84ad51909e14d371838f5b8af28a47e6f760f30ef22fbe1fb03403f940a5715e

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample260804-gd43dsdg65
SHA256 84ad51909e14d371838f5b8af28a47e6f760f30ef22fbe1fb03403f940a5715e
MD5 b9262069a456941413d1a33ead519a73
SHA1 2d25744670075aa2f2a68f3af04af49b7ee656fb
SHA512 3c4c1876151d9d877cc1bd9488d7ec53ae3d74fd8573175f62ff8a3e6f6ac4d3de43b755973d4bbceeb5e22981cb27ea8f189c15e009da6b1494e77f135ea108
SSDEEP 98304:+++LHz1i1oYJvJC8q2VhkbimwslgJTIZ5Bgp:J+z1i1oYJvJCjYhWimwsT6p
TLSH
T190269E16665901FCD5B7D138C6CA5627E7B17C1603B18BCB02E4BA661F33AE26E3E341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3256	elevation_service.exe
4884	elevation_service.exe
1268	maintenanceservice.exe
4356	OSE.EXE
3644	PerceptionSimulationService.exe
1908	perfhost.exe
4532	ReFsDedupSvc.exe
2372	SensorDataService.exe
3480	ssh-agent.exe
4568	AgentService.exe
1600	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b73b9ebae05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c79db46bd423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a7e6dabd423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068dca86dd423dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013f0bdabd423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091ee1f6bd423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089e44dabd423dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fb6126ad423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000487d586bd423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e190b6cd423dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2836	2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4568	AgentService.exe
Token: SeBackupPrivilege	4532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4532	ReFsDedupSvc.exe
Token: 33	1600	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1600	SearchIndexer.exe
Token: SeDebugPrivilege	3256	elevation_service.exe
Token: SeDebugPrivilege	4884	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3052	1600	SearchIndexer.exe	100
PID 1600 wrote to memory of 5632	1600	SearchIndexer.exe	101
PID 1600 wrote to memory of 5332	1600	SearchIndexer.exe	102
PID 1600 wrote to memory of 2432	1600	SearchIndexer.exe	103
PID 1600 wrote to memory of 4444	1600	SearchIndexer.exe	105
PID 1600 wrote to memory of 5688	1600	SearchIndexer.exe	106
PID 1600 wrote to memory of 4736	1600	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1268

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1908

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2372

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f535b1ffd458066b86dc3cd58569eea6c0c45e2edb1d61e61bb149a2ac76c49d
MD5 f381f41fbbc42528f17a59e939873606
SHA1 da0a37b6de5f08bd41d0e60af956057e8c190cc2
SHA512 c44c4e49890a7581a72a22d89da2b6f997e9454e52dc1f3af1e2d0f4563f353e6aaefb5cbf8cace35fcb04538ec0cae02b681a6f4c459a15e826297b34c1ce3c
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnvb5+Pl6bJTIZ5jdgp:43q6mjBSslgJTIZ5Bgp
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 037f9a4a4db1593b7a7cffc99c0f2b3945d14d451e16aaa5a229bc39b339be3e
MD5 b933550613b558186f92d5fb32b06113
SHA1 27eca07d7f0d8d4446145863788c6a9dd19ee9ae
SHA512 de8862dec474612e9bc0da9dd658e6292e87dc2d6c7d9b7f0da9a774e11c52b7f35d4fc070658f74daa7f36bd22c18eb4ede040bf36951958159065cbc9e6f50
SSDEEP 24576:WXYfDtczAVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:VtcBb5+Pl6bJTIZ5jdgp
TLSH
T12885F11967E504F9EC67823DC8E1C601EA73B85587A0E79B03B499265F333D86D3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 78566492a7e43f580aa22abc5021e684c91580949b9b860b855c6e43182e31c7
MD5 bce5c3e1c7b7ad7cd3e733387343b0ea
SHA1 d4a30d3a89761d63bfa2f23b3044eeeca591fee3
SHA512 4d824111f456023f1eeb4f5e267302f05dbcbe38d1f14cc1be29668f10dc16a854e1a8a92f5ff1d66c02a0d6410a4a50fa0c61b6d12f3aa4d8cdb08679969ffe
SSDEEP 24576:h0Le5ji0hmxyrMgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hPji0AIGb5+Pl6bJTIZ5jdgp
TLSH
T1B095AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 10eadae94fc4da183745e3338bda346df6aacab8516e9b3e8563d7dd1aa83d6b
MD5 895b732729f7af36e50c7fa2562a510b
SHA1 74a70f01e9da84fd734cc04867b97393ee146a64
SHA512 496abd63d3b3a0c83067a8af3f6091dcf6f2fddd8a32aff01fb7a4d57c7c77a32020e2bbf74ecf8deda559f7fc0c81a334486d196d25ab64da4fbfe2b682425d
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWj6q8wyuOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:7/ezSC6vUzPv+HjyKb5+Pl6bJTIZ5jdw
