dae22689d58dc0d6817a6d91ff0fb0d5fe07d447ec2ed2d80e041fbc763ed715

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample260816-vrf5dasfmf
SHA256 dae22689d58dc0d6817a6d91ff0fb0d5fe07d447ec2ed2d80e041fbc763ed715
MD5 a69b747d639b5cce41de342dc2a5d934
SHA1 c0fcd39cc406b72664592886447a7e0d5d2195d4
SHA512 1eba7c1a80ea76ba286077e30579dd1c1104085e30f75fc91b8125f7e026cc9db6b8e3fb46c52c108746c1d8d5cf92a025853a08d3a32def3d1beb8ed7e0da39
SSDEEP 49152:NGtlq1aVwASOz5IU6iCaW8SyrZ12B+fti1oYvJWYWQaIhfCj89zd6hfKH6Tql8Bn:0++LHz1i1oYJvJC8q2VhkbbmBYtH
TLSH
T13C269D16665901FCD5B7D138C6CA5627E7B17C0603B18BCB02E4BA661F33AE26E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5400	elevation_service.exe
1828	elevation_service.exe
4592	maintenanceservice.exe
1244	OSE.EXE
4556	PerceptionSimulationService.exe
432	perfhost.exe
2812	ReFsDedupSvc.exe
1892	SensorDataService.exe
1508	ssh-agent.exe
4764	AgentService.exe
2824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\61934432e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000781a599a22ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000639ce195a22ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059a70a97a22ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fb9bcdea22ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fc5b296a22ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4204	2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4764	AgentService.exe
Token: SeBackupPrivilege	2812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2812	ReFsDedupSvc.exe
Token: 33	2824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeDebugPrivilege	5400	elevation_service.exe
Token: SeDebugPrivilege	1828	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 5620	2824	SearchIndexer.exe	100
PID 2824 wrote to memory of 3932	2824	SearchIndexer.exe	101
PID 2824 wrote to memory of 5060	2824	SearchIndexer.exe	102
PID 2824 wrote to memory of 2776	2824	SearchIndexer.exe	103
PID 2824 wrote to memory of 2340	2824	SearchIndexer.exe	105
PID 2824 wrote to memory of 4296	2824	SearchIndexer.exe	106
PID 2824 wrote to memory of 4380	2824	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1244

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 82e71920954f3d4353a2807a4cf6d61f62cb73d2fdca609be6cf3051e2f78e3a
MD5 09dbdfa8fa5cf99614a5919b21dc4200
SHA1 c3c0c988ff279ea2f25cdc43aadf0308f52e1c8c
SHA512 bc81b3aa12d765fe9bc459ea0cbb6dbd65bf843b2b30c3bf38a60230c25f7c9b18a622c9a05025c17f403c47d2a00b49486de2ec388be442ee34cb3f58dbadaa
SSDEEP 49152:Xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnH4ZPzwFI/wOifnzH:F3q6mjBlYtH
TLSH
T160D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 dfcd964468e03d8f9d72f5c7a530015147ea6cb829c97d1d49902158da0b0732
MD5 54d2a1631d9396878daa80a7435c4768
SHA1 464b8985c197c7eb939eaa3adb406437ece68a6e
SHA512 3cfc1f1f2d6bd8579d1e0ee29a89b13cf0e2273fb4a037147add251613cb3e64364df22c11cee0248d229f35b41b3c97cdfaedcc32218b71ef43917b7d92841e
SSDEEP 12288:F1XLsswWkxy2lRq2czAXcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:LXYfDtczAsM3tBZPzwFa7/wOifnz20
TLSH
T13875F128B3D109F9EE67827DC8A28501EB3378954760E78B03B4953A1F736C85D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 4b268dfcbaca19cca753ce9e7340dcb92e26c4ee36ef59ef1c70828584cb74e9
MD5 3a526b757e76b4a6c089125c1ba5e87f
SHA1 daa2979edb9738ce2dc7bad4b2800b86c424ff81
SHA512 d44f1969959fd2a22cd21d4c15dd0c373e1db1c725f1fb92030ea0fe0788dc12873247aaee88679fa97070068919437d19ae9ea168b8b741eab616f19b3cf236
SSDEEP 24576:G0Le5ji0hmxhrM/M3tBZPzwFa7/wOifnz20:GPji0AzC4ZPzwFI/wOifnzH
TLSH
