9JdpTCePo9L9QIE
TLSH
T15F65F14976E50CF9E9A752388697C136F7B2BC012A25D71F0760D64B9F37221BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 698fcf031dcf2e10b30645502b990e8f194c86b19e9a0a86689a062930bde3ef
MD5 2947a943a4e61a568cfe92be692274d2
SHA1 c63b5e8e6262f8affa598bd73382d3ed6c5f8fd2
SHA512 9a9d7e47be6997165b7d82c9b2747b1724ad99fcb368296a0a14e9c2c748f222ec6c399f85eeef5177e218e55b617b0492610d457087f92afcbddc0c2c6d9ff6
SSDEEP 12288:7UZ1IyOhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:AZuFGEDqHKliE9JdpTCePo9L9QIE
TLSH
T10655124D36D521F6E2A36238CAF05206FB727C56273A53CF06523A468F339E56D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c3b58375eab13082983ea9fb9af966b689b781fe4230559e6ff50e96cbf6fbe7
MD5 e8a5992d36a396cb3a684aaab817ec4d
SHA1 b04183577247135ab622e673d439cf040e6c37e9
SHA512 8326e8163e017a0312ab359df49055d2b98e01381bd5bbfd882ed1501029e7be8189a238b29d52dc2c9969a23e69447ef76a672594d649eb73b52bf361751219
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uq:TQRQyi36YOcPDLvw2gAf+PN3kDqIP
TLSH
T153667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 18ed2684ad720850017b09c69943857006d06f147b6173aba1822b99d7d291ea
MD5 527d988f7125680de9daed4b2f7796d7
SHA1 2f09143cc135e26c243d648fe5cb2292958bc527
SHA512 b7a9577501f5ee48bf8e82fe6847d908e44812379c42824dcdaa5843a3a96aabea05883ed9572fda29967b5a91a8279df9e02b9c7c2fecbf4167559fa2888c8f
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uq:yQRQyi36YOcPDLvw2gAf+PN3kDqIP
TLSH
T15D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dfb955af542eff01cdd16436a0f477f4d84a8c3df92eb621a9a07e0a4a4dc96d
MD5 cf16058e92e50647a63aaf7504bf13e6
SHA1 897f898271733ab00e4b34882068946f211a372c
SHA512 8ec780e4e2d8e542536a77f91fa874a22ab31e99200a0475121f0336057a7fe95c5d361cf341f3d90b8be8778d08806e0f8661c05141bd386a857feeaaaa93bf
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL01GEDqHKliE9Jdpl:468Qg55nhkeWu7PNU3/u3DqqldPx
TLSH
T17EB55933B2F20099C44DE1769F4A973196E27C758FE1E3DB854172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f0af79010eacfaa1f9184f533858f6334dee68ea8a3cac6debd654c605b0cd41
MD5 bf78b6d1140afb41badd681f54a944e1
SHA1 8bb04ec878e0e410f0c82aaee367432fab588e4c
SHA512 0665f708a279aff523fbe803bf18845ab420b7d4fe6f708a700c988ea9241acdc05ab5d074a8b404a5e7525fb0cf359a00f9fd547b9e5436994e38a9c0d9f019
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99o:Ny5112gYy5azzVvU69nLKnhZVDqIP
TLSH
T1FC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f5f49e713be6f1ed19668ec67c8ba5aaaeb66e3160e9e334a4e73965a7948d9
MD5 f005bc9f0fd26113364a801cec5cab1b
SHA1 09dac1bdd06bf5a34772c4871d1f2e0a622962f7
SHA512 98aa62ea03c34dff2807f1023a46ff8d8e39300ece5bc51ba8e248fe9987cf1d7b173cd5653d8b3917d9a2a574911183302dc342e96ba0915b80bddc437a70f5
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glM3DqqldPx:0u6JmIxd2dMDqIP
TLSH
T10CD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6e1d4bf931b45dbe1806bd4068c36dbf470f544a4c51e8aab0647999b84af3b5
MD5 96a96192839799c8536dcfe53388c469
SHA1 23bd1c358c609df772cd835a54f56017ddc9531b
SHA512 11dab785b94b39fe1af129f59cb6f7a3c818c71102b303614f354b74b28659fac573917cafcc17f0c4b836839015f36777b27c79f0b970aa9b1b932dd7442d17
SSDEEP 49152:H1hpsNoJpF1A67U44CwH7R4xg3DqqldPx:HmifPqR3DqIP
TLSH
T121B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 78c3761c5fe904cd796aa99aa5c20c7974b9c43670521fb1adf80f78bd3ae79f
MD5 b09bed9bcb6fa213feb01731697af573
SHA1 72f8a5d917db9a512e7e265525056540c587a4ec
SHA512 3c0065a5356fe2a3eefd3d9b2fb9cd37703eadd8ee7b47f3bc844084f3d6f4025b713b8cf8708d5d1cb76d931e1e54168f83ed2ec8240e8eeef688df698b9209