TLSH
T10F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ca64dd7fce0d3531a49874256b1c89ffa987f72fdaaddd2cd9105621b1d5c631
MD5 2c1ec477596853687b0eddeeceac5702
SHA1 76422464c1165677db437f77a3208ca9b0e57e73
SHA512 a879e9d9cd7172a73c55e9ed492679cab9fb95ad022aa3d85df5010b0f91ca80b3932b57a7382e626655e72da729fa13bff75a1a536736b10901d3734cdba22c
SSDEEP 24576:JVbqPb88hv/l+B5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:JVO88hXl+mb5+Pl6bJTIZ5jdgp
TLSH
T1AB559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 eb02b07ab29456e2d6e5927adabcfbef9f6b7b32f57d296f7f600da252c02da0
MD5 ff73039bbd01b604b499805d8a6c4b8a
SHA1 30726df78ca128ccaca2e21b23fe56a52bb2b50c
SHA512 6de209a0c0013f3180a375d368a6864108c2844fef9fb9e094500792133c1d4ecdd706b243fb08d27d6690986e7dcf179845334a26a310974a1abfd7d1e29455
SSDEEP 24576:xFUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Xb5+Pl6bJTIZ5jdgp
TLSH
T1686523838B6930C5E5AB1739D9CCDF00B87AEF55CD866B76C5752C2BE134389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 20fb9063e45a95f66876257aee9deb8e06091167e8d8292fc25b057963ba36e3
MD5 946403a10fa5bcd258ae6df740d0351f
SHA1 ba11b4aef7d7e11ca8c2c86723c5ee2c10c1831b
SHA512 57ca26cd08874035ead3f98bc4c911583f0642e841ad34f235b6181faaff24e92c377bca7db62551f8ec1c6d87dc2bb055979fca8492cd6c1a1b58fbfab39b6d
SSDEEP 24576:yJIUBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:yJIUcb5+Pl6bJTIZ5jdgp
TLSH
T11B85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 544436fc5b62d01617106fdb20dab79c50ef6f43ad05eca175f3d43311b45eed
MD5 0f598cb6126323224a8bdbd676406ede
SHA1 5bb25c27aaf79e0dd7efe086cc1c30cbdbeaaab0
SHA512 27e4746928a6d9ea2f164e28db23b794f0a9bb2ac261085abce39cbb8b6e1ab2bfa453e8cb4deae8b692ebb56a72649dbd465b89c2470f9a51a3e4205fce6e56
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THc:WQvGAdlCEL8c/WRNw5C9slgJTIZ5Bgp
TLSH
T18B266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 fe2e3d5ad252c93076b87ea649298e2bc535894e891ccdec36a9c5a1da3ba1f4
MD5 b19ae8a2c7a51d8ce5196654b5d998ae
SHA1 f4b4b2ce4c2cf75d2b3d6c116ebb8ae43ba5704e
SHA512 18b42348b8e86e8d34c79f01b2e2feaa8c8075e3b9d93e9560ea952692f03b077a30a92bba3aa74a3395840a4e4ce4850e151860968177655a0432aeb226bd20
SSDEEP 24576:BOewsAj3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8lj2b5+Pl6bJTIZ5jdgp
TLSH
T15385E031FE74E036C2BB0DB65B65C706643DBA208F511AC3E3B84D9E99302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4d35b2342c6ddde169f7be1fad5e248f1f1bc5e93a1655ba31250b7c94133912
MD5 e39bdab41e5f608423ed0f15770ddc28
SHA1 6e205a2eb81d2dd761dec174ace8976971d95dfe
SHA512 22d01d9297340d659bbcf322423e057354e79cfdd5703225ca6250f9edd1c2483982b3d322dc5c84c0dcd756c6b1c041676acbe88b720ef91ad1ab49ab97b699
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH0sT6p:VUEtQevvqc2W1cpV20I320s
TLSH
T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 74623a3bf40c27d12858a42d0e53cfbb5e12f2b79790cdc39824bb9f77d68c8f
MD5 405616f8c61f477883359403a76df11d
SHA1 6a772358b85dfc0fabd912022908601086c02295
SHA512 9c6b3221731ae2ef49e11ce296e3a0843ef7e02e86c57aec900378c47480ce24721dcce455181180071684664142eee5c7e065b69fcadc593e6e018fbe1abcbf
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/zWb5+Pl6bJTIZ5jdgp:8oqtVjnmhslgJTIZ5Bgp
TLSH
T11ED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7db8b3cbb67d2a815cd36c4036efa782a870390f1d3f5eed7ef3f0e6d92bcf26
MD5 13e568f76c759c9ce64745053dc2a297
SHA1 392c8b771ad1551f4d3e9e5cd606a6e53068699a
SHA512 044649f7bada0b00fbd4c6bfde63bf7c11cb1c4ebfdd2ae0a63c23bc71a25703be117e9fdd8013ec2ce0e78fc9d8ca4c3495ae6399d3b7ec7c1acf603e778562
SSDEEP 24576:pAhGL6IFoiwtA5l7S53amb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pAM5Foiq5Vb5+Pl6bJTIZ5jdgp
TLSH
T1FD359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 2bf1c6c018c5432466727cda03d1e8ee0b23cca0ba32cd62d081a2a9efcc0397
MD5 c9bd396fc949cce2795fbbcc0cc92780
SHA1 8ddd287609e6ef84bab40911ffb4fc922ccf6839
SHA512 bc5e4cac68ef481504d62d1c305785c47ababa5fad2db82d653b7873f5346eb573171d5b47d776ebe1b7ff3e36779b4d610bc3d275a6adef7cc8b76d9d409cc0
SSDEEP 24576:kwuGOWTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:kwNO5b5+Pl6bJTIZ5jdgp
TLSH
T19975F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 a5f5928c36f9bbe49b8eebdbc162f4f8a8991bc30053465a05362a2e1d2014f1
MD5 93f0624d649d94fe2c06c11a4eb12bdf
SHA1 0fd01633c7533ae0fe7147280d3da0e39fd74b56
