9ddc49da8ed2c85052a8174e12f8363c870cb14a5f738c79b03f8b7e8dd2b61d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 5.2MB
Sample260813-157gdazbnd
SHA256 9ddc49da8ed2c85052a8174e12f8363c870cb14a5f738c79b03f8b7e8dd2b61d
MD5 c912f98dc7900ea5b1c1dadc3f83b069
SHA1 17c1638bdda58c453ed805c7966c35f697ec3424
SHA512 9106ac35d15731cc29834def3ee5619624b76d9ea0c6c18210c3cf03cbfa7ae6734893dafa0a1f7b4756b9f50bdf1b7562f8367149cc0c5d87c3f4251852257b
SSDEEP 49152:wYsAKiLk6ewLhCOT4Jqq4GBUbjb0yyyyylUnXqK+K9KYVL5E+Y5PrA4r3:wKk2KC7crbE+OPrA4r3
TLSH
T13F465B17EDA556E5C0AAE13489229253BB717C881F3223D32B60F7782F76BD06E79314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3404	elevation_service.exe
6868	elevation_service.exe
4392	maintenanceservice.exe
3136	OSE.EXE
6452	PerceptionSimulationService.exe
7048	perfhost.exe
2136	ReFsDedupSvc.exe
5304	SensorDataService.exe
3496	ssh-agent.exe
1288	AgentService.exe
4688	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aaacfc0a957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f22d1143712bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000510e4644712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098660c43712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d41a380712bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
6868	elevation_service.exe
6868	elevation_service.exe
6868	elevation_service.exe
6868	elevation_service.exe
6868	elevation_service.exe
6868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4864	2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1288	AgentService.exe
Token: 33	4688	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4688	SearchIndexer.exe
Token: SeDebugPrivilege	3404	elevation_service.exe
Token: SeDebugPrivilege	6868	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 5912	4688	SearchIndexer.exe	101
PID 4688 wrote to memory of 5444	4688	SearchIndexer.exe	102
PID 4688 wrote to memory of 1548	4688	SearchIndexer.exe	103
PID 4688 wrote to memory of 3716	4688	SearchIndexer.exe	104
PID 4688 wrote to memory of 2772	4688	SearchIndexer.exe	108
PID 4688 wrote to memory of 4488	4688	SearchIndexer.exe	109
PID 4688 wrote to memory of 6952	4688	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_c912f98dc7900ea5b1c1dadc3f83b069_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4392

