a3a3a7e09b00a4833ce3e90fc106f0e471f0f1d80559fa2eabeec7155f634531

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample260731-apseeazfnc
SHA256 a3a3a7e09b00a4833ce3e90fc106f0e471f0f1d80559fa2eabeec7155f634531
MD5 d7c5be383e7c7d9c47cc4d91813ce739
SHA1 63f3185519ebd74d186470ff58126cf1b2428e27
SHA512 b4c0e9e4f2999604fd23324da127b587a0285ef83cff0221a814271c6dd4b9eab4ad29b407eaba5fcf4d542f15c3ee9db509f2912bdf22f2a6a05e34439b84fa
SSDEEP 49152:VGtlq1aVwASOz5IU6iCaW8SyrZ12B+fti1oYvJWYWQaIhfCj89zd6hfKy6Tql8By:M++LHz1i1oYJvJC8qzVhkbimpwFRKIh
TLSH
T1BD269E56665900FCD5B7D138C6CA5627E7B17C1603B18BCB02E4BA661F33AE26E3E341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1680	elevation_service.exe
2936	elevation_service.exe
1752	maintenanceservice.exe
3764	OSE.EXE
3220	PerceptionSimulationService.exe
1004	perfhost.exe
5512	ReFsDedupSvc.exe
5932	SensorDataService.exe
3356	ssh-agent.exe
3728	AgentService.exe
4724	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ed42b2c5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bb068ee8220dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d669bec8220dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1680	elevation_service.exe
1680	elevation_service.exe
1680	elevation_service.exe
1680	elevation_service.exe
1680	elevation_service.exe
1680	elevation_service.exe
1680	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe
2936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2336	2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	3728	AgentService.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: 33	4724	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeDebugPrivilege	1680	elevation_service.exe
Token: SeDebugPrivilege	2936	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 5596	4724	SearchIndexer.exe	100
PID 4724 wrote to memory of 4424	4724	SearchIndexer.exe	101
PID 4724 wrote to memory of 1028	4724	SearchIndexer.exe	102
PID 4724 wrote to memory of 3120	4724	SearchIndexer.exe	103
PID 4724 wrote to memory of 5108	4724	SearchIndexer.exe	105
PID 4724 wrote to memory of 5476	4724	SearchIndexer.exe	106
PID 4724 wrote to memory of 6080	4724	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d7c5be383e7c7d9c47cc4d91813ce739_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b2b9492d941ea1db396f16cdb0bafefee8f161e86f90f95cf5e1dfbace258a8a
MD5 bbd658125726d039ae760d0c9dbf3a62
SHA1 3afefc47e8f69ef1211176b3744b88503215e5f8
SHA512 6b9cd75933d393d5d6551a0ca76f9c6f3e60778e91d4e387d0190ec3ed6719c168867fbae7c934d7ed6db29f3d6264bf60213cf598b98514116c17723c3d241d
SSDEEP 49152:ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnLXozsr8zlLwJIh:C3q60jBywFRKIh
TLSH
T121D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 478b28714eb109f48ce90c15f5e4dfb32225c7644c551f86a32e9db44e947411
MD5 4975fb8a5690085631044e264ffd02dd
SHA1 022377df12758de57607ff75c07ba0484da9f133
SHA512 e36b3cb83b595babbc0a2cf44c486bf4751f085c83882414ebc4b0550d78b2eb8378c1a77df8318b11796c542a10e1e99434a5792551abdd0f90aa928b7aae86
SSDEEP 12288:c1XLsswWkxy2lRq2czA0ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:qXYfDtczAg9Xozsr8zbhN6GwXOGIh4
TLSH
T14F850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d03064cab9b88b365a037293b70f45c6b632739bd880d400cc06c50964ed586b
MD5 b15244b695b340b0887d15833cd62c2d
SHA1 0f2fe50fc3844e1df177172785b713346935bc28
SHA512 847c264cd161986fd83a51c34ec2e080ccfe34666ef8faf87e20d16d036083826577a88c71be915c2aacadacee9e41b53b0ae8be4d8238985d5607e1a7db8d5b
SSDEEP 24576:M0Le5ji0hmx3rMB9Xozsr8zbhN6GwXOGIh4:MPji0AhsXozsr8zlLwJIh
TLSH
T163A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a231a94ae5b3f032db9c20fbd76ae1ee3b91f5369a0f51a84679e6ee3b56af82
MD5 3896c6346d912d3d3184eaa6abfc6510
SHA1 14ca8ea801cea538a05562f86086436fd70dce85
SHA512 cdb66042b9cdd241b34bd7f60efe969f9335653dbb9dd76f7db97dba6ae5d43178200c9145fc934e097af0888ef445a7e0765c7e875ae4184f52952a5e7fb22a
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWr6q8wyub9Xozsr8zbhN6GwXOGIh4:v/ezSC6vUzPviHjyQXozsr8zlLwJIh
TLSH
T1C5755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 edd9ebde127ccbb66e4c225c5ea6cb227adf1c13fbb90a55ebe0ca62fcc06ad2
MD5 544447d50caacc7c887a226b16f33aa9
SHA1 4ec4eb33863d85c51abaa1dd1a549e7c5589873d
SHA512 e163b3498d5decec0c2a9deab8ce0cfa6e1e43f313122f93aae481d1c458c953a9e746abdfa47ea851455f719eef5ac0a3f18d33d2590c02c722b5fa3cc1770a