SHA512 dd02f99087931a5138c07204f48ab59356f74b3be376d712ef5eb27140d37b63642c4a6ec15cd150b4991063e960c71c8725b7de489dacd5dcbb13352c5e6a3d
SSDEEP 24576:CZuomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:vb5+Pl6bJTIZ5jdgp
TLSH
T16465128A17A830F9E1A7523DCCE58B00E772B8529B7653CF4674056AAF33BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0bdb1ff0ce9d11e5140e7c8314d1575a5f46f119a314fa4438b22b962a8c4c89
MD5 426ebea7c8eab9f5d965c4eb0b67369f
SHA1 3a44b26fed79155266140dd72335c588743bb701
SHA512 7fe205636d14ae1559e18e3931eef078e285c0aeee536248581a3050e029dfd252a277251e611e2de65ac503b3b55630e00bb748bf29ab4ce1a68bee3c491efd
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN3uslgJTIZ5Bgp:SQyiKanX+PNesT6p
TLSH
T144666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b91dac71b73dc5e9ea915ed1d0d40cee74a2974785cbf01420e4b4addee4cd8b
MD5 fd721ede0140fc9630be09026668d797
SHA1 d526122e89247fe6473f3dfb8fb068a16efccf44
SHA512 079b6ccf706b0b919e412f30dfe3c34b64840f8afaa1a6c6ace0cb5c49d177f9bcfa3a60b9382f75abc98a53259175c907f24f56497174f314e4736df257f591
SSDEEP 98304:dQRQyi36YOcPDLvw2gAf+PN3uslgJTIZ5Bgp:UQyiKanX+PNesT6p
TLSH
T167666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 139d64e6e5fb08e437a42ae2b31cdf6de33a43bc5d82f9663603d8ad6a10b4db
MD5 048cf868119c196acad3186a542adc15
SHA1 3fa1c7e7cd862617a57540a5cf2afc2973378ea4
SHA512 16903cbde869843de281a89c5455181950dae7dde2d869eb5e7b86f9129be6f912e97b970694d5c5a42161ea24908f108ad35213f29304044f04f78cf2fbef68
SSDEEP 49152:d68Qg55nhkeWu7PNU3/Gb5+Pl6bJTIZ5jdgp:bthTRc/8slgJTIZ5Bgp
TLSH
T1DEB55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac9cb089f1b0c19fd9e5fb7a8eb3b8c95f8f09c7b008f72c9b8db0328b397304
MD5 45dab11bb0d85d414a7fcd3c7ba764dd
SHA1 00bbdf495051098991fa1d1c9559ad02bb8f8a9a
SHA512 7e0a0dbae22a060e343ad4cd2e159f5c503e94658b56b5a43c36fe0449d8c0fb43932ad3e64f55c80eafab73f5f75c132920760358f7ffb6d391ff2bbe58a3f9
SSDEEP 98304:Wy5112gYy5azzVvU69nLKnhZHslgJTIZ5Bgp:HLIHRWhpsT6p
TLSH
T1E9167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 40eb1f158ca7d9193b3d2110ed31a4db0dd53556da050bd8ae8ce5db00d23a18
MD5 7d101b9d041d5177dfedbdcbc1815548
SHA1 a3916f1feefbbe2e69d8f8ccd3aad10470ea7351
SHA512 7d17a8cccc071913c62d352d6d3f67a9473bca0a14bf32d14e98bf038bc93f9f283cca4263041336ec5ee4beb593e4666d7b2b0d7784e9388e7022f4972135e1
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glob5+Pl6bJTIZ5jdgp:au6JmIxd2dmslgJTIZ5Bgp
TLSH
T14AD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1daf4b3c1847bc4bcd8d997696d54f4f046f59a7548dd453f456271da0316dab
MD5 c189d9e86829c03da6f2a4e22100e67c
SHA1 fda1b19b85806c7165eacf557f834772b68db8b2
SHA512 02849e03ceb16bee148438c3a54dbb71cf3ee5150e4c67c452ee293040eb46c395c2382b85246365b13b9c47d519408f1a2eab5919bb33f56c500ee402d72c27
SSDEEP 49152:O1hpsNoJpF1A67U44CwH7R4x8b5+Pl6bJTIZ5jdgp:OmifPqRhslgJTIZ5Bgp
TLSH
T142B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8ab03689ebbe72573db5f67b9e0e16cec78e2483ce3a9dfcdbcc95f40820a9e2
MD5 a743efbb5d08369428824d9c85aca04e
SHA1 d599cff6978e3a1c0dbb2c64b2b99ad9e2d5943c
SHA512 135068a103c6fa019d92edd66aa8eaee53b255fb02ca69d873f9e6f60f1ac253b91c64ddc3852ee7d3824c34be66d4cdad386164c5c02038d5828de194170cbf
SSDEEP 49152:5SuZQIY0Be2KkRVtOnks6NMHqfb5+Pl6bJTIZ5jdgp:X5dKqi61jslgJTIZ5Bgp
TLSH
T1C7C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 741e503474ea15e8bec44f0e375a4d4d22be7ca246a9d9929aef823f82d636fd
MD5 a4ec650635aafa9581bd0ac9b865ec69
SHA1 e9420c744b53706a3f51c63e2fcf2156be5d5d02
SHA512 49a3850cda775149b3b2101e75809922e8270abcd24a30a9d75577093c8fa9b7b518ad1d147e66db5309b644f04300d311cbe69315f778c269443ae7886fbe4f
SSDEEP 49152:QhtSn8EApI0figjgiDn0AP5wYb5+Pl6bJTIZ5jdgp:BX2iWphFslgJTIZ5Bgp
TLSH
T11C95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6715f860453e1cb0fe2f3908b0eb4cb9b7c64717187eea7312fee22934a15603
MD5 1dd910e4e148f899d9f46344477695aa
SHA1 cae1c0f2f5789cc32cbb30838b023d21a820e91d
SHA512 2076e8b837c7e72138d998bd7856faf78eb28a971295d6b74835871d28e64619b517b4652c40bc7a9220d79dab2051db479c23130a7b2e3ef8c3dc7d9154f275
SSDEEP 24576:d8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:db5+Pl6bJTIZ5jdgp
TLSH
T1FB652346896B20CAE4575739D9C8DB00F87EAF56ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 2c4d6fdef14191547bbbc8a7f4ce2c2b08b3acebe0742c6598b8dd75c61fab24
MD5 730786f142ebc1f99a700ddd9de60e03
SHA1 2e04de302805b176f8daceb03e73e854e8fd54d6