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6452

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7048

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5304

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3064 3060 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2988 3036 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2988 3036 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3064 3060 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3bbcedc6124aa056fac2c26f440a052196fd7701e4be27f370acb493e93479c5
MD5 753593cdf9978d6e36488eaa2c1be002
SHA1 067b3552a519971a61a55ec7f1981f38f270af69
SHA512 73cb7b6697e7055c9a90a6e23668ea105b3da3f9dea32750d1bc3a1500eaf095eb287f24e71c143a769aaaaf65a15dcbe2708702a5e636fc387d3c8898e0299c
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqY5PrA4r3:e3q6HjBXOPrA4r3
TLSH
T127D59D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B6552F7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 9b0042ec937b9b277ba1bebf13462a8cabe3eae521137d73cad2fff2dc5814ee
MD5 02297d353343ae14bb790f910b804bd5
SHA1 05797f030643f9076b54130c52041331b1e86d32
SHA512 b03d32e12911a6344dab78effb740086fb31800b0cb4311c998f2006d7a3f5307a29ebb66a2aeefe1ab27a725ee20cc04b91ccb05536d28497f5a83b854189cb
SSDEEP 12288:z1XLsswWkxy2lRq2czAS1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS3:pXYfDtczADY59oarA4r3Dqm
TLSH
T1A385F128B7E508F9DCAB813CC8A19505EA33B8564760E7DB03E099291F377D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8f6f4cf3db5afde4358e2bcf9fbd01451c8d9d7ca2a254c0d44971c51a2ba304
MD5 3a1b14d5a880d8e72f4612d842ab3f48
SHA1 02f0cb29e74712e5e4654389aec167ff47baf003
SHA512 1fafe75319b0e523b33aecda959bb3856abbc33a1c599cfbdedced5e21ccdadee9a59c93a40e6bf3a0e232a178b213c621bcd904f62cdc82570da2089ace2373
SSDEEP 12288:yXZNYVLeyUji0h90ZD0wxpGZIVuFrHsT1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjta:20Le5ji0hmxirMyY59oarA4r3Dqm
TLSH
T1B3A59E66F6744375D073C0B9C5D2A68EED7230865B308ACB0286D77C2F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d09d01c95b5a909c0b43f83084141fd4b6715a47b1276ad1049f296dcd050fbe
MD5 9b7293713740735fe71fff08266fae20
SHA1 5b26428e132619f75f95098ab3f51f4e31e17550
SHA512 1c23117f8688b10976c922b879df49da8c588b445308bb49e396f21073017aeb11de5731189089123768d5039801dab033ec276bfab9c524766d6196159cf8be
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuEY59oarA4r3Dqm:g/ezSC6vUzPvxHjyVY5PrA4r3
TLSH
T13D755B25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7665628239d86889129e338e19488051370d2e1627ba68f10bf729da7b150cad
MD5 dc5cc509cc654aed28144fcec80cda8e
SHA1 edb6ff7d3bc1947357aa8162babd5609e14e3594
SHA512 94a1869132d794fc7ffcdf05f6dec57bf4fd3e2fb30c6fc976be116d2a1ae2d8b67b66eef4fe6ab780212c2e5b6b1ef4c14ba8a32471b0a174ebca84fb9d633c
SSDEEP 12288:CVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98u1gZBcfB0zGoaZ0Rd53AA4C+aWs:CVbqPb88hv/l+6nY59oarA4r3Dqm
TLSH
T162559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C2F677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 8451260cfae0c51ec963ccd67fedf7d6e68c675cc8633433c68a0aabbb585d43
MD5 aa10f3be3e91576dcd453a873e17ac21
SHA1 693420457fdffe146b654844fa9d447c59519e73
SHA512 df22ce93bfd7cf2ebfef8126e0f384d5f3f1cb22085c9180b6d18535b17ce90c8c73fa63a899ca1826303bf7bcfeab43b95dc3145826bd3ac0173d3b6504f273
SSDEEP 12288:zRv1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSn:zRmY59oarA4r3Dqm
TLSH
T19E7523F99DBF29D6C2ED6934B1B039483C2FAF778D201B520192EA1C173D6A5CC62476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 e6805d517a6713e8d27fa2c4cf30e67fda9a1ae71543c37e831b591c4f4fa418
MD5 25dbfd0052b310386df7da652147e269
SHA1 29efe6f4eb2df72998afb9fd5010ac85641b736a
SHA512 1d5e7e496567fdfbcd3351925ebfb591a6557bfc616ec6487466116aaa1613f8d5cfef1480159ec9aa1167cd8435ccd1c8bab2518e4f29a038fe9be0d3c2ce62
SSDEEP 12288:zeBNUbTVO86UG1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSH:zJIUvY59oarA4r3Dqm
TLSH
T13085DF7BEE38FCD2C27E8DB856918600A77278314F21A3CBD165C20E9E275E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0887be06e7d465e67ae70b48abe91c114579dfd3ce32a010fdf60c56263e059e
MD5 71e264eba736515d60b0db2413929f4d
SHA1 53c730d44c19a721c36b4655d5f608366e281b0a
SHA512 becc17ca67750fe67702c7728b19e13b1308b2bdbb02396d69d3792412cecc7df1beba2e7720d1e5db9fbed82e68f3018c81fce28891273f5c23fb530301f23b
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:jQvGAdlCEL8c/yRNw5CUOPrA4r3
TLSH
T100266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4265f0e2249b7ab74a2c3f803a8c8782e6448e79a05fd22bd23e10f21e1a897f
MD5 cbded832bc8b5fc70a5376829976f747
SHA1 d0452e8d64b423bf38c5e9016301310bd98c1a47
SHA512 a16d9c65c3d1d9ae8ea26a4ea8872b9b68aa74e912b689773a17e2bacc622ecb65d0740e423596b72a8a3dab8b863238d2890b579023ace243fd947e1c61c9a1
SSDEEP 12288:YAwSfxL/2Dc34DLLmt0LDQewsAjI1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS1:9dewsAjJY59oarA4r3Dqm
TLSH