T19695AE16F6748371D073C0B9C5D2A68AEE71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1177b6192dbc05def587ff03ac9e9be9a9344c07a0a453fd08ba2c8cafa87af4
MD5 c9bb8951b9714de439a9ce3568790965
SHA1 b970d2834f1ec9e52c4db1bf230ac45fc8ce62ec
SHA512 c6c36eabe168bd9096905e74ecaf76ff1aec7dd6d0e4fa80acd20d7229c78aa1293b68e8bd7e29db2bed0f6ba99ff39ad1fdeb707e6bd4343052fd1e18570012
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWj6q8wyuZM3tBZPzwFa7/wOifnz20:V/ezSC6vUzPv+Hjym4ZPzwFI/wOifnzH
TLSH
T19F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d56d416f6c5af4bb2bc9509866d367a67b8bcff603195f73d939682923553a01
MD5 150f74fb1e62e52dc7ac067fde768d74
SHA1 8d834368747383655e8fb631cf73f3ebf5af2cd9
SHA512 0b945a66f5053500eb9f7c9e497152a64990114fe4567d4880a2bd844800f1a888ee2a533cfcab227a7483aa67525dbc14601545bd1d5cc0232f96e221ccc84a
SSDEEP 24576:nVbqPb88hv/l+B4M3tBZPzwFa7/wOifnz20:nVO88hXl+i4ZPzwFI/wOifnzH
TLSH
T1A8559E66F6748331D073C0BAC5D3AA9AEE3234415B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 8dfe0f9825062c367c9685f649a2f46f389f7036eb10018a92e63ed0f95223d9
MD5 6d2cd8e9afed9b3be9f9d624492c4485
SHA1 24ec7d9ee8eca9bcc5c1ee215c3ce9e8cccf4548
SHA512 3720dcd8f3927e80c119f241d6831c7d679cb50f96ff4f08eb9b1129cc004c65dc0637d0ad51bfec9983a5f273a6eda3fff08b89e594d8acda1ecec441fc0d79
SSDEEP 12288:UGScM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:UGbM3tBZPzwFa7/wOifnz20
TLSH
T1E8552382E79286E1DF521B7521E7E6028B19ACC85610634F5FB2303F5EFBD46C01A5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e899f73cbdb6562713ea8fb7babe8c2e39ff130d819a28d3f646e5ff2a0833ee
MD5 924b693ef1abe4ae17a24858cb7e7844
SHA1 75c9ba669cf1fd3a57df3ae428e466ba1821d09a
SHA512 869ba25845539eac3141cac9866a69004d7116a9b5ea344a3378e6f405d3131558cfeb6472b5bf0e882e45c65dfdc3bd3fa3f03921b0f790425a1f95eca2bb67
SSDEEP 12288:veBNUbTVO86U7cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:vJIUwM3tBZPzwFa7/wOifnz20
TLSH
T13575CF7BEE28FCE2C67A4DB95692C700D76278704B22A3CBD175820EDE235D14D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c0c44edda1720f3828c34530b46a0e4f9f2fe2431eaf5d3db89e7ab00c8429fb
MD5 37f59110cddccc3b9421b400ecf9712e
SHA1 a3ce442734fb044ab3af01c75f498d2f11cee6a1
SHA512 0cd8133103adec5f1b0b22c47f8a0f055a7b5ddf081a8945621eb271a9247855640f070df97d1fdcf0a2ea6eaa63b7e1447cbfbf09f37a2a10ee2c68f4447a6a
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THU:1QvGAdlCEL8c/WRNw5CmYtH
TLSH
T1B4267C656BF880F5E1A7E138897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 0b4dff2c15ab44cb7cd27a743cdc6fee5b2a9291aabde4e08dfcd926224513be
MD5 13ec000671a9125f38257cc6da8eb30f
SHA1 bcfdd48a4e5ee895f016ea305c3d48c7ca3fdc7e
SHA512 5353b687a260dea217030e648815f2d6adf9dcfb99c9dff2e5ac7e6f5da4f684726aaf1b8f573a643436c51a70871f85b9a5274b63dd5a3bfb5327390d94a35c
SSDEEP 12288:4AwSfxL/2Dc3mDLLmt0LDQewsAjNcM3tegtociOPyazluRF4KM7GAwOifEWDNRV+:dfewsAjSM3tBZPzwFa7/wOifnz20
TLSH
T14685E031FF71E032C77B0DB61B66C716142C79604B612AC3E3F8499E59706D26376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c0729406e3051c3611b0d15a1e7fb56ccb1f8344ce94071f589b4024adc354d8
MD5 63c400d63e0ad5e12b8bdc7c556861ca
SHA1 9abe467e69b802b83e48c01b80af48ab92bb6edc
SHA512 ac8ecfe3037b519f0eb5b86f04002a99b77ae98c30c96360b9a23f6ca2173db72e5ed935c5c4b850547981577b57b4c5aa6599bb13a14d8fe9a40138482601c1
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHz:PUEtQevvqc2W1cpV20I32
TLSH
T17E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b895694267c453c90f65771f45abe44cb5d4a54af9bcbabf850f3925e475e39e
MD5 6b1f210b1215ed3a4f412262b1761956
SHA1 4487dc9055e18acde6cbf6cadb21ad105aa7198f