SHA512 07aa5a2440c0b8ad539a57e2a4ef57fd33a131688dccd90664415c9c385d9d657c9b00c2dc6f15e3c8d46236bdfbad070b0c7e92797f97abfa4e067c31be5323
SSDEEP 24576:grmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Pb5+Pl6bJTIZ5jdgp
TLSH
T11B652346896B20C6E45B5739D9C8DB00F87DAF57ED8727B6C67D0827F231789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 2832bf0d7e841094cbbe15cc0926148ea06d9ebd454288567a3da8fe5da08359
MD5 9af79e0bf1d8f54d19f2e720479a81c8
SHA1 10f55658b0546bb6d5023b6b83f2e01a0478d361
SHA512 18c652e4071e2a1ce82b20bccea6eda05d3181aa51c2807e057eb68fce2b1de5d68929132ae26970576d583bf95e17a5092d8d91ad41550b08ebf591b2846e61
SSDEEP 24576:6Jmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Pb5+Pl6bJTIZ5jdgp
TLSH
T1F86523468D6B20CAE09B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 cc7fe7ec329d0a6f00f78a9e057cfbdf75957d6784822629bb49dd0be4686631
MD5 0ca023691e2aafafbed7f4587116cfe6
SHA1 708ff97be51c14181158a2c7e5ccdc57c2c31977
SHA512 d163e78866ba14e24940477da60cf2c73fc1b2df1b4855a188dcbbce765bf07af8017470e669b7b314560080959f72896771a9c3f8a2d182bc5a932a4da08d64
SSDEEP 24576:Gmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Jb5+Pl6bJTIZ5jdgp
TLSH
T1AF6523424B6A20C5E4A79339C9D5D700F4BABE96DF5267FFC675081BAA313887C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 047cc376e91e274dddb30ea08e5f0129b49f5980b3701d893ab6063a8e4ecc06
MD5 b72747961d29f50290e92bec2d544ba1
SHA1 9439d85abcf0c85f6f436c769fc985b4c8bd22c6
SHA512 c89b84794674871303c275da1df74422bff9dbb1465cbb34e5647c4feb87c54a171cdfd738e31083468f0e6c3ad159e0291dd5105435023276970162eedea277
SSDEEP 24576:nSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:db5+Pl6bJTIZ5jdgp
TLSH
T1F26523868D6B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 2f8dc2786b18486d11d5cfbf0432c67da183aa3b3f3cd4e652641d2d8604d47b
MD5 8214647abecdd284ab6f3d982c324593
SHA1 417d2996b9bc18fbdbd39acde74cc0bbe146931d
SHA512 9577bd776f52c9372a5798229fd6d2ad4680c24dcaeb05b11deab8ad80cf592bd7d005092effa93efeef57169c4fb75de061323e6fbd5833eee25c0530c206ef
SSDEEP 24576:i/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:zb5+Pl6bJTIZ5jdgp
TLSH
T1B26523864D6B20C6E45B5739D9C8DB00F87EAF57ED8727B6C5790827F231789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 68232958145288a087bdc43772735654e44a149db27f6a4e0b114b2b88eab3a2
MD5 2cfb7c464694242cd9983d9e48ec52cf
SHA1 03c0305849526a8d40b40f16e5411e54054fa958
SHA512 9e7bcaee51c1d971f7db064c9cb77928dc004a74f9de0c0f2a1a88fe2eec391d3ffa3c563fe8e51468a6f93b1c67cc2ce605c62b771759be41dbec65978d7fd5
SSDEEP 24576:0jmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rb5+Pl6bJTIZ5jdgp
TLSH
T1026523868D6B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F231749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 1c96192f7983440d8797b302f1d5bb8d5d091edcaeb14900a1ea642d3ef806f7
MD5 75bfb708fcfda37c812dd3de332d0d92
SHA1 7c234b5d42665da7d1ab9b83e09e9e0d8e410074
SHA512 1495ea06e09f07c434ee0c95bffab77b91e023895db932537e5766653c7396a8bd1cccc4bc1ee64d00f06280b6f3315a06c7579edcee5170c42a83b4ee22d322
SSDEEP 24576:XZMazFVSOLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:XZMazfub5+Pl6bJTIZ5jdgp
TLSH
T12185F195B39018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a3e907e27238703785721f7957b068e6a668ee8586dd682fdfed2c6f4f14d0e7
MD5 386130efbe155f810ad0565783cff7a1
SHA1 13ce55bb03ac65c05fae413f8a6271fc8f6d7b43
SHA512 e3340e5723a11399ec86b32e84801ef04f4121f516d986ead8f2b4ea8a19ffc870cafa429e4b3f108712ac52f59a9151bc165f8f621c18618c8fff2e0cd9620f
SSDEEP 24576:kYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Mb5+Pl6bJTIZ5jdgp
TLSH
T1E0652387896B20C6E45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 9545186cb80511771613bc641253d2832d7c972e498190ff85838f7032addd27
MD5 65ebc2146725ec8cb4fc584f436aa304
SHA1 0fc1435fc9770f2cca8e730ab74ef601f3b50da1
SHA512 d6395f83142b54ae55295df4ce2d0b9beb8371af3161e56cc84a2d3c678702986fdbd1dfc263bb3340fc2c1a9c6b780ccf87a2472e1ebe22396bf822cf6af527
SSDEEP 24576:dEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hb5+Pl6bJTIZ5jdgp
TLSH
T1DC652387496B20CAE45B5739D9C8DB00F87DAF57ED8727B6C57D0827F231789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 2b15e00c34e79d4700e9e19e3ead79c854f1ec355dbff58241aa889e219bcf0b
MD5 dfbb536543dbfe934ae61c361530334c
SHA1 9dd9d664027272f5de68f7ce30709f2fc62be220
SHA512 82aedf2f7b2b239bbd8d2dd6a82d0889d37efde83d30eb6670d0581bb3e808747d19f6ab12db036791ca6af667029b9768684fb1de882c5bcebf1889a7d83abb