SSDEEP 24576:zVbqPb88hv/l+bM9Xozsr8zbhN6GwXOGIh4:zVO88hXl+yXozsr8zlLwJIh
TLSH
T18455AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 320dfaa7ba404940d5cf0f6a4236435dc11daba7bff74b82882d8ded112659cc
MD5 41fbc8122909cdd8dda41a1f7a7297b2
SHA1 15cb46935e04df973eee949142aee2998b16e340
SHA512 2f3e7fdf63301a1aedd59267d31bb57b1e23700a78aaf697191bd88f48aa78652c52f8aa21ccd59e7976916be3f77c756c6f4b5926f78bdb2dac60bb69611010
SSDEEP 12288:RRPksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RRd9Xozsr8zbhN6GwXOGIh4
TLSH
T13D6523F7E691A442EF671F3139916AC4DAA7FD9E49C11B4112382186CC7E47AFE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2180ee49af6823c568b155c6aec1e54f928d9ca2d0d36aeae0e2b13efaa4c5d0
MD5 adc72d13c95ecfd5554885d7a4b901a4
SHA1 f4524095920e3bddffb33a1f3a05c0a0e7b6bbe0
SHA512 f24054302641ba7eec46c5ce8f99c8bdcd579c23f1042dfb0a79c0ad73879aff60a645dc11761edb0ae7f4cee14a391e17577f1b89a1d0b88dbd3b141629a36a
SSDEEP 12288:BeBNUbTVO86UIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:BJIUk9Xozsr8zbhN6GwXOGIh4
TLSH
T17285CF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e883e462699acc66f9183f5cf37e6f56c04b26eee969624ef395b02157a6dc7a
MD5 857a83874bd3645d7cc5433654decc2e
SHA1 947d041e491177b06b6bfc6f0c0a088f38594262
SHA512 62fcc46f0968081770093b51fa72230441ecbd44c5026057a07b94a38efab24d615777ac6711dbd67499bfc82eecdbdc291e2cbeff496d5a95ac2fe7ea937c42
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THJ:UQvGAdlCEL8c/RRNw5CFwFRKIh
TLSH
T1DC267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 0b205efd679676ac31fd014da7329d262a0c6cad6af41eefc01e7e48df6678f7
MD5 f9e6640584442506ca861eb93e916ff1
SHA1 50cb6465f2ab0bf127f74ef54079b15a278c1e76
SHA512 c5f24ae1c8b7b80b9aa6a38c1196d0a0f2cdb42a0a031a6cd0dca681d58befe7c1e3e4daff01ebab4d4e9b29ba1eb81a09ff3a91aed779dca4e3b387677f0c32
SSDEEP 12288:qAwSfxL/2Dc3VDLLmt0LDQewsAjKksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:/4ewsAje9Xozsr8zbhN6GwXOGIh4
TLSH
T10585E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db1fc7e2c81642dc6899dff4411344184ed8836d7e72b36cc95b2e7a1a106b37
MD5 0ff2022752de64582f66a504c7c42b4c
SHA1 57594e50668383a3451232c49cc6d328a1e538ab
SHA512 518b2cfe7786115a57329686754093a99a1bc84b3a435d5b9a049d5370c7a5f9c952740584fa49f5618a5edd57cdccf231bb0475d50fca17490a1386f89f5cf0
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHDDKI:PUEtQevvqc2W1cpV2RI32DD
TLSH
T156474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c7464ad2e1027a872d8b3b4524564e0a0c6ee2b9ce98e386da9217a5d2c5d03d
MD5 314d35ef2022ecbc8d47eae387e258be
SHA1 7929664b4b30acb4e0432580934c824acd2329c2
SHA512 d0fcec4fc46fd8a034b27946df0ffa2363e543cd3392b895121e4a1a402391e4c5c1b2ca64f52dbe6689b13dbb4ecb78e47e9da8ff44c6e1b374edeae4ccceaf
SSDEEP 49152:UCbRquA/m2yL5zifFiV+XenmE3/zcXozsr8zlLwJIh:9oqHVjnmZwFRKIh
TLSH
T152D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3af69dddb9392bd0efc23c8ed5c53c843b4fdd38aa9290e1431155aea91fe50a
MD5 c4e4ec20c5cdd85a994d3020452a92b9
SHA1 d5f2595e1bf9dca590dc8a7b7b748254d8dde808
SHA512 a59128cf2d7f7ece40b0755db46a067633f9d47547f9bb9007ae24dceff88004e10b9d2f597ed62b3ba1f71b8cda01d68a48d9ff4b17327efcef249f59578463
SSDEEP 24576:5AhGL2IFoiwtA5l7S53f9Xozsr8zbhN6GwXOGIh4:5AM1Foiq5VXozsr8zlLwJIh
TLSH
T141359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6040d1f32530e2a601402909dfa7ddc5cc44ebe080e5724f7b101e3c1c8f69b5
MD5 a09177f8a9f715aa2295779715a0c976
SHA1 dfbc592d722ed5a7de7335c6cb2eeaf14b544434
SHA512 cd0877819afece5b8b7cfad62036d999b2d80eec848b6984fd15eab5810d4dfb16b78c47683fa6f3205d5abd08d8d213c0c7cf02187fbc0a4bef069b1dfa3db6
SSDEEP 12288:3mw5HEjsChNkBFgl0WDm+CNksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:WwuVOWi9Xozsr8zbhN6GwXOGIh4
TLSH
T1BB85F14676A41CF9EAA786398587C535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 ebbde2d8bf8a9fe431be5a7da3e00db28da4fe32e2b99022585106466993d710
MD5 f0074b223b561066d97c6910537a968d
SHA1 dca91e0d9a18ae79acf5a9780eadd51a06394e5d
SHA512 f3c8e679847b6de361cdf15fa01b2908a76f53b8867699744a8267c91269cbce2dfb3c5cea0f3cede2d5fdf5f20a81a726a5b9e6c0a1b2a97cd651cd987adc0d
SSDEEP 12288:EZZ1IyaksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6Zu59Xozsr8zbhN6GwXOGIh4
TLSH