SHA512 6bf06e0dca7f2cb4baf4e255218f702c7068aeff3f1e318392c2f2a99ba056908182fea8ad0d41f7b5da2be31abadfc72744bad6b131c2370ef781739e744d9c
SSDEEP 49152:LCbRquA/m2yL5zifFiV+XenmE3/zy4ZPzwFI/wOifnzH:UoqHVjnmiYtH
TLSH
T1F4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e373b2f418136f75e72baa7cd6892ca1b6bf8e946f5c0b36c113dfe8da8147a2
MD5 561df40b36a5be69f2cd8b61fdd990e4
SHA1 ecd52d6fdb0892ceff60c05e3259e7f7d9500c9a
SHA512 9d0a731b258b71ee7bbb64309e12cebf54f0a078356f068b7db69ee5fa32385e1a51b4e6e85bea61af6dec1d19154d14824eb5d9421d8ff1a0b54f2a78cf7f05
SSDEEP 24576:yAhGL6IFoiwtA5l7S539M3tBZPzwFa7/wOifnz20:yAM5Foiq5t4ZPzwFI/wOifnzH
TLSH
T1F9359D81E7F945D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 758fdef1efe4bed958b11bbb01bd54ff28010d23d6298b52cc4bb3e613b1799c
MD5 cc0346db681980fad3712cff88af7b5f
SHA1 c35f7e70b2a22fa4acb79cc7f1d91bec6b86ae59
SHA512 d10ddb96f094bbaa9b5a8d8e4a3cb3fbea0af7c37c80d206245eae13709d28f55cc023a38e289ccd315b5cf85c6ee4d3fcb7b87dd655cbe7a6dbbaa64cacacc5
SSDEEP 12288:/mw5HEjsChNEBFgl0WDm+CYcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92go:+wuROWGM3tBZPzwFa7/wOifnz20
TLSH
T1F975F14677E50CF9EA6782398597C132E7B2BC412A21D71F1770C22B6F77251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d68b1267cfa0870064e20f7f0da0055f82c87cb40c7c5ea2e33bb1fb99cd54d7
MD5 f3529c4984cad575a79243b51c1066c3
SHA1 2b17807845b1579b0e8f633bc5fdd7148714fb6d
SHA512 499ce73983a95ed4502347efdd8bbb87ab7ab28b297fad58be0e6ce2c767248efac519f56e93d30ac3e71d79df85fa65737bcccbb0b16f1bf9f2cdc96ccae433
SSDEEP 12288:eyZ1Iy9cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:nZuXM3tBZPzwFa7/wOifnz20
TLSH
T16D65128633E121F5DBA3427D88E29605D7627896633153CF1A71413A2FB3EC68D3A736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c7643a6cf40ec54ae63af3fb8b6bcb228e7f3292e028ee9866c229af6aa6daa2
MD5 f5583ae10b779dad7bf684cb85211431
SHA1 b3a5f96ee7c8d126c72f400503755f4284ac9a26
SHA512 d2a5cd71876ca32c95b0bb7812fdfee97fe70746c1d6e93c7384842fa904680f7203c1ad168f6b576e6db7f43db82913775fd299973073882d0ae3dafa740d28
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UI:/QRQyi36YOcPDLvw2gAf+PN35YtH
TLSH
T165667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4b35a4b9fdb2b7525afe1bd790727269b9517125ac7c301081c09b4f800905bc
MD5 713a02b96b1f54fe3697f1e046ec63e3
SHA1 8a59919a94841fb7ad4626c2f4b9a7efec6d3583
SHA512 8e85848ac3dfb066261f453295eb171723ee9c20de06b7417c6303d170d7e96fabd263b93aee2d983d0bd027ee8e6a55e6ef27180f8bc8a07ec936c7bd89aecb
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UI:+QRQyi36YOcPDLvw2gAf+PN35YtH
TLSH
T10C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 090b0ffaa7f4fe0b623030708b306aeade4571580f1a3f1161f08de109d1dc3c
MD5 3835aa17d71754083369bc447abef778
SHA1 63073e37054f0f2c5dc9ef7f63b79d2665633531
SHA512 63e34c9b5e608fcb7a7fd1b626b82c7769eafb44eaf88ad9d46c74dcd80dca55e928c274ede3de9deb07c6a87ac018f3bc7322b7aea21af1bdcbfe1a2b7d571e
SSDEEP 49152:/68Qg55nhkeWu7PNU3/C4ZPzwFI/wOifnzH:5thTRc/LYtH
TLSH
T13BB54A33B2F200A9C44DE1769F4A972196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 90a28aa3c7302b944c3950892d30ad382463868d3d7c22e589cdb88b596914c4
MD5 5021b0b6148d50e0f3c931dfdfb78d21
SHA1 e3cce2c222635ea37231d1d2c5b1060601fa6207
SHA512 faa92de75588d960ac9060a099f932826469d5226c806e8574a8e121abc42c64960795a653f83481ff1ac2e169be85d013bafc9a3e210b3edd7a7e051273560d
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99a:jy5112gYy5azzVvU69nLKnhZUYtH
TLSH
T1E5167B13F29900E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 42bedaa61720bd0ed70cc2442c2290ae590a90c6812b74555d40663e1a1e4b1f
MD5 4620b5313f93831e44eda049d9269774