T1B695E031FE75E436C2BF0DB21B35D706182D7A204F611AC3E3A88D9D5A342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ef5448406d709bd2da52ff8754eab5f1fc90367cf038aceba23b32f70aa6c643
MD5 011905e143edec7879a849a8c6e2c923
SHA1 dbfa0aba0d03af76706f08e19d182e01dbba6992
SHA512 88b2607e83fac95b32a561b5b4ba81e5eb8e2232c0184f7035eb543b08b045bee41efabf788ef12543134e44c02f6c67c9475e4bc9068b729258380a77b3a46d
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHcr:UUEtQevvqc2W1cpV2EI32cr
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 433eabde08fc761097d5294315ca4736e306e750c45e2e6fa366fd01a8401b98
MD5 170d1a667b89c9e3bf3da1927989b398
SHA1 55efd01edf84ac3aed39dc3f370441a32ff92c43
SHA512 f05ba4c81e58f7d5ee3dc78f7a5dbb74b7d32c04b18c6c53b559da38681f3d9794d4627e42c71a5c0fadf86339e69a46a8c08bc6fabe2781a7136fec80322221
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zpY5PrA4r3:UoqtVjnmAOPrA4r3
TLSH
T1C1D58D1976B881E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f73cd2287e7c5ee22f558d9f0dd688456787eaa3752bc32bd14f6e72c89f56ad
MD5 e7551eb3e29f8a5d07518b02950e8abe
SHA1 22addc21d0820dc0db516df0e0f1f8805283ef68
SHA512 b24e524891eb0cbe10877d550506961bcc4f4ec810b346ea1402c5cf473ec6cadee1f7a68da368a65be5463a0d21fe4d51305c6218aad79b22cebbc610abefa4
SSDEEP 24576:YAhGLJIFoiwtA5l7S53gY59oarA4r3Dqm:YAMyFoiq5QY5PrA4r3
TLSH
T187359D81EBF915D4F5B3AA78A9B69170EA76BCA65E30C20F1160D11F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ea0d21ddf78939d2afea9118ffbd8423c6f584d28dea375e854a82c4f1f7f8f0
MD5 668e73dd114c6817bc3ae820ccf0283e
SHA1 aa258755daa520ac05ae6abeadfb49b5b70a3a86
SHA512 192a909f7d847581a29e0fe091e9368a452851fcb284db2fd68f28ed6bce87d1b18bdc362e252f86fbe042ec494b48cfa901a20e3004621c9883ca4e7c79b13d
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CV1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSg:twuoOW1Y59oarA4r3Dqm
TLSH
T14F85F14A76E90CF9D5A79138C5979535FBB3BC122A21DB1F0360C61B1F37361AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 dcbe6f3db8bec76ff2ed258f5346c835cec0944af76cd499d67d62613a63f1cc
MD5 8978e81d2c18d16a270168a75642fce6
SHA1 a5196775c4c1639380805aa6c1381cd63d9371bd
SHA512 e84cf4ddab4071f342484e06299b2e891b95d1e1f20952635fbb44bb9e5a54905d0cfac0f93e29d0a31e6727f0ad931ebfe337c5d4c888e49ab6afe1831e79b2
SSDEEP 12288:bBZ1Iy41gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSx:1Zu6Y59oarA4r3Dqm
TLSH
T1A87512A92AF920FAC1E7513CD9F02A48EB767867473103CF026186691F3BAD59D35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aaabaf9cf79f4a6eddb5319d5ea8ffc822c46355621c7fe9e84d9681d177ccf8
MD5 629a851bde175e9e235e99857b40cec0
SHA1 75b9a52d91854c70650addb64dd7f97b85adee68
SHA512 dcf45e83a34e4dbb4134b2c12836dc6658b4b51d501e6592cb1409f39d54051bb84aa5ee8fbbb454cadf8a4bf57a343c8089c83188b87f33c1d730311629f4bc
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3LOPrA4r3:LQyiKayX+PNKr
TLSH
T103667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 97c53f186011ac10f0b648e1f30c86e2b6a4e124517373e4a21a1b87518d949f
MD5 62ce2620974d74ea5c4fa5d01c030fe2
SHA1 d28fdef914524fd3e57a8545c296c75ff276579d
SHA512 6409b1ef86b2a6ff9c4d504e2e79d3f979324924168e8aaa6440234bd5d67424e5bf0ed9da46f57c979745b265a36eff29ff8ed44e9db2158ccec15aed85a720
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN3LOPrA4r3:cQyiKayX+PNKr
TLSH
T10D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d82a6d5ab2c4d6eb5ea2cc462be9ec76747695a64c066ad21f42fdd4f0c89e7b
MD5 fe920480da439b05674e5294a1cb4f60
SHA1 1a34677a465caa900918dcc4218d10ad3f524b5c
SHA512 f2a607754f1c7b2ccef9c847561ef78d1715994c07fcf6c38121eced8e00ecab91a66d10a38b8ae8a42f67ae4046cdae32f255b823a14298ba3272bd5851c69c
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0qY59oarA4r3Dqm:Q68Qg55nhheWu7PNU3/5Y5PrA4r3
TLSH
T158B55A33B2F600A9C44DE1769F46972196D27C75CFE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7d0338716bed2548401a914bfbdde2e52cb64db146abb181e2d3816bc8a84373
MD5 15d2e3d35fd7048dfe8866e9f23f7570
SHA1 e8e70a4c92516d270979bf4d5592d09898072392
SHA512 b612a859ac0a15344e794a03b74cb5086f7bd4e2a433a99581a7e412a400ae73e1999b7205aa7ec68a489902de5945039ed212fa74b028f7cb8c066465223871
SSDEEP 98304:Gy5112gYy5azzVvL69nLKnhZmOPrA4r3:3LIHmWhXr
TLSH
T168167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cd0cad875261e09503aee62664895e6d5c063a0ef175cc59770704f987456965
MD5 118e9a1d11a1f41fc26315c2f31cfb8a
SHA1 45a39dd6f8fe724868df6f5aec993e080bdcb4a0
SHA512 a8de5f31548af27cbf85f8c312266223cc8723015710cd85295da5a7a76fd3266e3f3bad325c0a17247529bb3963f3d509e4f917b50eb3979fc8e61034d7e574
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzY5PrA4r3:Au6JmVxd2dzOPrA4r3
TLSH
T114D59D13F1DA01E8D06ED478974A9232F962BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 10e694037754651e2fe4f5629e7ab920cc45a7bd524a1c4e297f9adc9b1fa710
MD5 ce62d7144a6eb7fcec1f6eddd297ec63
SHA1 f2a2c61878c518f920fb9c69f318b4e44dbd952f