SSDEEP 49152:9SuZQIY0Be2KkRVtOnks6NMHqF3DqqldPx:T5dKqi61pDqIP
TLSH
T1C4C5BE03F2E941E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 90918b8e9035b39870fd02180e9937b14673528bc166233144136b7c8018e071
MD5 6b5d9ec8ba8c168edf268f970316663f
SHA1 58da09c4829554a9b7dd2204d8ff0b4722dcc336
SHA512 3aff3f6df76c4a4d2a55d6199b892c061726d502f9228c28466690c756fcad72c0a1c9a8288bac94ec67192cb5c322825586bf6438be6846b389ef4d40dcc896
SSDEEP 49152:GhtSn8EApI0figjgiDn0AP5wc3DqqldPx:HX2iWphDDqIP
TLSH
T13895BE13F2D900E8D06ED174C7568632E962BC160B39BAEF0A9076561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1f6d0448ceb2350ab678d14c31f301b3ee137bb4e99745e9fd60f0a3634b88d1
MD5 fd5b15d6971cdc4a98d78888587df877
SHA1 d1a41ca4c3d15d9c3363f3326bcc761a172f286b
SHA512 b109b85852f55e4428d1e41c89bfb480b024acac07a607591fce4bf0a7dd114d21cbdc5fd9f49bd1f12a22fc483cc85943f16b6edbcf3566ae38fb4dce9793dd
SSDEEP 12288:ExhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:ExGEDqHKliE9JdpTCePo9L9QIE
TLSH
T16655230C6DC74BC3F6632A7187B42267FC29BE8A7D6F328B57873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 13b570accaedd69b1bc9b8b8fbc6827cbf3ba33e793852dec545ca23afed741c
MD5 f2a4f2f933cbff4668436f8199d51bd8
SHA1 4ddbf61e2da06029bab8d4b47e19ee110e391508
SHA512 f2d53f33a94b67340f89f41cfb202d5f7a75f8daf25f8f6df7a6bb3fb81e91a270ef7189614aa69ab4001c15e37136102b152d750dfa1598e66887f3a4bb959f
SSDEEP 12288:t6hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:t6GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1BD55230C6DC70BC3F6632A7157B42267FD29BE9A3D6F228B9B873C01C97A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 16b128c0f2f4bc39d9afefaf1cf121891ff71d36d24c498e9a18c092cc811422
MD5 9128f392353bcb1eaf2aadf5ccb5bebe
SHA1 fac5fc9c24e20fae11e9e4e05ae3a9680e938552
SHA512 79589be846a64aa22cde93ffe46b6857063d4274902ae20f37081265d4439dfaf173cff1f46ccbb270c649712b72bb5985e08917c0ebe2241bebc0740c337c48
SSDEEP 12288:HIhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:HIGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1E555230C6DC74AC3F6632A7157B42267FC29BE8A3D6F328B9B873C01C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 28578273cab02c1a156e7c1915c356628200a3b4b9936a47305b16db25e61d50
MD5 0104a4babc2bb213791c0edcb48b343c
SHA1 1cee67c46d15fa8bf1bfdb835b2a46774a3eb572
SHA512 42c237544fa329052c5211bf7f877dc5236d4278dc181dc0ec389bd4c51c00c672e6d4b6600802f2129dc997dabb13a435a32f58555a6baf35f98acd5174f90d
SSDEEP 12288:4VnhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:YGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14955230D6ED706C3F973A670C6B15122FA75BD997A3B63CF8B423C01CE72474682AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d551ae3f0557ccbb410a3825c4457f1f2b127bfe2540f0ad2682440dfe7587a1
MD5 ff7d339c3df5dd6790fae5a9eb53d26f
SHA1 9e53bf8fd5c820695de0a5fb0f92929fe0a84741
SHA512 c66b8db6adc39edc8f6f7ab61e2e1060dd93a0a61a00a894adab76a4459ec824d0ed32ca5d30296a495cc254047f5c8db47fba87dcff555d4524f7ae3481879e
SSDEEP 12288:N/hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:N/GEDqHKliE9JdpTCePo9L9QIE
TLSH
T16055230CADC74BC3F6672A7157B41267FC29BE8A3D6F328B9B873801C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 13e7471e5f4a7a45fee9d776b05182a997d3e88470ed28ff54f36955ba3ec2d2
MD5 230820a2ac4e9f567c13f3c3bb1e0b50
SHA1 515bed1f541a9ef8ea3413789dbab40ca1d593fa
SHA512 d4c6dfc11ce0a571c012a0e453532d9fdd5e2fd1254c124d04d94c425afef857ced6e938030f18ccc13230aa5bdfc2e63dbf2cd86e5d0b93a67d83fc8766054c