SHA1 d3004b19920fd680150e488167098e9b2c4dcd76
SHA512 6aff1b0c8ae45b80426cbe7735f0fa46fb7101f1a20564c12f0a2076a6aa16d992d472f501d11b06c1a7b1763eefbfa58899fea044a748cc2da1cdd8fe934033
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glc4ZPzwFI/wOifnzH:/u6JmIxd2dBYtH
TLSH
T19FD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5e7d764e8a0ce2a58b94f2e1356e98d9264036cdd394bce3286dcd377de8f642
MD5 27ef5cf864dfe603a581161632ef882c
SHA1 9cbfc1f4bb758002915006c2d0aa8920c24dc75a
SHA512 10cee8d743f18a9a88f62cb48f7610f8edf4042d1f2c616dd270b6d73a4ff73671f71a7f9c3997b0f86741a48ee8c342a10fa108a12d53b2a1d288868793d613
SSDEEP 49152:A1hpsNoJpF1A67U44CwH7R4xQ4ZPzwFI/wOifnzH:AmifPqRiYtH
TLSH
T142B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3a54d4152cdfcf5c67e340cb78b31e2d9a9bdadbb14a3c7e928e8216e238aa3d
MD5 92d31d2a4720b72f410b51f807338c24
SHA1 bb688e4fc5bbc2667c717ac22607358b2396697f
SHA512 237542e32a8c376137fd8b98d1973a0494795a50f4909035c3dfcf3cdf312d2f66812596476d0443ed037f0c68720ab434f9746d6535fad885455889d1f451d6
SSDEEP 49152:bSuZQIY0Be2KkRVtOnks6NMHqX4ZPzwFI/wOifnzH:J5dKqi61YYtH
TLSH
T104C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a3f63ad3080550658ba822fc399d0e2cd2c4c43ebf197371e8f2033540236c3c
MD5 70e7c71384b3c0b2d596fe5e3360d042
SHA1 980722def0c0f68f909b3ed056f2182c6e3dd3f7
SHA512 b8a86f25dafe590349e3a28cb3cf32fa5b81e59ec15ca11214e941e87303bdb9e3c54a02d6580abdd454e021371216c76c87eb67c803fc40446a36c242edfb53
SSDEEP 49152:7htSn8EApI0figjgiDn0AP5ws4ZPzwFI/wOifnzH:aX2iWph+YtH
TLSH
T1F895BE13F2D901E8D05ED178C7468632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 3cde60bb87df960f365215c5c63cafb6efd246afc6ec3db743a06dbcf789f03d
MD5 3210836672cf47aa87e1dbc37c1f78b9
SHA1 be822b07ddab737788313df4ac0da43b177f2101
SHA512 4ba9363b7ed09a7cb896fc9358034a2d3ad5e24d9e54867520734c2b22446e690a6382ab7c03589408ef7156fc24bb71ef9fc3c85ad1aa7c682cc00dffe1bd10
SSDEEP 12288:XacM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:XzM3tBZPzwFa7/wOifnz20
TLSH
T11E552381E7938BE1DF010BB551D7A3058B0D68C9A611635F6FB2203B6FF7D46801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 9c00010521fb6f420cbeef17c9674e4a42d3de57e33992f66e552fb5526720d8
MD5 6c8d0736c51b4073e13b76e5280c7314
SHA1 7c7982224f1cb787ea53618bc3ce4d0f21f6bb03
SHA512 979fb7989d5188d9285fb4b1fdbdb52b2207b9c9ed137633ee26bab3e69aba00cd038f599e2c5d864ec1f0ea81612190e4f6adc16b8f963ca055976e4cbf3049
SSDEEP 12288:nJcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:nuM3tBZPzwFa7/wOifnz20
TLSH
T1F6552382E7934BE1DF011BB551D7A3018B0C68C9A611635F6BB2503B6FF7D4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 987341e5cfadfeabcfdc46f00cd653f463703efecc112e1ce8d9185456af774d
MD5 86f6ae95eeba049ff8557a21b9074990
SHA1 e59f219a61e31f5f6a5d6cb345fddcbcd361851a
SHA512 cf8460013cc9baad4d2abf64b0ecd85370567f9e0d815ffad654c334b48695a3d7b448df36c8f9387fa7faee88d969de2e616e44b2f6b67c610351a569ffd4ff
SSDEEP 12288:XDcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:XoM3tBZPzwFa7/wOifnz20
TLSH
T19A552381E7934BD1DF011BB551D7A3018B1C68C9A611635F6FB2203B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 811de3d8030a251af6e823a2cd4c5f16f38f5f36bf308f7527556a76ae09a0ea
MD5 77a4fd7e8d4e7ea7c0bdccb8e9faac7c
SHA1 c3c815606a6dd9dad824b6052db16a4fd680251f
SHA512 be83201398607c3c15ff676ef98cdb6a8ad2b348874da5c4f9785d8f164f9a64d895af7255f8ccc35436658ee5346ab245f4ac1c121bed891dad340a79a58b9e
SSDEEP 12288:VVccM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:tM3tBZPzwFa7/wOifnz20
TLSH
T1D8652342A7A346D1DF11977981E3D201D769BCC8A731639F6B71003F1FF3E858429AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 1d4962a28718a447607b364a7967b7a9e87c431458bdb35df0de508f59b1ec2a