SHA512 50a1965641a33edd2e88585146d8266c2d12534794b507534cbefd59639612dff78de61423a1d5831a68ee541c3dc95aa678f454f89d3d30e3fc94dd41eeca8d
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xPY5PrA4r3:ZmifPbRAOPrA4r3
TLSH
T1F3B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 781088275902c3bf6e79aecff9570db367bf1fdee31e55907111a59aecaa9fbb
MD5 0cd61307b19543d3adf9dc4bff390ab7
SHA1 9604189f18dd7cb06a81898428b4e8fe801c1fa2
SHA512 b624d8691dfa561e1d68b6f2c044137ffdbd8e4c39a2d57950e3745d95e432eba2c99a9ec95d7ae673b81e230fec4f072c381cf414a2ed044e8dd22ae7c4a0f2
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHq6Y5PrA4r3:d5dKTi616OPrA4r3
TLSH
T172C5BE13F2E901E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bed5f6afb3b2b6a7071be81c4c92e18485bfc3b584be1a0d3c30e0728680150a
MD5 28ad6af527870e3834c5a9ebab005c29
SHA1 2141d532077c9c39e6f5a62a97ad47014fedee90
SHA512 0d3db074e798f2c42d767c20f403739de4e4b7b761d58f6d048c8b69b8829542ca404a7d6a88ddeec8c3d9d52a826a246194e4af0a75a37c988e77d9e9ac0c78
SSDEEP 49152:2htSn8EApI0figngiDn0AP5wDY5PrA4r3:XX2iyphsOPrA4r3
TLSH
T12B95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 9abd9df1c5ac0482b0f6a0ecd91c6924c4bf3c65a3a0838ca16800c2fdb3f21e
MD5 f5b9e662dc576bc59ae1bc92afd84726
SHA1 a540d8794e299dfd97a2c3bd93a232c6cae8c113
SHA512 54a6cb622f26dbcb727a14d9708519ed7ce5c164909e18b27a0c153a48cef4405ee99263f2b2173adabcbf048e6ac3b607558f2696c25c1a56370d8ca01b90fe
SSDEEP 12288:CH1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSK:COY59oarA4r3Dqm
TLSH
T1A87523EDDCBF19DBC1986974F2B035483C2E6FAB8D2017920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 1d5e9e8a6d8dfe47a5daabcf8162c5e1f2ca43b65fb638f8e91d4617d5376ce0
MD5 569b3761bc5724cacc9c05f32048dbb6
SHA1 2a97a61c1e2d19103c13e11d5009c18547d4f7ee
SHA512 ded2659eb9bfbb4151455b89868901876f9e442543e313d09a631f6e74cb873f2f4649b21362605e8a925054c06ed3ecb38f063b4db8ce8650d86aa5bf3240d1
SSDEEP 12288:x01gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSK:xNY59oarA4r3Dqm
TLSH
T12A7523FD9CBF19DBC1986534F2B035883C2EAF6B8D2117A20193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 7b283724efe008cabb77ad0221bb03cb9b18ef0a05eff2cccb3b757acbfbaa6d
MD5 34a852ac6186f7329f7b3d34b1250e4a
SHA1 f6c8a5ac58facb2d2d9ac40223d6628afeda1ee3
SHA512 916062cfab0b63c4f0481ac05a4ebb8202350f6f9d93c50bb9326a5ae40776a42f46c33243af694d45728771c69162f864da09824e575a7303169cb6d2b280cf
SSDEEP 12288:C+1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSR:CXY59oarA4r3Dqm
TLSH
T16C7523ED9CBF19DBC19C6934F2B035887C2E6FAB8D2017920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 5cbabbb09e9b00390fce4ae3007c414ccfab7b18fd25128663ec980a60820a52
MD5 c6f66ad1d6f923eb512f6afa8ac5b662
SHA1 d9c87758319e4ea3fa65f94729cd8bd139e1649f
SHA512 c7d1a884528609a4a188941618574dc64332b7b5798ae41e6b3bc6c1ea7e9759b0f3cfbab1c591eb47775930c6e510ea70e7c6b11613e3d91b299bbc9cc806f4
SSDEEP 12288:mVp1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSs:xY59oarA4r3Dqm
TLSH
T1A27523A9AEBF15D6C0A9E534E5B03548B93EBEA78B30179B0242491D0F3E7E4DC31971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 c2f3b9fa754325909c9f48532bb7cd8e833e5d4876ea7e0b612611fcb896ddd8
MD5 17abf700f97a5d46ff08fc9946d274d3
SHA1 938b74ca45b520e6238944b9801ceb000b3e8efd
SHA512 0f6573d3b3f2f2154eac250eb42c15627cbcfa642ed233e224459153f082cc50d5d672ac8161560332c2b24e9963f133ed7b109c4c890744c3609b6f26b99c03
SSDEEP 12288:+x1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSJ:+YY59oarA4r3Dqm
TLSH
T14A7523EDDCBF19DBC19C6934F2B035883C2E6FAB8D20179601939518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 3848bb6a0d05d3218eb53bbcc3630c501ba031ba87b8691c8a307489c921a2d4
MD5 676f3f9b5b4f676ad013c27cbd46c4f6
SHA1 a0e54088cdb585b3702d1d51351eb7a4eaebed4a
SHA512 6fce7d153a6cdd64c8d0de0e716a4c3450d792cb94f840663e3ab34836f028f6aff1a1b8cae20932579b826bf624dacbe41df6fe1242b8422db6b9fde0c334fb
SSDEEP 12288:MA1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS+:MxY59oarA4r3Dqm
TLSH
T1657523ED9CBF19DBC19C6534F2B035883C2EAF6B8D2117A20193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 71b9a06231e41416a2ec5032598a7e12059ea5155382e4ceac5fe72d6ab71e8f
MD5 707f99543481680f401ba44ae0aa3976
SHA1 2ce1ec1789caff7058bd841fb7187a7842a5b9df
SHA512 c12a3765d1ef87e1812d562d740f142c7c7df2e58253c8114a4d9d7d1117a3cda9bd3d4ce88168edb467026f73693f1a0f7f324a2febd280725fdc1dad9da60c
SSDEEP 12288:Hc1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS0:HlY59oarA4r3Dqm
TLSH
T1057523FDDCBF19DBC19C6574F2B035482C2EAFAB8D2017920193D518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 00f35070e66cb8f1b2f2a1cfbb9afff16a77eb0aeb69a5c93a2e718a5b4187a6
MD5 3bab1dc415a626fb17d3404ed83391d5
SHA1 7d809653b1184d9ee4f5bbcb86ffec0727a0a072
SHA512 83c12b7713ce5b8859cf02e362d20df1a790d4c31c7a57529985b3d25faf9c0ea484ea4d7d5d8aee29bfe0dff538d3d250ee9cd08a5ea128a17174932e5248f7
SSDEEP 12288:KiZwb6zzFEoS2cPvyU1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSa:tZMSzFVSOtY59oarA4r3Dqm