T1B87512AB73E070F5E6A3473898E15A44D7B3B856577203CF1238029A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8097f0abbfc5830f7f8f063b6d464689aab5c456f8a3e20793a2d032b7c66177
MD5 875e9a9d94ac2171381188472858dc20
SHA1 5e856a8eb06327638614f082223ea1d135ccb10f
SHA512 4411cadcc7f4c42db685ff6bc427f8461e37eebbe000652e1dc3e4e127885e45ff8e7398008ccb06996e76a48686e39b57574ec7ed3bf6647802b81cbe5aecfe
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ul:CQRQyi36YOcPhLvw2gAf+PN3OwFRKIh
TLSH
T153667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e85edc53103ee620a0f2def91aa8d79d87caf3ea2cbb67f526ed40ed1c828ebb
MD5 73fbee4a87dcbf593018579eca29a273
SHA1 d5ebdb58b1dfcde921969af3f88ce53159fcbb99
SHA512 bd7797afef22fea9ff1b75c9db9077f1101e1dfcffb8dd070791b2b52145822959cfe15df61d08bf7347d8f305f9931b6fe44b9288cd8c003a9528c18874835c
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ul:zQRQyi36YOcPhLvw2gAf+PN3OwFRKIh
TLSH
T1DB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 acce0880be90b925cedb19126c7c3da8a266e23881fba04a38a18601646d43f3
MD5 41c5d88c0dbcc2cf97ec541d4221c2fe
SHA1 16d17173dac22cd33ca4e89a35007e169efd5949
SHA512 a8c43db834d2e7bb7a758bbd8801478c84452c95aeeaa3515668f597cad18224d13fc4b38cb12fb6b7131fa19c6af6900ab585604466a9f0d3ab07f9760a8af8
SSDEEP 49152:l68Qg55nhceWu7PNU3/sXozsr8zlLwJIh:zthLRc/MwFRKIh
TLSH
T1DEB55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ed5aa09b02cfc3ae47d8453713753dd186d0900365d3e4e98e261d6ab7ff4e9b
MD5 cc40e515da5a1c7738366df003eb5eaf
SHA1 df57eea80b6136cdc8070a59bfef7a50aa3bb4c5
SHA512 f0e0fe527ff7b47058fe76ce25508d3ef1de1571b6d63dad3131dd4648a72ce9c6018ea138d6fb0104bd19b11024e7c60dd36606310c0dca1cda7bd8e6fd9e16
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99z:ty5112gYy5azzVva69nLKnhZ/wFRKIh
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d9b3023cd0183cda5bf1ba8623ba0d75dc4ee90cd13d0368beded86895605cbe
MD5 4fd7ae7691d958a26b7899cc89bb9917
SHA1 2671f7d67d06e7352f617c42dedc11b78b7a60f0
SHA512 ac53094ca9a7338cbce38d3d907c17be23943f26ecd8cdbe26a655ffc18eda7f3585c4d9f5d8ad1b8e1d75fc15b92f70c3f87458999f30ecc0f1bfb5fd16bc5f
SSDEEP 49152:0B+taZ3usBWOBr4tEG20bqx0z+n217aau1glqXozsr8zlLwJIh:uu6JmUxd2dGwFRKIh
TLSH
T1AFD5AD13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 10c1e1731d06f0f4c9787a3cca3a47037c66857d43b2a52bcacb79906bc23fc3
MD5 0f88291124861247401be253c0401158
SHA1 eeb9a4c2c884665f09eec9a71895daecce950c94
SHA512 d3e75f6f2198dc2e7546fb1b6ee67c717d7c1cbcc27d54eca9e5f510305e9474e81ff5f2b8c4618f21a4f0671b2ef6369fc1c7e7127bc38b8bdd5476de8ecf36
SSDEEP 49152:X1hpsNoJpF1A6BU44CwH7R4x+Xozsr8zlLwJIh:XmifPkRZwFRKIh
TLSH
T11EB5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e4703d28519c2d64e18e7efcea45b087396218650056321196b53b34ecc1f209
MD5 8fa0663389211c9062af2c7e4f62fd02
SHA1 2701353ea6b76589fd91c18fc4d3d5273db27152
SHA512 79860fe895da30841cc105450e816dd5e74c7fed56fcc181822bbe536227685113af64ea6b276baa8bdd939f96570ebeebfa8e2ff3a4c81ab2746b262ce00c18
SSDEEP 49152:2SuZQIY0Be2KNRVtOnks6NMHqbXozsr8zlLwJIh:Y5dKvi61rwFRKIh
TLSH
T1F1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ad9a5cbd7bdf105c3ae94b40e94b0439be56c2ecbc556e866c9439ead89b537c
MD5 9405cc999a85589a4e950920f41ce53b
SHA1 07824ee226b6e25fde26fa4c4bc862b0b18d587f
SHA512 2226207b5e0a768d9e20748b7553343a4ca2979c46105815fc782566ce717b58e98da9acad35621f490c8187ecc6883852fa4eac3ab30914d3f05d1c61a576a9
SSDEEP 49152:QhtSn8EApI0figXgiDn0AP5w6Xozsr8zlLwJIh:BX2iyphNwFRKIh
TLSH
T10395BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 1f98f5c6b444af4496eaad035f2a309b2d1fd2dd1fbda049639cf6d631f2976c
MD5 7b26fd115d9e434034905d70e78d4064
SHA1 092ed66def6089585499d39a0d27a5e3349a019e
SHA512 9c56621a5b4a51737f9bc7c9abe5f76d01323bb6abcd1666c981bd53d1da524c3ed85f1c868716a933d0e7a9b4011b4a207e71a10e09ebd5967585d789f8e967
SSDEEP 12288:XXksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:X19Xozsr8zbhN6GwXOGIh4
TLSH
T16A6523B7F992A442FB575F3129811AC4DAA7BD9FA9C20791333C1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 61db7586041933477d0a3dff7f21eeadd009ef2626f600d2c2e73c7e1ef77675
MD5 96fb06ac90cf9be34fde464afb7f6c6b
SHA1 9b0c83cc94a48ee76734f07e8464e096a5ba2fa2
SHA512 aceadd5b784e58238599e4589b0cbae1b6bd3553e1e985aa1d19bdfa68e9560afed26c1fdac8f4cb8ffa4048e700e79b620b68dd6502a04521e3a06930a87a58
SSDEEP 12288:+GksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+q9Xozsr8zbhN6GwXOGIh4