SSDEEP 12288:mGhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:mGGEDqHKliE9JdpTCePo9L9QIE
TLSH
T15D55230CADC70BC3F6632A7157B42267FD29BE9A3D6F328B5B873801C57A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 430a3802b5af89bea2c0030a70135708b916d001f7ff4444780d4588215d8abe
MD5 405225f2fd4211eef94cbe2632769a54
SHA1 e3e122fc8ee4e751e9454cb9d65280930faed104
SHA512 8201ffa105b45e6707e93fcc745c0a580f7c567a8e026e0564a7d33435f631a790c2247a4d73c8b677ffd59a6b06068a0e88b1b42b76678400cac73141134e8e
SSDEEP 12288:2ShoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:2SGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1BE55230CADC70BC3F6632A7157742266FD29BE9E7D6F628B9B873C01C67A438644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e62d5e990e745acf8077a0eed12f0a7496321238afad966fe6c2ed275bfb8672
MD5 63224b1042f6fceda252b7c255352184
SHA1 8c6de8dba58c38afd671335a4177541f96c28de6
SHA512 534e125ea06f70f2073ded689c7c46b46276df59c69eeff6b90be38df847b53bc9363d96451a9a89c9514b8de4b9fffe6f26595474f8c0424ab8d0bbde3a85d8
SSDEEP 24576:FZM4zFVSOaGEDqHKliE9JdpTCePo9L9QIE:FZM4zfW3DqqldPx
TLSH
T148750199B39018F5EC67823EC9658916E6B27C5A1B70C64F03E436179F333A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7317862cf5efa60499fc6fff37c4074c7ec9af4e2737ecfefe13e6d93cd05d16
MD5 31b6488f93767f287286b441fc2d88e9
SHA1 dc785ced63d485e9f35435dec6bdec4a039cbb46
SHA512 f7a920ae1c981bf074e542acc5df4e48b65d155a29b61c9dab0308731357cb64b6e26bf35defcff080b54e1c94c5f84a58997e1d3da62c2ecc1d24c1d03e574b
SSDEEP 12288:kVhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:kVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T11555230C6DC70AC3F6632A7157B42267FD28BE9A3D6F328B9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6937772ae7c1f36afb8b0f10d3f2503508db8bad9a434c6ed1e9de0e10eddaf6
MD5 08079017318fd324b3b5a476b6877014
SHA1 b461252dd658d032f2ab4e494f11b4d418d002e3
SHA512 a54a6274a059b8e9ffeb4f4c075f959942f023e68a4dc751b1ad3b7acce3635a952f197a284b74105d5252fc427508c161d1185fc654ffaf4a2120adfd835887
SSDEEP 12288:DZhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:DZGEDqHKliE9JdpTCePo9L9QIE
TLSH
T15B55230D6DC70AC3F6632A7147B42267FD28BE9A7D6F328B9B873C01C67A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 accdf3a89a759320dd243b803fee2bd881959a2a95ef48151dec6df1f27ae02f
MD5 19c0c082aa89b57bb29b2a01ccdf2837
SHA1 b1301eceb89f1120a1f4d2803b1a7693c4cdef61
SHA512 55a6f07667f35a7225a0105c9afde56d0e25fcbcbbe974cbc39a16ada5eb87280430d69296690018fa563ea26a57167b783b594446143a97441458daa03c67eb
SSDEEP 12288:7yPz5L8OhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:2zyOGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1C865120B77A221FAE1779234C9A11602F771BC361B259B9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bb610374f9839eb4cde23b03e09f838e911379e7b356c0b569263095dc022c82
MD5 1b238c4391923159844023c405d48b3d
SHA1 39487b4f44c4e9c0743f4b861e420efe3ac81ca7
SHA512 80ff32f2577608b8ed02c40964fb579f6c1450b34c77263d4590f38187ada3949fc1770860e0a72f6c9c26859bdf7c3de9a4a7a2b3b91db2de922b4857235eca
SSDEEP 12288:jVhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:jVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1D155230D6CC70AC3F6632A7157B41267FC28BE8A7D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 57ab301bdc589d95fcc1db0d694f76af9fe790140ce6c288c923c9f76a4b04ff
MD5 2a9e3f9edae6db01d6b62a1726816288
SHA1 622b76f22b40fda71dc233d288ca6ccf0d251259
SHA512 63681fad87757a57de271de3d0c0cf8647a2d587009e9854c9974f82a38612bee0517cc50b8facf356c056e0b19bbc83c95a58945cd4bd386b940ffa0ae58ca5