SSDEEP 24576:5zynmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5Zb5+Pl6bJTIZ5jdgp
TLSH
T19575024767A630E9D0679239C8D25B01F776B8328B619BAF47B406376E333D06D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 6d8e0f6ed8fc5f32f2f65a662ba814c5de1b2e2499999f1549693f5f70ae7ede
MD5 b5e22b355f636ace88e35fdd0f5d8b98
SHA1 15368ecb26337405d36e9daf0f5dd2760ba01f4c
SHA512 fd5ecc29954ccc52a4845ea6230eebf0f1b87109a19cfe82c6b88fb2c417512d8664a527c29d7b3b211dc117d76c18f7399a0b2ad24e5e87fd38edc90a8e6dbb
SSDEEP 24576:dYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:tb5+Pl6bJTIZ5jdgp
TLSH
T185652387896B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 d8404a6ea25ad7bf3b96a5a54e74d833dc90876bdd8762f6df9d7ed8f5290374
MD5 b9093df4ef270cc66239166beb625161
SHA1 0fa13ce13a6075ad115119a706582b6941b9dcaa
SHA512 3472865821927ff80969cb91eb66fb4aa10355b43ebd879b98e68ebe80fa69190dcff4a04d209d2f5ec849209d20f42d92ea33743c578069c0e180e023ff1ac3
SSDEEP 24576:gYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ob5+Pl6bJTIZ5jdgp
TLSH
T1BD652387896B20CAE45B5739D9C8DB00F87DAF57ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 88f5fbb06a8488833598c918537713901762a52635ae0049daf811566cd69c3d
MD5 f18bb5a341c728886b9cd441d15d89ff
SHA1 5bb4f92284c3fd9d10663051564c4505a6a6e8c7
SHA512 c796be9328cbcf9bb34fd3c74b8799055d92f9bf135b1b83931a42d919a7c484919ca1c071ec7d028d3539e4adaa0190a7a4ec6f72ab670c7cca1f43b2c58015
SSDEEP 24576:Gzynmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:GZb5+Pl6bJTIZ5jdgp
TLSH
T1B675024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 14b23c4e70de01eba5b0bef3726fcc953d541aa66e09d6b5ea23c376f7c7ec20
MD5 7b94a8321cee815cb875bb8831200ac9
SHA1 bdcadcaa36ca3c5ae94cbbbdfc250c363421cc26
SHA512 cf31830e17a317efbddd0e4aeb5af1f7baef897babbec637b5471b21926ac333286cd0cb8fde86f7092f343db624a0e4f97d98672d158c7637a6b09e33199e16
SSDEEP 24576:lT/aLl3z0zDZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:lTiLljxb5+Pl6bJTIZ5jdgp
TLSH
T1C1850195B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 768a2f8c43d43650a72fe05108cbe0d3281098f86b351219783cff8882d27dbb
MD5 e272803516729f51d80b43c49e29b78e
SHA1 231982089055a608f23e3b84371fdef0dec6999b
SHA512 d5edeb717dc80ff2db0b229fec3d705e298dc64148aba7af260fe46d8652ff3c5e8a53e92f04f014a589ad8d063bb484039da6f9c5455b8a7dcb7b74c855a035
SSDEEP 24576:e3Ud9CHKy7GZdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:gUd9CHKyaub5+Pl6bJTIZ5jdgp
TLSH
T16E95CF90F3E410E8F0B79A35CDA68611DAB67C5A5B21DE8F03A4251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a3c05f7a71f4a531698b3df7d3f7e10eafa0b44e9a21891d225230b4a531a9ca
MD5 7e79467ec1710342c5413030bef9e140
SHA1 38c0d18697ada3ee38c37bc14abae0d774803af1
SHA512 692df56e15900fbc8bde1226e7d3fb5054470b03725f3a1c968264f048ebec8789a11f7bedf68e60672c4ca0dee49313b10cf4fb6626f2ae22c27a76cbde039d
SSDEEP 24576:epmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Lb5+Pl6bJTIZ5jdgp
TLSH
T1F96523868D6B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 9b12962f3f2dfd9770fd6029f93ac15847137a600b1b30ee03d304657bb9ed30
MD5 7da5bae350c194ff6008aad8f04039ec
SHA1 7e24b889134d08b23c6d877edd91ee2085127c3b
SHA512 0ff20c1efd2e682af0b3a69b10802a7512f5fb368808a29ab13a38755bfb385f283c8114b0faeb884348ccd780c558f31cedb90f678933077b1f20969c0b25eb
SSDEEP 24576:SHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Rb5+Pl6bJTIZ5jdgp
TLSH
T17E6523864E6B20CAE45B5339D9C8DB00F87DAF56DD8727B6C6790827F235789381224B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c9294886b0906af38551b2a80467a6d8c94cf5f22b6bf64b91d6770ba001c328
MD5 3302796f2c7e6204669559eb6530c868
SHA1 9359b1e95fa12535e8141bd8f9756d624c87b88f
SHA512 28c359da0eb75c9a88b2f01c8455f98136d3d85c2514744d06cd0ea7d05fc319497f85916141432967dae7eef9fe62dfc366dfb82d54eee04b127abff5fb1f34
SSDEEP 24576:2Gmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Mb5+Pl6bJTIZ5jdgp
TLSH
T146652386896B20CAE45B5739D9C8DB00F87DAF57ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 37a3b00ea9810e25a416eec02985c34c16dc45ed0bf589b5606c2e30095c41c2
MD5 0ce8318208f3b5b854ac8afd82e39f9e
SHA1 07ace8913c65f97f960022f6ec69408050127c75
SHA512 f4e5f08cfa4e6efa86c21503dedea8d5e85508005edc840f83068f80284127bcb41660d3b5f505f82763286fb96977252aa6cc488e87975260b1e1686ea26ea2
SSDEEP 24576:GYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ob5+Pl6bJTIZ5jdgp