TLSH
T1956523B7F9A2A442EB575F31298116C4CAA7FD9FA9C20791333C1042DD7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 046baed40993474f4d8783b6fa2c1d41b15277acee22e462d6d179bd3c93f7e5
MD5 90d0a30868eeb05497a5dd4eaf825cde
SHA1 63af7b0a386bc7e1544d44af2107f45cd2632c35
SHA512 74370500e1787bae1d40a0c8128ce1cdd93bf9bc52e92a60c0fd192de7288d4e50042fd1534119fa8a3a048b559d3c1315b9d4451759ff4a2bde275fbc1f03d9
SSDEEP 12288:NQksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:N89Xozsr8zbhN6GwXOGIh4
TLSH
T1F86523B7F9A2A442EB575F31298116C4CEA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 464d581a9fa805e9b3822ac26395e8e62b5935a3d5f47f05993f08cc2aa70e1f
MD5 40043fad1ebf5e358dda17304f7b16e9
SHA1 fcc19f07bcbb0fe3cecfdafc2fda56ac5f992008
SHA512 0211cd7a7dd83942efdfb2acdb7efb3f381d9d8eb03299a00c19558bbe4dc5a13353f802a9343d02e416a06bfd6abc153d956e6fa5e3ab267819c622198aad71
SSDEEP 12288:bVhksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:59Xozsr8zbhN6GwXOGIh4
TLSH
T1A16523A7F7A550C2EE639B3198915684DAF3FCDE9B5207DB232800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b8bba3ebef7147c9e92e32a3a741989c4602773a530c5a1da1fbc2c9105aadec
MD5 b54ce27338f3fa183ae98323cacb5f5e
SHA1 3ff4f20f2b6e1aa5559876b908c025ebaa8c840b
SHA512 0ee892ad91ea699a8f1b1153d16b885c7d39d04296d9ed5359dff38d8ce41a512317ece723be703138a2c1c1124aa6b7eb42f6c5cc4cc27990420211fc89d9ec
SSDEEP 12288:TZksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Tn9Xozsr8zbhN6GwXOGIh4
TLSH
T1006523B7F9A2A442EB575B31298116C4CEA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 c524c4eb0b259bd988a83eaad36e1998dd4719bd281f367f07188d9c9f27082e
MD5 205d08a62ed67d559f3a4d38207905aa
SHA1 845de1d45ceaaac7322e18ae9d8e2863fa8d7a18
SHA512 bc9fedaeddb827ffe5b5770dfc4d93b996289496a552c9cdd7b1f625a04629865602292ddef97ecfc0ec05168b6321b73c539090b3687add28ccc6a5f48ff71f
SSDEEP 12288:nyksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:nW9Xozsr8zbhN6GwXOGIh4
TLSH
T1746523B7F9A2A442EB575B31298116C4CAA7FD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 bf9c423319f0ea3cd94eeedbe18d32a820ba1bf37b2d4dd7b789c7ff69885152
MD5 9d3337f646753ff623f6f679ff307ca7
SHA1 fbb32764f77334548518cbfc59457fb07e57b942
SHA512 761012c9d27db145da2b91922facbdadfc7d234921aa3974093c5dc42156b41155fe6b586614b1a073b2e4d42f9931c984337831336f35bc7a632ab7876bfa7b
SSDEEP 12288:teksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:tS9Xozsr8zbhN6GwXOGIh4
TLSH
T1FD6523B7F992A442EB575B3129815AC4CEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 fe863cd612c2c4dd285be59feb7c9fdfbaadc905cd3e2453aa93458528aa660d
MD5 635ae87045186eb0ec6ed6ecc18774ac
SHA1 b27c9d568b95726dc36c833382c1fbf76ff0186b
SHA512 a3d6aeace166162d94f740101c7e3a2553e3452454d12c723f2cfa1e2bd31aaed1ca3ae63163ba462264904b6f8aafcecd4a366ffa0b04b528906713e3c4f675
SSDEEP 12288:GiZwbWzzFEoS2cPvymksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:JZMWzFVSOK9Xozsr8zbhN6GwXOGIh4
TLSH
T1588501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832575F333A11D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 0d474e607566f827f53ba8a04fceb7d6f4e9e74fc62dadf9113a35f500c60ca5
MD5 f1823cab520bca5d703c1dc9009f6cd5
SHA1 836acb5e4e7735161c9bdf0762be69d18b1e4724
SHA512 f08dbbb0c7cacc6a3102ba520b5fce840f608a9fae3c19af87e7c1a068beb64c6d812034e7a6b6d1aca1aaefdef2f07d44db95e3c4b72d798aebd2ab6811bb83
SSDEEP 12288:B7ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:BJ9Xozsr8zbhN6GwXOGIh4
TLSH
T19A6523B7F992A442FB571B3129811AC4CEA7BD9FA9C21791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 1426a875f282618deda23e5e7ef98a632266ed149b2a1fa16badb89986354cc0
MD5 b47f22611975c8598bd0d5e6da0ce0d9
SHA1 b06508e0d7d40d7bc2a10d402dfb4bf4712d850f
SHA512 26f671a9bc7532c63ffa813b2e447b342b0c35ac0a8c07ce839cf0d3bcbdf0ddccc86d63d6b7e003fd04ae5e88c0053bdf77bb75e86610e88aca354386a3c428
SSDEEP 12288:rfksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rt9Xozsr8zbhN6GwXOGIh4
TLSH
T1B36523B7F992A442EB575B3129811AC4CEA7FD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a0511c0271dc85074503cc9bc593b0842db515917ed4effba6a02ad1bb293ee3
MD5 22714adc45e3c737ee018afbdc13f5b2
SHA1 ca3e3511ce02425b42a3e81694575b149869309d
SHA512 b7b098c8334b1918387f516d766fa1cd2b2c16aa8c8b53eb60b7f5360ec031749b49af97bd771842b06f71ce1bef6ed85c41d350dfb76eea7644797992f9edaa