TLSH
T1D98502A5B7A118F8DCA7813DC9615905D6B27C6A0B70C71F03E4362A1F373A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3b615ce59e6bfd777385705ce45fd4473055e23006c2d2535a19f1dfa4214201
MD5 27ee643b19dfee76ff1cf7f21b8e7887
SHA1 9cefd73cb7d88959cf2eb55d6c38eb7f2501022f
SHA512 53b37a9da7926c7f45d113e464f402f804612d6ba2b94121638f6faacb8dbb9aabf8db52bd5c93d5c92b716bcf05dcca19045699d188d29ee0261b154e2ee54d
SSDEEP 12288:L71gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSM:LKY59oarA4r3Dqm
TLSH
T1D57523EDDCBF19DAC19C6534F2B035482C2EAFAB8D2117920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 fefbdb95e4f9872ca447badf9422260bdca6d0eb4f8c700c327233c80be82bfe
MD5 f09c347b255e8cd1a85619edc45734a7
SHA1 4d912991ef0bafbdddbf9e5d036e1366dc3e4ddd
SHA512 364059b7afc4978503b38f9da83915091ad35d2627392dcdca5f7537fdfe9fbd905966786342c6f2055f000066d6b2f747f5006e97ac12c6b1a2c047744414fb
SSDEEP 12288:Mf1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSD:M2Y59oarA4r3Dqm
TLSH
T16E7523FD9CBF19DBC19C6534F2B039482C2EAFBB8D2117920193D518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 18a653bf9b966ef8c62fd0e17161eb4fa2df7434d93b8712d0d5611aee395509
MD5 160a101d16771099d40d59557303ac7f
SHA1 c0013357f42e566bdc8853692fe3a759cfdd74fd
SHA512 549532749f8c0702280204936d543f4c18db2424f4ddd58679d6e61efc9d8b655cf2773852ce8bc6ab5c97d8c8bb87071a8bc8dfc9d9c8fe8b1f43ed4bf8ee85
SSDEEP 12288:MyPz5L841gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSd:VzyZY59oarA4r3Dqm
TLSH
T1B985025776A630F9C1769138C9A11A05F776B8374B204BAF03A0477A1F3B6E19D3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 73c77fb1d26aab58b3ab31d2fbbbf35d5d3eb3a2fe458a159a1b4fd537f54cf8
MD5 20df7eb0f25ebc0673679ac3d78b4c08
SHA1 aa0495a34650331b2bd825f2bbcc47e012ae001d
SHA512 d8634c2664b5fa533b6f90380e9d34de486e2e40848f2fa0c6f118d3ba51b075d270d1369a44df1cbf2bcddfbbce736affd6d12bd37b8b87fa4c582fb9cd64c2
SSDEEP 12288:W71gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSB:WKY59oarA4r3Dqm
TLSH
T14F7523FDDCBF19DAC19C6534F2B035882C2EAFAB8D2117920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 db465ba0ab3e717f1c428d63204b75e626d4b42960631a2763e7c9591857dd5c
MD5 0fee24dc12489c2a9ef86be840c41fd0
SHA1 99ab1b3102181e9b1015c31a913a79f326810ab3
SHA512 182d969857a64d167b4db0bcc44ae53a704327981f48a2741dd9ce2350bdbdd60718e4e8db5967e9bb09f736001d3cd24adc8016aff965c74627e172e3e150a2
SSDEEP 12288:871gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSg:8KY59oarA4r3Dqm
TLSH
T1807523FD9CBF19DAC19C6534F2B039482C2EAFAB892117920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 d27667e3b328df1d616a6833fa24c24e16ae5bec2cd0bb7e336ae1848ceb66b9
MD5 ff24311eed9a590505dbd5b8a067af01
SHA1 3e74deccf3a7ec4c8fa7cbe3569367b6c3527c09
SHA512 47cd58c0bf151ca524af25e35f551abf85733d68b9d65b7520fa1f093787189792fcdbdf23b24f7a5b0bc8a63a68c9cc19196dd44d62801db3bf4e297238b8c4
SSDEEP 12288:5yPz5L841gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS2:4zyZY59oarA4r3Dqm
TLSH
T15985025776A630F9C1769138C9A11A05F776B8374B204BAF03A0477A1F3B6E19D3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 ada6eb776fdc81bd3c9f521f264033f873e3f92ae738f8b221efee0ebfa33409
MD5 a84dc05bddf0836d78807d01d49a4e64
SHA1 7bd6f73f6ddc24862d55bc516a357777c06e6d60
SHA512 1952fd73a8de0454d10c89a5bdb9dca8622f913b96bce0a9de1d29f794febf5069bd4d29e201326921a939745b21928354a4a834347a9389f6ae9ed732eda19c
SSDEEP 12288:ECd9eWYoaLHF3z0z04PDvhO1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSK:9THaLl3z0zDHY59oarA4r3Dqm
TLSH
T1DE8502A8B3A118F8DC67813EC9655905D6B27C6A0B70C75F03E4362A1F373A15C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 3e47b3094c88211ed2d0aec5555441c65cca3df00bc7bb72a5071bcfdb9bfc02
MD5 a84cf98c035580ed4adbfe62885a948a
SHA1 fe438ac67b4719a159b2865137a47d5634f80b3c
SHA512 fd28ecef259cfc03179e11904155c9ed92d2b4198aa66f81ee8018c9bc4e88ef9b11f1b2be19cd9c6c4ac92ed95e7aac2a027734ae914ea02762871a973422aa
SSDEEP 12288:bi4e7+RdTfgwCHKy7GLbbdIv91gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSV:b37d9CHKy7GZrY59oarA4r3Dqm
TLSH
T14B95CF90F7E814E8F0B79A3589725501DA767C6A1B31DA8F03A4661A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 7fdca76e3986713dc2bf1c0f6ab4991e49c666670f72b68987dc71d87af1f81e
MD5 981e32ce65e66141c48344c4af5b70ca
SHA1 b4afd2ca6d8f2aa42ad45ef4b60aa75fdc07364c
SHA512 51677091b17a03870ee499e7247f85a5141a8e370a2831ed165c400213576f1167faa925a1ecb5071c55022729e7413da7c4c0e69b753560a63376824a2646d4
SSDEEP 12288:Oe1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS5:O3Y59oarA4r3Dqm
TLSH
T1587523EDDCBF19DBC19C6534F2B035883C2E6F6B8D2017A601939518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 5792da03d8dabbebe0e65c757bc3149431b3a4725bbbdc17d64627c31134a657
MD5 e8915b46b5c3e0a73efee27a9429fb12
SHA1 0ab1cf71b556a1d3dff62064d7fcbe51e1152f1c