TLSH
T1DE652387896B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 2b10f813a350ca1f52735a0e1946d1fec3a6af355ce5a06847d231e6a79b3daf
MD5 84a2ad3c13be014b42959e6d435759c2
SHA1 bfacaf86be549f4bbd091205eb68983c31f1b10e
SHA512 66419b0fcc999e733a6ca83eb3fb0cdff5878e29e15c422f202cbd08a081e7b956ded1f0c04895b3f297c2bfe050abef0f4fd337b15a8f2f7fd782d4d94f4940
SSDEEP 24576:jpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:4b5+Pl6bJTIZ5jdgp
TLSH
T113652386896B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 91faf58bbf917da375e7a8f60a8c5519bcfa98d847ed8dc26c5bb64eb4249b7d
MD5 1c7438e2df3e73c91d8d00500fd35e28
SHA1 1148351a04d97aca9380379f537662ac7988c0b4
SHA512 552ea8d4280050154898a0b25326dbc6a130b78ff74b1e90dad1bee8accef6bac8773e68146fced0397baec10463919200f9cba914e7af0ded710cec967592f0
SSDEEP 24576:uwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+b5+Pl6bJTIZ5jdgp
TLSH
T1576523468D6B20CAE45B5779D9C8DB00FC7DAF56ED8727B6C5790827F231789381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e518df6129ccb7de9cac6037c5e7660da1127dac406f0e56dca23a5cb97a424e
MD5 2cc768e45c186f5d599c808475845ac5
SHA1 1433b6cad766bbe6d66eebfba7d90dd8aaa6d699
SHA512 3b27e7038f7fa2500448561e866da8d3f18435fd2ad215dfdb1970a5f721f2e990783aa00eb4c7823293858ff2db319b2fb7ab446a35badb88fee047045dd109
SSDEEP 24576:nSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:db5+Pl6bJTIZ5jdgp
TLSH
T1786523868D6B20CAE05B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 5c7ca60f5f4acd709c0f0c37af4a11deb20393d4365b86d75e3520a16a183af4
MD5 3e949dee6b83bd43988b8a050593648a
SHA1 c832df110b8fe13249b075047eaae44634ab1344
SHA512 3e1946cf71fa95d7d405c0799f05a78f1cfd997b65ca02c277abd2d8128e9161c812e1988a8e71cda2e21b7fdde96d22bbe4af04851f7dc6ef2ee414caf4b2a3
SSDEEP 24576:uxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:jb5+Pl6bJTIZ5jdgp
TLSH
T1566523468D6B20CAE45B5779D9C8DB00FC7DAF96ED8727B6C5790827F231789381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 f76292685ff95a5474641201707ab4e4afda14e5fa475413dfeac64f63ebebaa
MD5 5a12fb8533726ed67fe3a5e140db1d9a
SHA1 8967de475306e3e06cbae0b4a71a97faa9783505
SHA512 00f738e2498114d3e467d53bd9c10fd8c9b05d0dfae7bc08480fd8c2fec2629e142fcfd96b100439a27438ef76c7ddb4624e380be9596910bbc284bd8c3d1aeb
SSDEEP 24576:kSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ub5+Pl6bJTIZ5jdgp
TLSH
T149652386896B20CAE05B5739D9C8DB00F87EAF57ED8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c3a7137c0bed01daadbad21b3f36c98f24c647628055aad44200c38acb697f26
MD5 d7d404a7db9179e5a01bb4c817abfff1
SHA1 32f523f646b31673cd434841b02cf99cb143b3a8
SHA512 a76b7db40b1595cb294467eff5f73f213845a76d380d919695c40740a91c0719efe083e03c718f368184850f7ba3d6c55714b907d15412b0a1ec9a21cfb65f7e
SSDEEP 24576:5fwvhk9RX6wkyAI0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:eMnYIDb5+Pl6bJTIZ5jdgp
TLSH
T16D95CF29EBDC04D5E0B7923C89E7460AF6B178595B31C6CF02AA536E0E33ED46D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7da7aa03e48a7953a0026274f29a0c55be3e9c1934979ad1096fdb9bf21a20d
MD5 ab4c6af529dc9bc7a304a7532665d7c4
SHA1 3f40004ea4f0a2bb37c32b010e26fb5b90b2b960
SHA512 7709bdcfaeaca97f8031ff92e9dbb7ff83f9f15b5583fbb12ab68032956bd5d4c5f23a4d58618ca05e4596e335286bb7ef382e837f1fffa7e9c97826660b26b6
SSDEEP 49152:YYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04b5+Pl6bJTIZs:XySzPOslgJTIZ5Bgp
TLSH
T109066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 63b0b5f3589b011307d5522f93b7785a534c9336ab8751be0278573173150260
MD5 b1ea4710a8a505f68584358e084db448
SHA1 38f651863746d2a2fa54c6bd983f10955478aecb
SHA512 cfe952a0b98b1b54a46ef22f689fb8191d787c8e6a259103894e1ef8fa674067254f8f986f1a53258099f230ff1998ae91010cb6640c3b6a59c2f6316b4dde4b
SSDEEP 24576:347Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY7mb57GBiOl6a8JTth/RWZvR6wQQ92X:347JUQjqirIhCnDHUPfF/ob5+Pl6bJTl
TLSH
T1F965AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 5708c92368d27488f0d43a9a8033a40265b009ecd151e2e948b65187c4389ea4
MD5 6c0855592d2a364105d957b9d2f07181
SHA1 606fa6731468ae176b9fb9f97d4e1b058e178981
SHA512 1e3a1636639ed1e17a9566bca52c9fe1a1aca89e70a89c680d7abba0220338985e71d38a97da776a3ea7e404f6791fa7056c42873b048d97c6f14361cd03c094
SSDEEP 24576:8omb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ub5+Pl6bJTIZ5jdgp
TLSH
T10075F14AC29811D9D06F6239CB858A00F7377D659BE293DB86E0F43E1F366846DE6703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 10d457329599dc8b3f9571dde1e9561707e475d1c082dc4f61b4b1759c4e834c