SSDEEP 12288:DVhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:DVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T17D55230D6CC70AC3F6632A7157B42267FC28BE9A7D6F328B9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e8bcb28a43c378a0e69168a2e997885c7ff9010293b5994465644e0d69b84973
MD5 ff5cad865f4fffc8582650a7051ccc86
SHA1 6ffbbf37a5fb5d039867091d307a7f94d99423d0
SHA512 cb907cac63854101a493d029ecdda9791ee2d2dbc2b8714eaf7d6216ad6c13aaa54de279a6442c124081357c08a511a707cf49841cb994fec6e02c1de0892912
SSDEEP 12288:TyPz5L8OhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:ezyOGEDqHKliE9JdpTCePo9L9QIE
TLSH
T11765120B77E221FAE1779234C9A11602F771BC361B259A9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7b466200f56e932a4879bb2769307600bba06b6b8142d40a424097c439a783be
MD5 17fe37c71adc2836c29548bb4c86e1f7
SHA1 8d52bcfe32c15099ced03df0f97024d0f56cf10c
SHA512 84fbc9ad4febe030a622bffbf41123b877d3788db1c470d93a1c1489ff3b795bd4249ca55547cf13e37711e32a510cbc1f30586bcc481f79dff5c24a82c06197
SSDEEP 24576:bT1aLl3z0zD4GEDqHKliE9JdpTCePo9L9QIE:bT4Lljz3DqqldPx
TLSH
T1A1750198B3901CF9ED67823EC9658916E6B27C5A0B74C64F03E536178F332A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ff5c82ff57777cda6347ea7b1bc0a78228facbd354532653a64f10d3c2701e32
MD5 da5f0c7523e1148f031179fb2ecfbb26
SHA1 cba084269b50d3f9e895f59739ef3a6c40ac697d
SHA512 c2e307cc603a99e5e5d56e3e7b4f4513d39a5242c075714c2c1e557166c5aba882eb3dea16bc72c077333ce1178bb63be91db5c6c43a88fa168a8aeb9806a22a
SSDEEP 24576:J3ld9CHKy7GZkGEDqHKliE9JdpTCePo9L9QIE:Zld9CHKyaW3DqqldPx
TLSH
T15B85DF90F3E414E5F0B79A35C9764512DA767C9A1B31DE8F03A4261A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 862f0e4f19ac0b973d3f310c44abf8276a6a3b7f49c73b656d5970a88d1baad8
MD5 e7c75e2f4f23c135a96b2b6f42a8e3d0
SHA1 5d5059245de2c7d2457e9834362f198a39036487
SHA512 ddee506505e47b8db2917b5dc83ce263aadf6a1695f6eede6d13059e4525b5e8aba48bf0058148f880a008d29bf9cacf7fcf3d91d6dbdc944ab617143ebb2f46
SSDEEP 12288:YohoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:YoGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14755230CACC70BC3F6632A7157742267FC29BE9A3D6F328B9B873801C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d7d1c9de9a159870d6d6cdd0c4192b59b28eb51e45a94e441563c7686081edbf
MD5 d91235caa642e2cdb31b69aae1c8fd60
SHA1 f34075f8991837688111f42ab01de981e43bc043
SHA512 5321d092c50a68c6a65ed7deb8c835f56c41e24e1ba896be065b30c2134b8eadb7a9746399fd30223b3ed0754d0961696af2ad4b36139e610f0a8b26130dcd06
SSDEEP 12288:tuhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:tuGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1DD55230C6DC70BC3F6672A7157B41263FD28BE9A7D6F228B9B873C01CA7A439645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 247e03c09465fe2d67240e53743f496e08b81887799bfa008f79fae008002362
MD5 40a177a7e0374a0be01925d5123843b9
SHA1 ddef8af7291319c2066c2cccd377b28d0f626b28
SHA512 e7565c938d07dc9b87168f4e6b0c5402778545e83788824b1ed3b420fe5091cfbe64a0c0bd05dbfa9a100eeb7db6632c63335154164211b54f15e3f8dde08bc1
SSDEEP 12288:ALhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:ALGEDqHKliE9JdpTCePo9L9QIE
TLSH
T18A55230D6CC70AC3F6632A7157B42267FC28BE8A3D6F728B9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ef98cd0a67711798128fd26a8c86d4e460146111b87c78099f2ec8d737aa5ae3
MD5 ef5dc25b36e4d52b792ee6d530b7493f
SHA1 bab3a1dc77722759fa5d2ca7074f91c60ae6fa6f
SHA512 87d765b71c7a10ce06dd6852d8daba256cd6df6221349f4a1eb907dbf532c96e2ddfcbb8c7112e66a13ba819284319bbf5cb1310243fbbbe1824c5f7432dbde7