SHA512 2d288e4a2003c08997c1a066f7fd411d4feac465705cab6f976462dd4dfa7adb20a794150992ef8323868919484c3a8c21c755a32509f89cfb9f843bdf57ad6a
SSDEEP 12288:dY1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSy:d5Y59oarA4r3Dqm
TLSH
T1577523FD9CBF19DBC19C6574F2B039483C2EAF7B8D21179202939518173EAA5CC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 f3fa25ef3327bd0229e534cfea2f0011266c99535e27d89633696f2d75920ba0
MD5 070245aa458fed5f4dccd5c76c9ad2bf
SHA1 f90f4cd109bc0af55625f04b7d0c63c6b910abe1
SHA512 392fe02529a137e041f3b050ca2cda926bb463a9eecec007156c4e5c662e1f0f426c825de9b19b1f2e10efe3d2506f27cc535e112c16d2465317050a11e09a00
SSDEEP 12288:c91gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS2:c8Y59oarA4r3Dqm
TLSH
T15D7523FD9CBF19DAC19C6534F2B035883C2EAFAB8D2117920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 89bf1bcebd266b0b69f25702e9ae645603b69195abac3316ad362447ef2b8bbe
MD5 29c7ae511f0ad76fda99237c2d78448e
SHA1 602d0a90b8657daf53507095fd00b8b5420132b1
SHA512 40b739e412cab590fb5737e253587b024fbe6917e7fc622c28b48fe8d99c871d090a2450787ff3ad527a2240c8f37b270009f17d1bf580ca56cbf30b63882050
SSDEEP 12288:471gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS2:4KY59oarA4r3Dqm
TLSH
T1F27523FD9CBF19DAC19C6534F2B039482C2EAFBB8D2117920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 67b7890113ba604bce0dcf11c546245e31dd198b7476b188cde5e39411b40cc1
MD5 e600d592cfb811a4d912a21f86522261
SHA1 0536b75e5646fe21830cc129be694d0c1e000fab
SHA512 fda63546b14762e0663ca8b974ec7e0dcc64f93291645633401f54258e6a50ce82eaecf71ab5ac12473f9adbf830bc4f1dec7c36657e09d98c23b1757bd92a8e
SSDEEP 12288:be1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSN:b3Y59oarA4r3Dqm
TLSH
T1707523ED9CBF19DBC19C6934F2B035883C2E6FAB8D20179601939518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 8c138c47c562bb57dd078fb87f90a23683f3186c9c9277f9d4542ae70e33cca7
MD5 c3074af6b7fdce49ad119a5ce9a79573
SHA1 18eaf2c3cf85cc900e73f6926097f3c036b5e0b5
SHA512 9f1d418646d77edccc65d52f1626fc7c3f85c5033f66f2ee943676a07b2f6d0a94d288ed52fdcb5e78bb7d9f7f33646739116bc9a2bb151ca1609a050c8c2fb5
SSDEEP 12288:sj1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS3:siY59oarA4r3Dqm
TLSH
T1637523FD9CBF19DBC19C6574F2B039482C2EAFBB892117A20193D518173EAE5CC62875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 2aef0188ff4f9eb07eb394057c7ec86fff1444e9dd0d9dc2da9167cec337c890
MD5 d7addc3ddb82de17add3566577ec3338
SHA1 a0bcac7478db3085f2444d7c5aa38cd7795076b8
SHA512 a70aa1e8fe17ba0f43976f37e00c3fe96f1795b748918ddc1a80cda6cc4868e216320ac4de5b0d65ed260e2aa936ed0f6a5653788c6243627ab42a01c1cc1597
SSDEEP 12288:1x1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSD:1YY59oarA4r3Dqm
TLSH
T12C7523ED9CBF19DBC19C6934F2B035883C2E6FAB8D2017960193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 6b5f89078142ad9f97204c84e193612f686c3c24660c1e86c3ad710563f10d8b
MD5 9614420dc7ce6475d1a85b8aa28af32d
SHA1 68746edfdd754b04dca4395839bf7f5dec2133ed
SHA512 d0953f5fee168da10bb3c5bad8af19ed9248097435d3e4980a7fc311418f47d401b7ab89943d3690fa196b55e2bc22d4d90a29411a4e96e9d8544da97a9e9fc1
SSDEEP 12288:D21gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSu:D/Y59oarA4r3Dqm
TLSH
T11B7523FDDCBF19DAC19C6574F2B039482C2EAFBB892117A20193D518173EAE5CC62875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 159d4134c2ec8ef2bfd6b69db48b84dc7df2e46ab61582389b82a0c42a3422a3
MD5 10cab5f23fee47d564c321bdd1f7e6be
SHA1 fa7844ad3751bd8c524b3a833cb3a77aea95d63e
SHA512 5e9e9200d9b4ec70131f8fb401f5692c98543c4392c15a96d291fd4658ece212daec057200b0634f94f971661f6bd84920e0fb68665606868a3edbf3da322470
SSDEEP 12288:Cx1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSr:CYY59oarA4r3Dqm
TLSH
T1FF7523ED9CBF19DBC19C6934F2B035883C2E6FAB8D2017960193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 a78e2881b14115ba0ccf01f8467d4e120c3ca52cc28a019a00322b9d72bb968c
MD5 d090b83f45dad607eab4e9691d1ea920
SHA1 5724c7c9388b1efee876a9ba2ba4f2ff0c06410a
SHA512 f9a30b04e1a94340c09829b55622c5a4b6bee5a9b55b424f92bb4e72124c96a26e50058db45f5b1969f3948a497aa4e5ea220c220ecc5568cd1b34427a5d16df
SSDEEP 12288:1fwvD5uX64Lk3tRX69qkyAI5l1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSa:1fwvok9RX6wkyAIGY59oarA4r3Dqm
TLSH
T19495CF29EBDC04E5E1B7923C99B3460AF6B178691B31C6CF0296536D0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 63cdb49c8b98bdcce6cf1122ad8c5847e63f5172036641edc34231123a23a53d
MD5 de2b5dba7269644f7fc995d8e2c489af
SHA1 129b7e94faf7b5e8153eeffd6b7acc3068bb0865
SHA512 5996c04e5954487f171b5e3ee3962c79357b2ef8dc0253f1cdf12a1bf0eec186df1f74dc817a9e095a19fed7952af2a334dc71b054a5490940d6fd459a17a844
SSDEEP 49152:OYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jY5PrA4r3:AySzPrOPrA4r3
TLSH
T16E066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a604704ed9911add9daf2b9be1126498f64395351dc860dbf1f259b9a007b112
MD5 d0a5b38903369f6575f6692860a3fb6d
SHA1 6c7b3937118e7a404425288973c4be9db4435453