SSDEEP 12288:tyPz5L8aksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6K:Ezyu9Xozsr8zbhN6GwXOGIh4K
TLSH
T126751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 887f866ca4ae9904633f83b7134696473cdbeb19d83fe8d22c344d0a42be4282
MD5 57ef5d995b15d9c23416b293b37c83f2
SHA1 33def3aee91246a2f24300901a222e6186046871
SHA512 4e76a16d3cc50139b5ed576b913dec98109835c4b6962dd8441648e0adde22af2d47620de924397e2b8951ce1b1194a9b2b8224f634403e69df367ca1ad0857f
SSDEEP 12288:B7ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:BJ9Xozsr8zbhN6GwXOGIh4
TLSH
T1846523B7F9A2A442EB571B3129811AC4CEA7FD9FA9C21781333D1045DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 92076d56bb597628ba2a42a18f66c826d2d41b1b7219dc0012ba4e35ae9ccad7
MD5 20393192468e845cd0f0ae7591ec62f5
SHA1 9454078b7475a3342cb9ab92a8c2267fb32483d4
SHA512 39e955987f89ee0e014da2607ada634b08f7047010c1d9dcf8fb4b994ec8bddd9857487d87fbd9bfb1b2d05cbf5b25125653f0e9f6b79eee2fe5af28eb72dfc2
SSDEEP 12288:n7ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:nJ9Xozsr8zbhN6GwXOGIh4
TLSH
T1C96523B7F9A2A442EB571B3129811AC4CEA7FD9FA9C21781333D1045DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 cd2c40b7d5213952addbc1996b12949001ec086139d1370c28bb41bef5a8ba72
MD5 9c54c21dcfecd6256c2137bf51f2fef6
SHA1 837550e57ee3f03c6b8c2853546b372b14403eef
SHA512 b72bddda1818eecfbfb0c1776bff96a2da0716d6a215e68130b9831b15a2405d12bfbedec357a3a7c3fca120d916e4ce99a79068cbe7c1c3a210d8b096bf2219
SSDEEP 12288:qyPz5L8aksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3zyu9Xozsr8zbhN6GwXOGIh4
TLSH
T1ED751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 300fcda19696698518f61cc23b01cb6a4f0258ff5b6a7ffa4d982b00f68c5155
MD5 37ff6dd3ca1b36a80f3e6f1d467ec9d8
SHA1 c09d675ab2cdf15fecb3bcad6d292288f117d1f4
SHA512 f4bd0cdcdff107b450ce5d0d89b2e7cfed14fc26738d19ae5c4043c18015811b854d1c31106a0bf3d4599aa44e68865893c64c46bbb2af8804857dfd0abc8e9f
SSDEEP 24576:CTHaLl3z0zDs9Xozsr8zbhN6GwXOGIh4:CT6LljRXozsr8zlLwJIh
TLSH
T1D28501A5B39018F8ED67823EC8518945D6B2BC5A0BA0C75F13B832575F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 af7256938051b0ad5bf0dd2e322608a3efdf7c0640ba36bfe0052a111be28ca3
MD5 691d6379b0b82629b1c86208d6fb7c55
SHA1 41317f544da2f42370a86f456c03ed01a2ee0a85
SHA512 eea9f3bf4518d659dc5cc24ba982a3eb8e0207b955eecff834627a7b0938bfc12c5b38e8daa638106c4ccaa5231d9d50728a2902e6eb2fa02741214003e1a0f0
SSDEEP 24576:53Ld9CHKy7GZ49Xozsr8zbhN6GwXOGIh4:JLd9CHKya0Xozsr8zlLwJIh
TLSH
T13895CF91F3E414E4F1B79A358D724511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 d2af3858e49ce5e7d3cecf09ebbd800617540b325a3d3790f599f7daf509d6fd
MD5 668245984303d2357519667613dc70fd
SHA1 97a10f3d3c4285fb65b335e5fb42429e95e97e7c
SHA512 9ee8a5fff4c3e8c482640f7f7a94763eedb8cb31c7be67359811fd8b51db2c4417ade848dd90678cf9f4d5673006596d2cc88219b34521bb0124c335e6510afd
SSDEEP 12288:gwksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:gc9Xozsr8zbhN6GwXOGIh4
TLSH
T1556523B7F9A2A442EB571F31298116C4CEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 7a7401b3ac912139c535479066a2ccff8a42d2312575fb69f479460782821e33
MD5 3a53f2408abe8d038b7d6b2f4dffdc2f
SHA1 c4da909a7c9abd807c8db0478d5836fc96ff2ab8
SHA512 0d02afbf03fc5a955c357034413d084f786af90cc3041a31d8bfb922e5d275caed62c3e91cb01ca9896ed8e2335eb1505dfdaf694b6c2f7de702f4e11b2a3488
SSDEEP 12288:76ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7O9Xozsr8zbhN6GwXOGIh4
TLSH
T1856523B7FAA1A442FB575B3129811AC4DEA7BD9F99820791333D1042DD7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 390ca8a30ed758e8a748ab1b9119a02c59e08eceb2550403d4c0335da3c0f450
MD5 d8fff883d8a09c47da07b5e4fe2be487
SHA1 d9af8312325431c0b0c8308cbdbcf85f459287d1
SHA512 99c06e23baa5f735790d65132b2eb4f01914d475ca74126f290e3da379372e0ad12d2910bfc66828b3e8d1a4d90f56c378757fb8a044d77aff70f61a3d65c014
SSDEEP 12288:+lksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+D9Xozsr8zbhN6GwXOGIh4
TLSH
T1DB6523F7F9A2A442EB575B3129811AC4CEA7BD9FA9C20781333D1045DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 022e16adfd16bcf8a15216a53e1b4119652903d57a02217992850934543640f3
MD5 2695c2db4cea823ec08febace34f1afc
SHA1 3041d3b0ac39cf9816c56736bf4d9b3ec1fba2e0
SHA512 89eebb04bbd103a20f2a8bc291aaa870ed2250a72f610de0b5db79cb1b76c01108fcd37ea1ffd71d90d8a87dde7da451d778d0b3d1dcce5cc84597bd5e44283e