MD5 535ff8b5de83b0a1c9fceb7a4114a5a4
SHA1 a86798137e4a3977d7d7e910724fde5ad0556bb0
SHA512 1bf2fef393fabb9e90cf478d7cf314ab9f3c51350406743d7886bb09c1cb715a4e280ce2f196d36e347a9907326284831560d0facda4a9068615d7af7b0ff9d8
SSDEEP 12288:k/l+DU3fM+8LOYILssIxbLSvkSGCtgZJRMtw+qdog:kNIUPyIYsAvSspCtCJRMHqd
TLSH
T18B352850762AC75FC6AD40321E32D1CCA7707D41EE05AF0773C88B3F9576669BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7aae8c7a4bec1a79357b7e973d044a260cd4de1cf6eaa8f987f69a06b3ad97a5
MD5 2bdfd997abf946c751cfcdc6b57b92aa
SHA1 4c5e4fe297e49081fc4979aceff9021a0a46a727
SHA512 7a759760f7e6b49433773d1680e41d7207bfd4235abdfe178319b0d2df0dc1d641b7da48154c58ea4f5804380a35b3f356317857f344aca5f735eaaf32d8a3de
SSDEEP 6144:A9DNK9xkFk9OHg1c5pTyqvBHZDGKAQhezwnfPvEzDyaq26tMxN26tMxyFkRPPOIL:AJO45ZavoT1sZVmWI
TLSH
T16465D9819537A3CFD5FA603207665B4CA7B4EC07B7495F2673C8453AD82A722A0BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2c0f3155ff06af4ce8fc2bf5a82e819815a7efd1dc61e191ba9c16db3a8b29d8
MD5 9dca7abe0b97debf552f0ae8f93a471d
SHA1 5b430b8113fc5e06a16bf0c6a7683211f7540287
SHA512 5bdee3fe98f14d8534566d9991f7321a885868f3749a3273f4f2dd8639c15a9725d1fd0c778ff3506273ce613c8c5d26fb4974fc15469282fa4149485f175482
SSDEEP 24576:UAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:U3b5+Pl6bJTIZ5jdgp
TLSH
T1AA6522428A6A6086E4BB5738D8CDD710B83EBF65CF8566E7C529142BF1306C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c0cbde8dfaee158facc4f6120b67d3cbd7d9968f0dfdc97740789c81bcd40e9d
MD5 de62d59e686d1adef31890e3131507c0
SHA1 551e1073de451bb05c60a18ad73d811adc643a09
SHA512 0fa66e83c340c84efb05fa03d7111d84b43fd034d2da1ebb8fc4583f93f9fd070f7ff39e7f62457a3329e1f06d60c8e70e9a30c52deb5b45746b96e2930797f1
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Xgb4mBIBhGFyb5+Pl6bJTIZ5jdgp
TLSH
T1A7659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 0f7c8847444927138eab363b9542883884b7bcf684b5804663eac557d41c9498
MD5 adf9664440843cfe39252679ebb7f21f
SHA1 5f5118c3f2e1d2e38105d55fdc8e524875837c62
SHA512 0e013672b294dbcacf4a9a85ef3a9ce16be5fb8a378a4130340c98e4c0600f07385832736beefc7c38decf3e0608ace2494143d1444af2afff2456460592c750
SSDEEP 24576:cG88u8FpJqH1ozria7/mLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:f7ZFPqVXa7/pb5+Pl6bJTIZ5jdgp
TLSH
T15295F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1e1915cb389c0cb0e110b56db4978324c73b5791f32ae7277f441f7d104045d3
MD5 9ed38a2fb3b17881203e9a26c9dae109
SHA1 b2bf1493a7326de468c5e936329a0cb1f2e8a15a
SHA512 df648d6eec4406da30cefabcd4cc34b4a0dc33c2604b71043a4e957dfb552f9517a2c1631a912e82690d28c9df636f78e748f69396556bc1f943e6c208133ca6
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+b5+Pl6bJTIZ5jdgp:YG05lO43bPslgJTIZ5Bgp
TLSH
T12ED5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b43a1118bdc504c10359ccb07bb2b488d2061968beb13d017138bb5180a2ab6
MD5 9331f9e2b2ba7f796942026ad94d3542
SHA1 a1dfc71d24a287876405feb630544606cf615ee5
SHA512 151f37909fe9709c82f831ca8d76b571795a78d52af1bc2d3abdc1522dd748409045148a90daf9bee88b0bbc35a0b67fe4014231b76304606f86e23b0c9a7ce2
SSDEEP 24576:rfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn1mb57GBiOl6a8JTth/RWZvR6wQQ4:za5POZ3lJt2pasx2+mGb5+Pl6bJTIZ5G
TLSH
T16165AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4cacdac3158a64e3f5431e8ed5c0f29baa0219cf91b7e6222cb3b24b0fab2372
MD5 7f08518c315a1c640f4bafc8b60e84c3
SHA1 c273f6d016de26cf938c8a5099d9023d43ec0362
SHA512 c0a8bd8ca9ddfcde567d7822caf88e90b3bcd70acde495cdb9bc3c45b5e754d176c2fdf316a330e10cdfc3b3b91163e810b7a1dff19bcfa2c507e0188431241f
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fkzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:iNc/zEOVHFJb5+Pl6bJTIZ5jdgp
TLSH
T11C858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a08027d00bbea27557e039617db6296a05d29f3ad2ddb73642675dd01fbbaacc
MD5 59e8e4fc0f08c6b2b17ed7a0e993d270
SHA1 1639f0010b9cf28ff6e066b2ff473755e867795d
SHA512 dd727b0e5f4912b52eb80e56d4ac01ef262e1ed3341bcf444f719ed93d569e9fabe1a07fe202b5a9188475000e29ae951cf317ad3b73559b5022b37048664eb8
SSDEEP 24576:RzkNvNnaFeYhJNtmZBmxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:RzMwBtOmMb5+Pl6bJTIZ5jdgp
TLSH
T1EB55AF6EAAB806E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 433e3b7bb8dfd3f600a4fc0f2ba0f90bc06a71fbe26fc2c067c0d922319580a7
MD5 3d19ba609d5d13e5533fdfdaafc1d25c