MD5 ba7c6e2c15ff19d0e72547d396e1642d
SHA1 541c8c22dd42f147130af78c84024f4031b1ed05
SHA512 52fd8223d8a018b72609dd91d7321d29812c89627dd0e5f96725a4fdaad81fe935497530aabfa4109cdd04924797319900a17ef99119d996f8bc8ca36229ca2b
SSDEEP 12288:10cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:1lM3tBZPzwFa7/wOifnz20
TLSH
T102552381E7934BD1DF010BB551D7A3018B1D68C9A611635F6FB2203B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 e7d82af851f48aa20f8756caa2109e4f3c0ce18b082712b7bf11de9f0547c7a7
MD5 27ca8120a6879e1447e3b6525a85b469
SHA1 6d3217a04f07ed3d92ec6272cdad71152138ee2a
SHA512 bf48a6c98548e6f7f401e2c860ff118c6a46dad5671c558b1939bfaf50f6597da0393176da7ab845419d6b172b9aac1b67a95b3d74ac904de7f6abf23b03dca5
SSDEEP 12288:b1cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:bKM3tBZPzwFa7/wOifnz20
TLSH
T12C552381E7934BE2DF011BB551D7A3018B0C68C9A611635F6BB2603B6FF7D46801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 292092f0326061a9ee65955af52d101a6c3a9f2e29a4d8bc820b399677e9ef40
MD5 36f9ef6c3028799ab6c5e5f1f02df067
SHA1 45e72747e1ffacc0e2fb9009e5085f185a358d32
SHA512 0aa5b24ab69df1a31a70232dc2cbd9421d7a714c2fab01586ae06f6a58576b0a919f09f775b6a29e179c9869b1417c7e24904c0c3e4f1c2cd92573dfd58e5591
SSDEEP 12288:HhcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:H2M3tBZPzwFa7/wOifnz20
TLSH
T19C552381E7934BE1DF010BB551D7A3058B0C68C9A611635F6FB2503B6BFBD4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4810f4ab41ec459d995a2fbda87f3a67eb356b2c10dcc2430aad131d46d57155
MD5 c25affdea2de1c85a856074bf6efed70
SHA1 75f33978ed8bc96330fdabc82d11dc16e67d666c
SHA512 df2696ce3bacbffdbb427a4fa7359e286ee198dfd363023f285e8887f6dabb70ab4e79f33f8ee584768de7ed6114cbd7c2e4181a5a17cef34c3019821556c532
SSDEEP 12288:WiZwbDzzFEoS2cPvypcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ZZM3zFVSOOM3tBZPzwFa7/wOifnz20
TLSH
T15E750195B39018F4ED63823EC9668906D7B27C590B70C61F17B4322B5F737914C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 798af196de2b993263632fdb21e9f6ff99739338f181deb497d50ec2111ef322
MD5 6fbecc11b3e4b3bb82fee5d0e6c36938
SHA1 8e658315a5002f87b2d7a4f736e3c66421658fed
SHA512 220ea2a86578b7d7e312f5fc28b2136469ec714debb842dec6bbc143f9a2bf775b957b63a0bc63f834ce7781b77e46bc5e592fcbd318feccbead3ad9cab29c4f
SSDEEP 12288:rOcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:rnM3tBZPzwFa7/wOifnz20
TLSH
T1A3552382E7934BD1DF010BB951D793058B0C68C9A611635F6FB6103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 c636f54ebe844538ecfd3121ad24513a2638b72e16126d2c9d2555d2612f1531
MD5 68602f2fcd5e6b29056d9a274436d536
SHA1 99ba4ccf0b3657645557d758dc10e9b1333a0c81
SHA512 4678144c73f1936cc09da06a751ebb7a8ef3a4ef6b36cfea8d4a05facde3b792d4ef717e06c8db9a78116f704135f1cb7dccb098255e50d719ff788a7131c746
SSDEEP 12288:1CcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:1rM3tBZPzwFa7/wOifnz20
TLSH
T10A552382E6934BE1DF010BB551D7A3058B1C68C9A611635F6FB2503B6FF7D46800A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 47b761412f49566ddafe652b0da3bcdc9b1def811f19ee59544912844fecc25a
MD5 6829ca785e24a73b5a180d256d04b1e9
SHA1 01873f33cdbeaf296851bd9e2096175233cfe9bc
SHA512 20acf311ff9e5d5e9bd7a32824253aacaa3f4b2cbb3540d049663631f861e48c7b21a77c762070784c784d95432a3b3611e9f67fae1d2b355bee57f57628173a
SSDEEP 12288:CyPz5L89cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:fzyiM3tBZPzwFa7/wOifnz20
TLSH
T15A65124773A231F9D622423984A35A02F775B875472097AF17B0023B2F77A919D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f05b1479226ada73bdbad4dc3fa6e75c8646ad2f176a7ff863381ef54efc4015