SSDEEP 12288:I7ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:IJ9Xozsr8zbhN6GwXOGIh4
TLSH
T1C16523B7F992A442EB571F3129811AC4CEA7BD9FA9C21781333D1045DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 11893bc738eaa827f27708c774b5c164970b6c4fd8d99b08ab9b1c5cd450b010
MD5 a3035b4c5f8d2c1ed95c44218c37c774
SHA1 9f0bbdb18ba903d86402806a138d1bb1b33e46e7
SHA512 4b78d2ae1ae832bc85cf6ca47d0ea0bdb78f13d656ddd890ed8b155b376aa488df6163e6a374139eebbda702b2f4f7a9afda8d4062abfb7d183d6124b5b052d7
SSDEEP 12288:6wksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6c9Xozsr8zbhN6GwXOGIh4
TLSH
T1BC6523B7F9A2A442EB571F31298116C4CEA7BD9FA9C20791333D1042DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 8dcf00b537bf2a1cf8703096539f2ecf04a73d8b02f8aa537bca92aa8b0eba10
MD5 cd92eb107d68f11025344b5afcffbcf4
SHA1 30353dcea920fa723b02fb224f23723ad8c5db9c
SHA512 eddf04911596afbffa7911e7b0690f003efd0934b8130e2122d51fbb49e8a917e5793bcd7dd3add01718f10fe1a8c211a0d588ed79ac96d4bcc3d10b1eba41a7
SSDEEP 12288:NzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Nx9Xozsr8zbhN6GwXOGIh4
TLSH
T12F6523B7F992A442EB575B3129811AC4CEA7BD9FA9C30791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 26fe7de3f5ecec2999db4ebea211f12140a59b26f39dc82d4c03d904b8ef2cf0
MD5 86e5cce14c18c08fd2e54c2305fa65e3
SHA1 b3e69dcf5491991bc72dd83a576d38fe470bd3de
SHA512 3edecb348ee051fea2d8b73a9677393dfdf5258652ad43632bd755a3537e7e785b40766b6fc440e70f2841bdf99597c93aa0afc12c1731aa241ed1d9ead950c4
SSDEEP 12288:SZksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Sn9Xozsr8zbhN6GwXOGIh4
TLSH
T1136523B7F9A2A442EB575B31298116C4CEA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 106ffa60c4d41c42ef0e10e621a2cebea6e97e67d989608844917fc8f7d4a994
MD5 889cd1a11e14f2cb609d91ddd9202268
SHA1 1504edf8b09ffec7ce267667054e26e7893bc876
SHA512 65dac0924e15359e8c8bdd76f7aa39e3ca97d3e55e57ab26dee8cd434a64047811e17cff4c9a5ba8be53c248a30faa69b4bf9f76878c1a95012aafd61712a0cf
SSDEEP 12288:XYksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:X09Xozsr8zbhN6GwXOGIh4
TLSH
T1D76523B7F992A442EB575B3129811AC4CEA7BD9FA9C30791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 108c9319ec933f646ac43b4866a74ee57a042698f1b5edde5539e74db9005c8f
MD5 6f387c0f13f51496605e3cd9a273773d
SHA1 17c96038d7b65f395a19efb9bd51250562dce7a7
SHA512 873544e296cba367b279fc9a9313bdc4ed9c99744e5404ef66f11d7d1d9b73a1bead479322c816dfd08eee6344c90d1bb5d6cba1a6e3bf665fd410b11d20f21e
SSDEEP 12288:rZksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rn9Xozsr8zbhN6GwXOGIh4
TLSH
T14C6523B7F9A2A442EB575F31298116C4CEA7BD9FA9820791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e67448c67326eb16d59a1ee26b54d292f0bfd829b91767de15f71ad1641671de
MD5 df0200746182d2cf851dbf974eb1b851
SHA1 bdfc08dab0315857f724702967fde9b614647dd5
SHA512 7fa1d89b970b5d074023741ddc05ebe81400e0a24d7fea38bde05d7177a62b3e1778d6a51c4f1f6ca4b29b692357354adf2b15184b5f58dfdb46fd1e82e62916
SSDEEP 24576:zfwv7k9RX6wkyAI99Xozsr8zbhN6GwXOGIh4:eMnYIfXozsr8zlLwJIh
TLSH
T18095D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3ef4c14aa3f3db0a94422eeb28bf268993f79dd5420cc57d7617cfee17ddfbb3
MD5 0c6e742e2420a203aea1711609fcce63
SHA1 b5a2b29cea50a4c427218cdebe15638913980ad0
SHA512 1961cd24d17ab6719387a40847aa9e6ccd59c8d29a41a5e3db7a396434ff5158f1e136b0d68af44639f190c90a290f50c0bd12f79f628824427ee8643a0edcc9
SSDEEP 49152:pYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aXozsr8zlLwJs:XySzPuwFRKIh
TLSH
T1B4066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 90be6b0ec214f96b1c3f04a91707ce3f218ddff91e12f39791fc8d6c59418f6f
MD5 994c0c1807abfac8340a32d30129a0e3
SHA1 55dfc4d1b59237d6ce886fc03ce3e0bf395b1651
SHA512 18214dcf2f67ed691c569f47c5ea791feb164727c982856e6b7725ac1fea69e2dd1656d761fe9b78ef85b289bbfa3d4990dbd3a2b4c561afc60cb214b189ddc2
SSDEEP 24576:P47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYa9Xozsr8zbhN6GwXOGIh4:P47JUQj4irIhCnDHUPfF/qXozsr8zlLT
TLSH
T1ED65AE1EA3EC01D5E1BA927885154A5AEA71782E1F31CACF2270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 15dd7addc3a1e2894eac07475ead18439d8c60e54092fe0bb6ffdca115c916d5
MD5 f7785d1f69d80da8d2cf30047a74cd6e
SHA1 da1bc222dade237c5c77d5c4190e85db4c46fdd1
SHA512 3349b66d5d8553dd0209adbe2d1438401648c7db38db1ff76a2ab29a123e487dfa5e27497d2505dad91490904fa31f5e7ec6435c8b7ad5cf854e62d65473d24c