SHA512 6dc0b8fcabcc4cfa6323eb56e4c9107a8919894a1c07b01f81db7a17ee9b505c80b772f9cf18e407dd12b405c2617af35d7107a696620a3f8f0b146178556f9f
SSDEEP 24576:r47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9Y59oarA4r3Dqm:r47JUQj1irIhCnDHUPfF/zY5PrA4r3
TLSH
T1B965AE1EA3EC01E5D1BA927885154A5AEA71742E1F31CACF1270837D6F27ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 982381fc527e90c516fcaaed658d57591aaafa7f0f9cd092b967af0217a9fb8d
MD5 30f81ee8a9aadac07b1d9b8624d82df2
SHA1 918d7d4dffd9f87005bee8d0504edfe3cf379f3e
SHA512 53bbfc21e35cf9a00e452877af83f02c8035fd9a8ed3773e9cfefffe573221d54c5d1ac3ab6c8e4b7cb8329d0e7ad8a65f0eccfe82982318d557d8a86c169bc5
SSDEEP 12288:YNsfL1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS9:56Y59oarA4r3Dqm
TLSH
T131750159D6A902E9C0AE6138C7615A40B7377C6687F193CB03D0F53E1F3A6D09CEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 60f95ce0ae95ab186bac9be9d666fe21b72c4e54875a93e19dfbd4218196e384
MD5 969325b7f9b1b85828a65a927ca03a1d
SHA1 01e0b3f20330314337cd2e73b1ac6cae7b193833
SHA512 814dc53e1b191832e6233b6f5086893230c16f8fd54fe1d302ca3ae4d28a8565dd9e255f9854c5567c959097a49922923dbad4cee33f484c4262915f2278d55f
SSDEEP 12288:pTBTgU3fDWZykOucJmnFpWQlbMEaeMsKvuPmvY/RCAv2b:pThgUPskmfl1MEaeMFvuPmA/RCAv2
TLSH
T18F451840766AC75FC69940321E32D2CCAB707D41EE446F0773C99B3FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 df7ea4822c0981617ab702ea21509b9d5643ff1098a415b8027843a628629354
MD5 270cb164e35ebba0945d3206cf0b78f6
SHA1 6d46de9cd5b412bade524d188b4ba0da20f2e43c
SHA512 6229d8b4651f3acd2e7f67d721971cee396285e9291deb57e4221d22f8c52dbde9cc90651c6b200294f113bf43df228b69ce365c81e5198a9462eb9f4d32db1c
SSDEEP 6144:LOeB9WgmpCOtWhR+bXPptMxqh7UtfPptMxHIkbz8xK/9I46ISi:7m0hR+bX/YIR
TLSH
T12565F9816137D3CFD1F66032072A5B4CAB64EC07B7496F26B788453AD86A725A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 1e33e443b51d56fb20a58de669bedcc033c2cd6bd9de54043d3b836d34a50608
MD5 1b1d07b46b8bd69bcfe37555ecb5d3d0
SHA1 1ddad1a925dfd3875c4fff069d79642e8fd7d93c
SHA512 1ea486b2a34f9d88d3ce9705f4c49a0650b5136064242398110d2b15d4cce134959b9160d6f2eda6d2d6776dfb72363f311ef33b5b9df672b83ceb291856231a
SSDEEP 12288:OM7z1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS4:rSY59oarA4r3Dqm
TLSH
T10B7523B9DEBF199AC0BC6934A1B575083C2FBB7B8F2016D311429618173DAE5CC72876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 159e5f52a0a2df7397ccc1fc220c524613e162abd59ee47aa7aff6e7c125b081
MD5 c632403099d208425f79f56601475f06
SHA1 5d844d3857be4ea91f561071217fdf44cad207a0
SHA512 0bcb5b66bd4fdb4623bc2cf76ad804500ebc6993135cabf3c8f9772f5a2f5ea80882764f63a509e17cefb6a203ecdb0021d96fd0cee65f97abbf4b1777a525cd
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYEY59oarA4r3Dqm:pgb4mBIBhGF9Y5PrA4r3
TLSH
T198659E1E22EC02F5E0F9E2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 2173a70087406a993da726de6a318a3044f9cb92d928d7a41e3e67ea76cd3bcc
MD5 cc24d1b63f30a8010f45d976bd6939a2
SHA1 38ba9bb0704f59462de1ed6edadf4bac147b3bf0
SHA512 84ba635b6b66bc88bce81649ada6c37f7430957b49339e6e6b6d9f22a1619d884a1cbd8d4d7a78fb22e40088cb7b0ee33779b8a3e1ba9b86f7c14a6e8088a8f9
SSDEEP 24576:pG88u8FpJqH1bzria7/mtY59oarA4r3Dqm:87ZFPqVea7/cY5PrA4r3
TLSH
T102A5F16576E501F1C47BD13889924663F6B2B8260320EFDF07A88B551F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 d2b62ff8aac3aad61dcaaebe6b3ba5c1c470b745fc240afa5f2c436653a630aa
MD5 fbb8ad202e6a77f83fea0fecc4da6a39
SHA1 3c8c1ff9875f305bcb63e2a3826d1026ab5d7ac8
SHA512 4d91577779c1248c693cbc8c81f60ce5991a93e4147ba236c72c548f0c3ba830d642366e82067feede832158fe76617d620e7f92a55a772b0deeb8521971159b
SSDEEP 12288:OHvUrBFrEjwaQw1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSh:OPUr+NQBY59oarA4r3Dqm
TLSH
T19A85E16F66ED18E5D67AE17C85925609F772B462071192CF02E1817E0F37EE8BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a388d1b85af4f22ad3324c1adcc3b69b0fa6890953d48713034c37da2c3c053d
MD5 76de1e7bb815819c8f0c1e94003bf8b5
SHA1 73e28fa286e27034816bcdd7a7b909da36f6a37a
SHA512 771c52302bb8b17dd8b895b76582d914f7ff4f8d838a8c0b7ba7739f13a8b87d2cde185a6557b55f3aeef2e8cce67c602641f61189941d65de0d4794dfc5f952
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxY5PrA4r3:xG05lO43beOPrA4r3
TLSH
T15ED5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2d96155f67763ad9f1d44493185e871b4f1447f128663c8830777568e7b93516
MD5 7cc9f353aa4690bc3d173ac910c61da8
SHA1 2f736515d7cc75535a9f30b982f5e1d7d7bd0d2a
SHA512 a4706ec9cfab268fa1c0f8dfe44d8d8dc8c4a9d3edc0b4faf3e7baa6c0a751db5b9765cf79476dd1af6bcfe9fd7d5af1bc5bf7045f38933396f78b29585f987a
SSDEEP 24576:Qfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnjY59oarA4r3Dqm:oa5POZ3+Jt2pasx2+m5Y5PrA4r3
TLSH
T18465BF5EA6FC01D5D1B9D17DC583461AF5B2342653319BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 44664685f987f8906772c79556418af69c61540c11986d2b547511e6988d33e2
MD5 26532e36187ba2956f230abae591ee42
SHA1 c00abcfc64fdf9f53d734bcf21a8fa6b0b340268