SSDEEP 12288:yVhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:yVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T12555230C6DC70AC3F6632A7157B42267FD28BE8A3D6F328B9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e8f3a016dc68cf92fec1655e08418dc4059ce7eac311379970a9aa571fe47265
MD5 3cda3b941dda56496fe2379c54ad58d2
SHA1 349f16c392ea57c434f5554a00a5fd0c24affcd8
SHA512 bfbedfa044ca4dd27c5f3d3c4f82ca29cb942a452ad82fe48745b63ced913f7c8bb0e3cf12fa287d76079805c35c43f16f856cd3d671b0ea0f96b48601e69a8b
SSDEEP 12288:EohoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:EoGEDqHKliE9JdpTCePo9L9QIE
TLSH
T17355230CACC74AC3F6632A7157B41267FC29BE9A3D6F328B9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d0cf79a2df8e69fb338a025e5a1c6af42dbfa99d65618995ced8347975e3263f
MD5 180992cd5980d490033553b910362ab9
SHA1 c115faf68e0183522a7a7fe29d203e1f19843175
SHA512 1c10108d59314b53566ef030b0ecab0d7dbb9a6d9273b99d575196d67beb4984a3c66f5265e65d916a4f1cef71a52dcb62ef9e091f57361175c88578aa128c43
SSDEEP 12288:AthoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:AtGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1C555230C6DC70BC3F6632A7157B41263FD28BE9A7D6F728A9B873C01CA7A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9f637adbe72b818e2656da7030c7a69270742dc5bfc303b3709beaf93ea45920
MD5 2ea870bd639bd0bd098c5b90e228e3b1
SHA1 a230c522e7bd43e5252ea8c4d616c14e465161d7
SHA512 37276a43d47b71ef45e8452060466b9f46f6434093c90a04306b08f44b70f4bea1191a6c116867874692daf85bd3a4c2bcee5172567f6b637a54eb2b5741feee
SSDEEP 12288:Z/hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:Z/GEDqHKliE9JdpTCePo9L9QIE
TLSH
T13E55230CACC74BC3F6632A7157B42267FC297E9A3D6F328B9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 6ca77538391ded171bd984af87c054755608e14f457a2fcc760c76d9ae6847e7
MD5 588a6f49e3bf1675e101256e8ab5f0cd
SHA1 e9febcea6f033540b4739dfbbf9441bb8f80fac2
SHA512 e5992da1830dba056024ae8713b16e7709e795090b66397a0518ea54cc4d8bccc6dbc83a4d30e59b33bd56cd2f4a9631d7695f2f30f5c7b22d0191f4fd89a9c2
SSDEEP 12288:cQhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:cQGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14255230C6DC70BC3F6632A7157B41263FD28BE9A7D6F728A9B873C01CA7A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 3eb6536b7e233cf5d1d81d8ba884227804da45f09562200f85b1dac7acc6b13c
MD5 6d1afe56e8d8cebf47074caf7535727d
SHA1 c99be83aab1a58b28c42c784a9ddabd8e3b025fa
SHA512 4f86df76f0e4d17961bcefc1fc6629b7ba976203c916b76cc9a30c316df92ffe17255255d004cdc51591f7cef14d5aee992bba4cdf12479008e444fb0313ff3a
SSDEEP 12288:k/hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:k/GEDqHKliE9JdpTCePo9L9QIE
TLSH
T16255230CADC74BC3F6632A7157B41267FC29BE9A3D6F328B9B873801C97A478645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3064820f9c52d0b2906305a9edd1d94aae768fae2e749478698e9f81ed99a2f3
MD5 ab45ccd7a26be16bbee4d17d293a980a
SHA1 9b1388dc8e72eb5170c7ff2334c56dee8e12e7e7
SHA512 dcd7cd4274bb8ade1b9b50a6b847aef11c25f7bb6e5b86a477137a5f44b76966a621ecd86e346d73bbe78217cbb8f6d62abd7eab6ceb1f29fd795e311c2cbc85
SSDEEP 24576:9fwv2k9RX6wkyAIpGEDqHKliE9JdpTCePo9L9QIE:9MnYIp3DqqldPx
TLSH
T17285D02DEBD844D6E1B7923C89B7460AF6B178591B31C2CF029A636D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2a1434cd3961f5a977f99baf0e4402991d24b04d28548117198ad21cbb764550
MD5 27fb62fbdda5ebecea429ac705dcb4a4
SHA1 99447cdd7f684958fdc7667b2680108b522fcc96
SHA512 ce810d4ec16f41d416ea153d19e80f774f55d394a94af264d333e51549b1a4ee4ed2d2a2a58fef5b40a9cc2f54ecddf90899e9bdcd54117904a12308262d836b