SSDEEP 12288:fQsfrksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:v59Xozsr8zbhN6GwXOGIh4
TLSH
T16D75F15AE29411D5D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1dda7fb07ce2fb2919f231f8431ea00f642c369767af4cf1469b89dddba1fd53
MD5 8be8bebc1fcc48ef5931fa2c213a6800
SHA1 d32913eee55de03bbbb99961d763c7251f3cf57b
SHA512 59bff9159cbec35053ae2e0f8797c7e1c4eb3859b34ac39a9c0d56d112bb1cf98bb63da8648c04faec099b32e2b53e78a422766fab342e94fe96f27156b91e59
SSDEEP 24576:oDlJUP88uujqe+qOUCsYdylvQJF6WHRvQe:kJUk8xONsYCvOF6WHZQe
TLSH
T1CD452840762BC78FC6A944325E76D6CCA7707D05EE05AF0773C8873F9476668BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 553bea4c21afb10d6fda4174072b2ecc4731d40865a47bfe43528fd86cd4ef6e
MD5 e542a8e2f70801bddc3b2494ad374481
SHA1 5ef180205362bf435c2d6c1887d90412a11c6c38
SHA512 3e974c4ea7c5c496a98c90062825904f1f1cb60d8644b88ac89129faf8c59861d7b479479977525303f46e0f0bc11b98a446907fc48809055cbb711a78512948
SSDEEP 12288:lhQZDXCck3B/fK74JnD9icH/DJ1bsOjBX44g6Db2A1zOKyBXlPoZ:lhQZT5otycPH/tNg6DyKzOKgXlPoZ
TLSH
T11C552940A5B7E35FC9AE9037423286CDAB746C07B7453F0573448A3C9867A7EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 f8564456c37d946fa319d12a79c2f2992136af7ac12b942425f578ee93b421e8
MD5 98e79f6282bb767a82ae6f94666bfde6
SHA1 61c7e30c3ae39d67a4150f32db1dc8781272aed6
SHA512 fa4f6e40f43a5b50df86af034ea4c7f59cc9091d126f876447558ec6f4c17263e353bb7b0f423c29847e18762bbe41978e6a1c760094f172824b21b82ec94d60
SSDEEP 12288:Nd7jksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:nh9Xozsr8zbhN6GwXOGIh4
TLSH
T1CA6523B7E795A802FA771B30288556549A5BFDAE4F8107C3322C1186DC7A8E5BE31336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aebb725816ec514c917c987737a80e8c3dcf735d8226c9ada051b5d0f147d556
MD5 53bed9766ce7ec1e8485dd5182979bc4
SHA1 85c0d459a763a2ed39d50ee6c5ba4c3b7401b68d
SHA512 35f762906d7f312bb2d694b6fc4e1b8c30c28ae1371a0623f6de8575f128546204b6a53c73c2cfe8c9b2361e1898edecbb30804359a8bd6ac87227591e45f285
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYb9Xozsr8zbhN6GwXOGIh4:1gb4mBIBhGFYXozsr8zlLwJIh
TLSH
T12765AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 3fe175db82fb22c42aa86cc3bbc668805c220e9256463f0c5aaed4e2fa95d946
MD5 d2a532a9be5d5f5cd35ba6c6d61ac7a9
SHA1 5f7e7814d2d4b8f42e9dbb187cfed57d7e0072a5
SHA512 fe39d93a1a05ef7b2b30c7703c1e6c59f0ddeda6524875d08bd28b4ca0fbb552a5fbeea379644b340fb7611bad9d9b284afae0b0860b679cd9592ed365c38620
SSDEEP 24576:8G88u8FpJqH1czria7/mK9Xozsr8zbhN6GwXOGIh4:/7ZFPqV7a7/JXozsr8zlLwJIh
TLSH
T179A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 10d9cbf6dbe16578844d4da354f13f6fceb336258c2c0b49a94e0ce7b6658ab1
MD5 effadab360077586defc7f39672e2d6e
SHA1 2708e5d18998a50928cff9b00f14c15364eaf554
SHA512 8ef9fda16f8676ee8195aafce147229398749c4d813b91fa264800c5363503eaf500b50e6fa872702e1799b5c0b9381d81c4b2062a7dddcc56910487a7a90778
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkXozsr8zlLwJIh:NG05lO43bHwFRKIh
TLSH
T136D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 90e8b224d150c07530b6144442553f9b071580f623fc9302d1ad076940389c6a
MD5 526ac3830ea84e8b8d4ae3a248e7f0da
SHA1 783ac10e27ec4c7cf6847a866eb0a41aed66c0ef
SHA512 2eecb47cc54a6238dc8042064db4afe29787e7f57df28c049b493c368d4df5217d28f30c91ce91aaf9e7a708fd0df031b578d0b2a68b04b6f405d2e28a07950c
SSDEEP 24576:7fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnA9Xozsr8zbhN6GwXOGIh4:ja5POZ39Jt2pasx2+msXozsr8zlLwJIh
TLSH
T1C765BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f79c5931e70df315f08ea44be34a65571a24cb75176b66d695117dcf60e0103a
MD5 38a3c4b7145d234cb7dd3347b5883c77
SHA1 8b5b0b85efa62c2b3cf9af898ac4304b033a6509
SHA512 6302acdc7cd87543c43c8772a72ca636811f325f3a77c38d6082bf4ac839f50f122af1e5daa5c0c35cf6e2b365d1ca96ec31d1ae9502cf19151f8f1fc7301161
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkC9Xozsr8zbhN6GwXOGIh4:bNc/zEOVHFpXozsr8zlLwJIh
TLSH
T1CD858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2dbdf11a0ab2ef3ef971d56c5c32d584b4ca48187c29c4341be11af4a0b20192
MD5 93cc1154315ddcedf4798b05ecde8839
SHA1 7ff4e92bae805c1ff0f6a99c6a1cf8904997e8e2
SHA512 9159403baba7da99a9628890dba32d64a21e4e61fce77992f40affc5cccf81377839d1a8922de96dfc976e33350c5a220ea660a69353ddf12dfd84f38921c95f
SSDEEP 24576:VtkNvNnaFeYhJNtmZBm09Xozsr8zbhN6GwXOGIh4:VtMwBtOmuXozsr8zlLwJIh