SHA512 ddbbc4d0484fb672eb4b81e03b6020271dcf9e9b45cf5fcfa40ccedf7990db16e5bb9603245eb22a2c5456c68919064fca20a0ada3b1c6d154313eac79fce622
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkVY59oarA4r3Dqm:INc/zEOVHF8Y5PrA4r3
TLSH
T175858B6622E901E4E1BBE1BE89779546FA71786513308ACF0291851F1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e4c27d84c6cff81bbd51a082ae40360dde8fd38be433039acb882b02b7305f03
MD5 1b98b3558b8aaf8d4c3672bffaabf5a7
SHA1 ba67faff8e4ebd2a611956fbed5e2a89b1d4b09f
SHA512 4a95efb5cf3d95bdd772aa891644d06d02365818f0eba5888973ba39d6135a7b8db7d294dcd94d5218641da619664c7c727045cdb48eefd03b4e196c9e282613
SSDEEP 24576:58kNvNnaFeYhJNtmZBm/Y59oarA4r3Dqm:58MwBtOm/Y5PrA4r3
TLSH
T14955AF6EBAB806E4D1FEC6B4DD238512FA727461073253CB5290C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 93c1063cd0b18979dffbbacb7c3adc916f09c90aa50c35a1f9c5898e4cc597e8
MD5 3dd2239e4971d3acdd106bde6b8bb0e6
SHA1 d6c770d071a7b66ee00bbced9f66ac595077b79f
SHA512 2ef80d9a0ebb1900c4cc9142f0fedb9b092bbc354172dca6f6c32cf501c39325e4767a62e057ca5cdb6287e339500f396fd6de18e89b3669b1bf2a673f04e896
SSDEEP 12288:7QcMxWDXN1Dp/fshBItT1IQgAn1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS4:7D3FHshBIYQgAuY59oarA4r3Dqm
TLSH
T17E95E17DEAAD04E4D57AD1BCD6634A06E77238A9033166DB02D0C1B91F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1288-126-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1288-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1288-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1288-132-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2136-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2136-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2136-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2136-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2136-379-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2136-361-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3136-53-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/3136-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3136-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3136-246-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/3404-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3404-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3404-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3404-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3404-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3496-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3496-112-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/3496-114-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3496-366-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/3716-378-0x000002064D1B0000-0x000002064D830000-memory.dmp

Download

memory/3716-397-0x000002064D1B0000-0x000002064D830000-memory.dmp

Download

memory/4392-48-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4392-39-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4392-45-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4392-50-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/4688-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4688-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4688-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4688-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4864-346-0x0000000140000000-0x0000000140581000-memory.dmp

Download

memory/4864-76-0x0000000140000000-0x0000000140581000-memory.dmp

Download

memory/4864-0-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4864-9-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4864-8-0x0000000140000000-0x0000000140581000-memory.dmp

Download

memory/4864-284-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/5304-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5304-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5304-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5304-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5304-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5304-362-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6452-64-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/6452-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6452-279-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/6452-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6868-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6868-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6868-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6868-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6868-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/7048-78-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/7048-83-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/7048-347-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/7048-77-0x0000000000400000-0x0000000000674000-memory.dmp

Download