SSDEEP 49152:sYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK083DqqldPx:jySzPEDqIP
TLSH
T1BC066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ede87e427e7576d043179301451e1389bbe5a495fe97d9364da62f36cc21282e
MD5 c2dd8dc899317aecd70a150bba0abeaa
SHA1 b32eee7c3de2e9ea36622555426e64809a224cfb
SHA512 4d0d592472aafa1447532c5f24a44a31dc62ee30b650a4868e6a948eadb82b594039ab7751f28fc98362cc7b09caa772463e2e2772adb201efea1b9d81bf6d93
SSDEEP 24576:u47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYqGEDqHKliE9JdpTCePo9L9QIE:u47JUQjqirIhCnDHUPfF/M3DqqldPx
TLSH
T16765AE1DA3EC02D5E1BA927885154A1AEA71782E1F32CACF12B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0f2db9bdf55f20c1ba7e7334516d0812bec26194016056d59e1ec8c6e6b3ceae
MD5 05bbc913346c77e1bf2b5f6b906d66c4
SHA1 79fc1c7ae7a010ffe657d46fa0f7177ad08af01b
SHA512 4ee4135c7983b21d637c5c550c56b557861c4e4d0ddda9d28fec1b0e08fcbde53c52eaaae050a580c1999d5ee22c4be38944b7c7fbfa88a8f7c1d3761f53046c
SSDEEP 12288:RmsfFhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:TFGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1DF65F009D29802D9D06E6235C7654642F7337C6597E2E3CB53C1F83E4F7A5A0ADEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 48926816c6a737d172d12feec5d33f1b8b2dbeb39a41c41b8e15dd17b3975a32
MD5 10ceb6dd335c9deac7dd88b45fcd1605
SHA1 7c777603e8d0bfb47ba8965e7383d2267336e69a
SHA512 eb767c5699a83513a9a33a33f6d9d4e671611161ed0983a60e60f1a625797b41f456e38918b413ba36edbb81f6bbe1cd00f35cf5de57ada522292baf96786725
SSDEEP 24576:aqXn5UPzbo7r4eWBr4HBpeidJEoYhZ+doEk:Xn5U7bo7OyHBpeSxYH+do
TLSH
T1DA5538007626DB4FC66940325E36D6CCA7707D06FE48AF0773C9873F9476659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 ab91373e0c8a7f80e91ad2b85b7d4d35ac1e8dc253ff95e273dc114aacd3db24
MD5 0f88c40a2aaaf01797707fe7ad4fedf6
SHA1 6e57ad9fbc88a152d30ce8e7d84f157e8aea4b2a
SHA512 324478db253a377555e456eba4f8399e0d56b729df5782b1ac7364c474d483e70f7cb0fbf96f574ca4eaf51008672b3750c6a240459093806aba078e6387eba2
SSDEEP 3:OlH/l84VJ3XlmlQ7c+fE/lllbl3y9Gxtg3mCllltGlslslslslslsl6tsx9X:KuedXlml1//BQK0mCtEEEEEEEp9
TLSH
T1B481129827504EB2DD2A903511182FAC1333D68870C0E3DB330650FD4F482946C4BF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 905KB
SHA256 66a0f30f42342c9424134792b81236fe94e3ab9d0372c8b10286115be0b3f9d2
MD5 4a84ce449377fb2d144732306a40571f
SHA1 74ee4aa080189661b453430d9e52d478266b7370
SHA512 bc5cf6875126257f09bc6855e4346ef2a80b3c86491df0470d227fa8222f437bc7600a5da40fac48a3ae41f3485a197dbb401f11ecddac84fb560f323f752d03
SSDEEP 12288:Fj4+F/W6uE58TVXsV1NVDTswB+BoOX1v6TXyb+AX:p4+Fu6uEyViNVDT7k6Ot6U
TLSH
T1CB15F80094B7EB4FC97E903707368ACD7B645C06B7892F047345893D9867A6EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ed15b665ec89c05e06ee9c8700710e148dc46f3f971d6304cbf114aed94332e6
MD5 b0d3b16bb129d7401eb912f110c612d5
SHA1 693b5602439ca18d42598cc3191ddfc0dc1ebd7f
SHA512 4723b8747485db9836b8a0780e674ce54121ae9990d2239bf3bf93987c94ac8b9509cf97211ba69c88d670f18d26da7d444a8368011be8acce0001ca2b5582d8
SSDEEP 12288:u67dhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:hdGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14E55230DAEC64E83FAB73A7047785132F92DBE592F2961CBDA433901C5768E4AC7B510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6b7ba8cfb88f114f216ccc1e9c7b76b3e8ef05f54d9cec21fe2cf465e86c763c
MD5 0d63852a4ece21f685584ddf43293643
SHA1 6eb77a1337788e61ac763baefdf29fc15c1d2524
SHA512 d6978c213367b741d9f081dceb84fa2ee77b43dab3baa652e5587f4429e36dd5f068d506e96196b491821b5f3b2d043b8236ba43c3804812d27ad2202fee7603