TLSH
T12F55AF6EBAB845E4D1FEC6B48D238512EA727861073253CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3674f44952debbadbbe67e1cc3c6c435e03d9ae7b0428823187de741fdd415e3
MD5 2249001e907a370837d1765500df6889
SHA1 745afb3f2c80a559fd64149f2ccd31a10cbaf679
SHA512 3a84e70bbdeb2f56b948babcc9ef843e39c8be5f3135ce27cea209360f92545abe4767a760f07060d722c831aea5cdd21e591cbbd14a81b54bd7f3a7529f97b0
SSDEEP 12288:7HvUrBFrEjwaQCksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7PUr+NQm9Xozsr8zbhN6GwXOGIh4
TLSH
T13885F26F72E918D5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7b99c6163e9d87d8a3a40082c43debf4237167ea7ad58cde6a0d87cb9b4e5bd4
MD5 9d017f9bfa6df66d528d00641e4821c9
SHA1 f4d54f4cb6f8f60a751134d85d549f5aac46a58e
SHA512 a4cf2f2cceb657f30d4077d19e86ca93f47ec3f37e85e80b9a793044a3d85cfbe93ae62825c469346814e2611d2c326467b04bb9921d5cf6e93a99c053dd910d
SSDEEP 24576:4D3FHshBIYQgAV9Xozsr8zbhN6GwXOGIh4:4DVHeBIAAnXozsr8zlLwJIh
TLSH
T18795E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-309-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/1004-79-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/1004-84-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/1004-78-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/1680-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1680-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1680-14-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1680-23-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1752-52-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1752-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1752-39-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1752-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1752-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2336-77-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2336-315-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2336-9-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2336-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2336-310-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2336-8-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2936-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2936-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2936-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2936-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2936-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3220-295-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3220-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3220-65-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3220-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3356-113-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3356-369-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3356-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3356-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3728-137-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3728-126-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3728-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-132-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3728-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3764-279-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3764-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3764-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3764-54-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4724-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4724-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4724-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4724-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5512-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5512-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5512-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-381-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5932-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5932-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5932-365-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5932-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5932-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5932-108-0x0000000000760000-0x00000000007C0000-memory.dmp

Download