MD5 b4b5032b21d812e5ee73b5d47f17cb2f
SHA1 316dcba92f1f813f1b3db1e0a0a446a4411c37aa
SHA512 36b533638e9a22cedd2e1f34600cd7acaa10357234a2aece067ef9df26dc87c000787177094a5ebe1251ff3f88e026c362ee811797e8e15971a63d89812e8ef1
SSDEEP 12288:4OcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:4nM3tBZPzwFa7/wOifnz20
TLSH
T130552382E7934BE1DF010BB951D793058B1C68C9A611635F6FB2103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 e2fadcb2a198fb99d626be9916083f79731fec2b0f0eccf74345c2db1b06820f
MD5 2bf2bc58b7a839de360a296f16715dc3
SHA1 3cebf463ffd8fd7d16d0693ec590941473e179ce
SHA512 cd5c3f1d0c24320dbd3b25226f161cd96eacddf8d09699b947503ebcabc64b007efa168652877fb983d17e4c565cb3097fe811edb5c4b9d1d1f42fb5cd55e4b6
SSDEEP 12288:SOcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:SnM3tBZPzwFa7/wOifnz20
TLSH
T127552382E7934BE1DF010BB951D793058B1C68C9A611635F6FB2103B6FF7D46801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e1ffb3970b429319debf276e6df7f835bfcf94a01e3f66bf9f170fc19a802832
MD5 dd7ddc2ad01624627a38933df53d8a85
SHA1 28a04d553334fb489805df350250dc1983c83f56
SHA512 f18aba49a07f49e29607726d836703cab3437cddb0b965ab7b50f4466d608530745d262c0c07ca0ef3df17b1c806f26123517459612da97e7c248d02b052a3d4
SSDEEP 12288:AyPz5L89cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:xzyiM3tBZPzwFa7/wOifnz20
TLSH
T14C65024773A231F9D622423988A35A02F775B875472097AF17B0023B2F77A919D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 559ec747322f42fe08fd952e83df1469fc72de1a1cf8241da401701d019156b8
MD5 09e4bc132fe38b091df3d463f5ead30d
SHA1 86e419af5ee3552df01c538533acb6ef8e1443d0
SHA512 def61a3541a2e09d578b210f38b778a48fdb42cd15de39a37881316087b66845e188dcb699e0898fc17adc53f1982d50882ccda6900b3fc6711540e5970e7302
SSDEEP 24576:WT8aLl3z0zDYM3tBZPzwFa7/wOifnz20:WT7LljZ4ZPzwFI/wOifnzH
TLSH
T11C750195B39018F8DD63823EC9668906D7B27C5A0770C61F17B4322B5F737914C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 d05fd8be137ce8fd5ce67996d46a5380c26fa926b637379194f2c6013b698c68
MD5 ca9791eae1c20979a33d12c2b0b9b573
SHA1 1a2b5bae2560362a425c2b5443e338db01b64870
SHA512 6caec9fd3387fbc330f78df1aaaf4e6f340d39077b5359e23a7d331534bab2bfa594b5deace32f74c06c8cf44ad4f7bf0fbc2d94fa20df0dfabd208496392181
SSDEEP 24576:Q3rd9CHKy7GZkM3tBZPzwFa7/wOifnz20:ard9CHKyaa4ZPzwFI/wOifnzH
TLSH
T1D985CF90F3E414E4F1B39A3589769511DAB67C9A1B31DA8F03A4252A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 2259c2f761c8c65186fd48fd30ed213a44886281f928ecb539a35b65a8e3d367
MD5 96f93ef8895d9621f3bec62dfe4c6755
SHA1 6752e592cd202d9d1a0fafdb52d4f91ce9d8b712
SHA512 855ce587ad0719acf92342230e88e673b0f7fc15e52a94c40950e0b4d02dd76f8a2fefacdf3a6f71e5bb097d946f09ed18536ad6d17e26eee1a1540d099e1d1f
SSDEEP 12288:QjcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:QIM3tBZPzwFa7/wOifnz20
TLSH
T1A9552381E7934BE1DF010BB551D7A3018B1D68C9A611635F6FB2203B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 83f91b9ec53070c5c728912ecc4daa8dcc2d4d3d1774bffd11d07ac87f746c80
MD5 6d23acfeeb62190954f9e06df96c805a
SHA1 8538f3163b9d2fd42aa00498b9c76b063deb071d
SHA512 314b54817121c727d3fd19c9676dedd0657d4f0f3332445d48f3f59b42a5b86fd8c7f3764ebbd7e42a14afb7f7775e2bcffa31c2261f5d274d3a9241d13e5aca
SSDEEP 12288:mdcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:mCM3tBZPzwFa7/wOifnz20
TLSH
T1CA552381E7A34BE2DF110BB551D797018B0C68C9A621635F6FB2103B6FFBD46801A5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 6f6158e635c945af9f36296f819efe022ff8ecb864225a51d19478b06b0c87c9
MD5 99e9df9be52516d9281c30ff22a64a0a
SHA1 411f1df9478c77ea9f70c4b3eb329b2420791937