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYzGEDqHKliE9JdpTCePo9L9QIE:Xgb4mBIBhGFq3DqqldPx
TLSH
T19F65AF1E22EC02F5E0F6E2B8DDAA4417D6B278161732D2DF1251422D2F3BDE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 baddf0030aaee90523b2c6dcec4256b7e3bfc7ddb7c5d5cd88e00c52d4babe14
MD5 c36af477d9cee1310a0dd6876fba3186
SHA1 ff3e3d57aeee265dec2d510bbe382339b8690343
SHA512 6217a609cb3973be5fa01e4fe7c0609bacda127668043965e8af34964600b511a415aae6e80bf9f2920826ee525c5850841a7e6eb1ab56395e881588927abea0
SSDEEP 24576:DG88u8FpJqH1Ozria7/maGEDqHKliE9JdpTCePo9L9QIE:y7ZFPqVJa7/r3DqqldPx
TLSH
T1FD85016576E102F1D477D1388A824663F6B2B8251364FBDF07A89A411F33AE50B7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 59a771000de6bfeb0e2b232d1e9d2a42a2354d7b775aa444bd15836f88613119
MD5 79bafea72e51426b22d111e8150c2b2e
SHA1 c29195385c3b13da26a313e65a087e916cc6b99a
SHA512 062713944eb097e2253aa5ff2c81b7791794f3676bf6618d1384af4ad73cb8cbfb1c724d3d65a9698a409ebecf8b9320bc83c0d471f936a3e0ff48a2a581bb79
SSDEEP 24576:iPUr+NQWGEDqHKliE9JdpTCePo9L9QIE:iJQW3DqqldPx
TLSH
T1A865E11E26E918E5F676A17C86828319F771B8621712A2CF02D1517E4F77DE8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d087e6c21419fcb3dd3dea7b1fd4fcdd7a81f803ace7bd038f7c1c9474c3413f
MD5 8f81b76835745b1e348d35611ca2f816
SHA1 6fb37f0efc4c73ff5c494eac2117b6a9142b095a
SHA512 4acf81a3eafc571f11b12cb8ddb637437a1e64a71b83316c01989dfe845e5ccca9b49868a3fab9d06417eba4bc9feb3a032df13d647d154d6b538b6b569c4b6e
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjG3DqqldPx:WG05lO43bNDqIP
TLSH
T113D5CF6E62EC11F9D1BBD17CCAC6460BEBB23815033556CB02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7b26b2e57cf1878f183a34b06cd45c5993e212e8cf9af9b686aa37dbc8ab6740
MD5 5cb13753029c982c0c9224585de9d589
SHA1 8331323b6b170665cab8f2f3c96751e871a1885a
SHA512 e052e8f79dfadf22bb5a199bf8448255377f06782850e1f3eac2444f6d379cb6c8f95c9b406d6e2b6b22db5499115b16b8dbd55bb7fa96f256297e970ec69dfb
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn8GEDqHKliE9JdpTCePo9L9QIE:Va5POZ3lJt2pasx2+mu3DqqldPx
TLSH
T1B465BF5EA6FC01D5E5B9D17DC583461AF5B1342613329BCB022142BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 82b946f56a62496178ae8c766cc7058c5126c3f6b938a5e8f524d8e455df498f
MD5 1869f423963750921f86af3fbf89e8d0
SHA1 ab3b2901e0ef9a41665cd1269e358e9b68f283ec
SHA512 b7f4120773fb324d55f191c83e6165fc0afa6452f23fda3a68a270af72ead64b9d80b8ab0e6ca5465bcea43167f27fd3a36c9a34345c53aab7301f0f99d7b5fd
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkCGEDqHKliE9JdpTCePo9L9QIE:SNc/zEOVHFL3DqqldPx
TLSH
T123858C1A23E901E4F1BBE1BE89779546FA717869133486CF0291851B1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 aaa69466e60c81f712d4b0761fd0dea0f4b47f933b39730604d257f61d8d8021
MD5 61eb119e5d4e8c0763d23897cec9714f
SHA1 e0bcfce98b26788238bc1aabc13debb64feedb23
SHA512 f4665d5fd14c9aae463451dbeef181f3b7012a5d08c1a8a7d568a75937db844414c9317bfe2576faec795e1f5525211ab3907628f860823cf0658361c58c7f30
SSDEEP 24576:6zkNvNnaFeYhJNtmZBmQGEDqHKliE9JdpTCePo9L9QIE:6zMwBtOmQ3DqqldPx
TLSH
T1BB55AF2EBAF806E4D1FAC6748D238512FA727861173253CB5390C13E4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cf6382fc8bdead96758c1ce003ee50c2ee7cf2234f975e97161ce13bdd5d15f9
MD5 2529ebda93823eda71b5d55409a80bf5
SHA1 23dd7adc9602add16493e0e405efbbac2fb3cb95
SHA512 53cfe5b3c9e166f877eaf49c439ffe9cc6abfd4d9837598a9769b299159a3d705bd1e582a3c23349f7cb17720f9992692c1be040dab8d1c170310c378404526d
SSDEEP 24576:yD3FHshBIYQgARGEDqHKliE9JdpTCePo9L9QIE:yDVHeBIAAR3DqqldPx
TLSH
T19275E13DEA9C04E5E57BD1BCC6638606E77138A9032266CB02D491B55F6BEE43D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-83-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/392-78-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/392-364-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/392-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1364-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1364-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1364-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1364-381-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1364-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1364-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2688-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2688-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2688-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2688-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2688-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2900-137-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2900-134-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2900-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2900-128-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2900-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3292-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3292-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3292-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3292-279-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3528-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3528-295-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3528-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3528-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3608-309-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/3608-1-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/3608-0-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/3608-312-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/3608-8-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/3608-7-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/3608-87-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/3876-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3876-115-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3876-121-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3876-369-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4092-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4092-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4092-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4092-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4176-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4176-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4176-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4176-365-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4176-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4748-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4748-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4748-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4748-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4748-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5600-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5600-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5600-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5600-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download