SHA1 62dfde491f0ff1b199f330514badb90864c16616
SHA512 3183ee16c671ae72cf0e6b705830070aa4aced094e76013730906041fac18d491e5d69ef13069c69be87d2985b0ebbbf5539fc79c4f5eefa01ae18dcbc3289ad
SSDEEP 24576:KPUr+NQvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:KJQub5+Pl6bJTIZ5jdgp
TLSH
T14375E11F26AD18D5E67AA13DC9C68709F772B862471292DF02E0817E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 4acffe3462ce88b2ac07e61d1aefaa7c9bd3dcdd214dbc24d6d14adf7dfb167e
MD5 c3649f54ce705fe163aa6baec05c8d87
SHA1 c3b488a34a78c50b586d5d82d669314a4f6d2707
SHA512 53740aae8c6fc95ca25440804c8aa75a678e39426ae66546b0e015ad3321318f125dc4bfc6432c251642c14911998a6743589696f09c7a6b0df3eb003ea6651e
SSDEEP 24576:lD3FHshBIYQgAcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:lDVHeBIAArb5+Pl6bJTIZ5jdgp
TLSH
T1B185E17ED75D00E4E47BD27CDA938A06E67138A9472266DB02D481B65F27FE43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-52-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1268-50-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1268-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1268-40-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1268-46-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1600-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1600-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1600-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1600-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1908-309-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1908-84-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1908-79-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1908-78-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2372-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2372-365-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2372-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2372-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2372-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2372-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2836-6-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2836-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2836-318-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2836-310-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2836-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2836-77-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2836-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3256-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3256-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3256-15-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3256-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3480-114-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3480-121-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3480-120-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3480-369-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3644-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3644-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3644-294-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3644-65-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4356-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4356-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4356-54-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4356-278-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4532-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4532-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4532-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4532-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4532-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4532-381-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4568-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4568-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4568-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4568-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4568-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4884-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4884-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4884-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4884-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4884-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download