SHA512 e1847895b0461e094a48baa7b87190f255c9af0a373933158a011da86f247d48f2299ca535ac2fb936f55d13344d572fb2604a6aa29e1df94d1ba5c950b561fd
SSDEEP 12288:3wcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:3hM3tBZPzwFa7/wOifnz20
TLSH
T1A7552382E7934BE1DF010B7951D7A3058B1C68C9A611635F6FB2103B6FFBD4A801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 c6c75aac291194b145b05a4c0ac80afb045fbaa6196a97534e400adbe8e4209a
MD5 003bf4b01f058022b3de9762044c3eb8
SHA1 d7d2e9eb165853e64fd24288e95ef596b39ee259
SHA512 39a87cb58211375704d8bada273cbc067239a704305b46d9d4919a6054d9ca1c10315884fb3a5f9be29180118924f3d5ef50fa04ebb5209752934187397527a4
SSDEEP 12288:5OcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:5nM3tBZPzwFa7/wOifnz20
TLSH
T1CF552382E7934BE1DF010BB951D7A3058B1C68C9A611635F6FB2103B6FF7D4A801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 80077f279961404edaf48fdcd09888540e53cd45c80615cae88a0786bc63b169
MD5 994c7cf8ea8c13afc680d72177567920
SHA1 6797eebd6db106fd6f6e3877d179ad9a7caa7716
SHA512 e1fe10d28e2b87e30ab82909d612dbaa869be5d16dc4ce13bb9a116f605bff5a78943e375a6bed37d85915006baf02e0fed910ccd3ea1b9086bd4abebdd0e7df
SSDEEP 12288:4jcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:4IM3tBZPzwFa7/wOifnz20
TLSH
T1AC552381E7934BE1DF010BB551D7A3018B1D68C9A611635F6FB2103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 da1bde7f68b56e416adfd0ce186ed7c8b0271702988f40b2bf906abcd82044d0
MD5 ad7cd1191ae7ee133195f4caccdd72f9
SHA1 aeca8c2d533154b5fcabdd4b87fadb8259031602
SHA512 c15ade9470297c9d365e1d164282dc199ade4129643d917a635c05736e81633abaf4a61b536900978e68ac3a95a5fadb77f7e1bf1e0de3d753b897938aa3de71
SSDEEP 12288:2GcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:2vM3tBZPzwFa7/wOifnz20
TLSH
T105552381E7934BE1DF014BB551D793018B1C6CC9A612635F6FB2503B6FFBD4A800A9AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 99ac69e045c034ca28b78d57f778f40a88b371d003857d1c431d52592c2c435b
MD5 0540c5d5f4394eac0ea1a4c7b766bb0d
SHA1 6c7d4f8a1c7187aae76338dce24eb71dd4f46c62
SHA512 b9a8bc626b2d15e7b0cfce727fbb25ce209b7a3be4106044f72daeb1236ba382d78a52fc09423d50f52dc3855fb37fe1383b37b26ffcdd7887b287f1a7d73e1a
SSDEEP 12288:L0cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:LlM3tBZPzwFa7/wOifnz20
TLSH
T174552381E79347E1DF010BB551D7A3018B1D68C9A611635F6FB2203B6FFBD4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 5a4946d5132929325604e927b025a7d1d4c38f7ad5185623550adcc188f4f730
MD5 60c288ce2d466b892146428c0d8ead65
SHA1 ed3152e0f9c564d8b8db5c02bcb83d7f72ed0b2a
SHA512 edeeb1d8c993b9f9330820d897fe61a640dc641df1f680d5aedbe026c0f8eedf8e41986db3b0d4e7669196e7fd2bb8c90fc41ea021cfab92658485780bfa3410
SSDEEP 12288:ErcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:EAM3tBZPzwFa7/wOifnz20
TLSH
T181552381EB934BD1DF014BB651D793018B1C6CC9A612635F6FB2503B6FF7D4A801A8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 730561ef2d413cf394e35a25f14ade4c1e190c623898648dde45e906fcc325fa
MD5 395f63bc0379bdf79dec346c9dcee128
SHA1 e831a9d168ef61cd2fffb1460b3f475a2621b198
SHA512 07db1db41d5cd1726cbef232743d1358f59cf00fa07fd166ad997aced26f630325cc75aec67a3c4be0507b5a75d6b4abf51b3b15c0efac799c339829f28015e8
SSDEEP 12288:10cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:1lM3tBZPzwFa7/wOifnz20
TLSH
T111552381E7934BE1DF010BB551D7A3018B1D68C9A611635F6FB2203B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 48f1feba2ed1c53d48213e59e14863e5459a0df9fb7db7a56ee0b63131c9a2c3
MD5 c7e4dc25c7afe6ef658b288bd623b967
SHA1 2a0a37eb7d090f7e7d1ba053a6ee541afe811c02
SHA512 99942baca8dd1e715cacbd6adfcb0c797903e7adeccf156865f87c67581d8fe2049ea55e7fc73a384a98cc839a6d878014e257051a289fb01c67aac04421b136
SSDEEP 24576:wfwvzk9RX6wkyAI7M3tBZPzwFa7/wOifnz20:jMnYI74ZPzwFI/wOifnzH
TLSH
T1A995D029EBD844E5E177923C89F3460AF6B178591B31C2CF12AA536E0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b5493d9976f91d477204b53e6f9ab0d1178d1682fb0660cb63320a10366b4a2e
MD5 35bb7111910e98569827e1cf1af871f3
SHA1 0f346aceeb3e81e10962204324bd395d22b87314
SHA512 c6ef7d4478bbc1fea21d651a3fefe3f64add5e2f7ceaee3606763b0c0058703c207966a9f0425c01d0009a95cf714196c4f292f37989937a1d0d42ca7e17e5ff
SSDEEP 49152:UYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0M4ZPzwFI/wOiD:LySzPZYtH
TLSH
T1E8067C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e37cb6296b2b8f5ee1aee2c98b6db6182a368b8964bdabebc6bac529cc39c805
MD5 d52dd92867cab3909dc900fc1b953c9f
SHA1 bafd54892ba4be60f654c1e79efc6370903c7fb9
SHA512 445e0c60dcc32fc85a0e3491f3bbe0b0717a557f037f5545065733448628c96fd4fbca514bfaad70f4ed4b2fa15efb51ed1da59518554d9e61751f285aded3e8
SSDEEP 24576:y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYeM3tBZPzwFa7/wOifnz20:y47JUQjqirIhCnDHUPfF/c4ZPzwFI/wt
TLSH
T15365AE1EA3EC02E5E1BA927885558A1AEA71742D1F31C6CF1270437D6F63ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 474c874a81fcca7190d03b4945a03c2ad3cd0e9276c7531ef132f800ae861c2c
MD5 33608a1cbc730789a692670c292778f3
SHA1 6074b81c5608a653cb10e2634bb0e995fd15ee20
SHA512 2411f93110cfd099eaffdaaef79e819f6bf43f0f3c68848c0a4e449d63eb56c4835c4a1687b51d77a11e5f47732d1e197671d96c3e418dace6ea4dcdf2d579ac
SSDEEP 12288:lpsfecM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:mXM3tBZPzwFa7/wOifnz20
TLSH
T13065F149D29402E4C66E5279C7969601F3277C6583E1E3CF57E0F03E1FB6A808DEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b6d21baf715de2c474f5fe04d6e58a9a40e8001870c79ce376df986241fac4ba
MD5 d7748451b86a128e8f9c5a1aaadaef5e
SHA1 9170b42a018d0889e99b5bc51a5194a82a4335a3
SHA512 7cedf71f636656c80b859f598356136fa469f8c428102a2332ea71cc4b2ae151b0153b794dbc2dfc5af5d462095912e411d01ee137365fc8fc2a66e3248c0545
SSDEEP 12288:NKudFU3f/EVSu22Eq2YcdNypfOQrYEILEKKXBSHwQzdLaf:NKuXUPscK2H6fVrYzLHKXBSHBBLaf
TLSH
T1F5451640762AD69FC6A940321E76D6CCA7707D41FE056F1373C8873F8476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 20f1efc4f248bcc695162de0901fdd3c0d0320c56438478d618ea9cdff435124
MD5 d645f385ec920e99a5a9276ac39cc584
SHA1 1b0c160327bb33026502af68738976117f2f1f57
SHA512 12dbfc1c059f6e5104fd8c9ef6ddd563ffa5c8b68574d00afa8a6d98c5f3ffcdd9ddfb80461894c23f2b31a158947cc49e02e1c1af692c4f7b6f6b09500d1441
SSDEEP 12288:0/r6I6JNciiSpaRDhbEM7KRX4MTLH49m9eE9jA/o8Z:0/r1AmP0cL7KRf472AXZ
TLSH
T126452A41A5B7E35FC9FE50370272C68DAB749C46BB452F0173448A3C8867A7EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 924c08ca311fc21d11266b86b878063e4ba7546ad74378acf97ad9a6ab5c953a
MD5 86d15f42335ec0f7e45b5a27017e83a0
SHA1 5f8f653b5a3420d7903087e963ebd1afa60c51ef
SHA512 311cd19d5f24c3117309d748f5eb9bbcb577b553ca8e0043ffe9b44ddbad54c27d3a758c0e812d5de60eaefe5b815a314563cb9eb628a6b926471382ab1f009d
SSDEEP 12288:3z7WcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:3fM3tBZPzwFa7/wOifnz20
TLSH
T191652342E7964AD1EF211B7410DBD211570DB8D85B10A2CF7A72103B6AF7DC6C839AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c64069dab6773677554f9abebb467f7de4142aab4a574e3b09781e5b31471f39
MD5 53e92fd7f463355e8cb983344bc515ce
SHA1 5b74dd5a8e1d62178081ac9fc7e0072f1c710218
SHA512 276bfa9e59b9148421c29eedaa5fc625ba19d56c363f83cdc7b93fdaeb8a8f51a6cc8962ea32d8827f1e951668352a85159917d565bb26097d63554330ed11c4
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYZM3tBZPzwFa7/wOifnz20:ngb4mBIBhGFe4ZPzwFI/wOifnzH
TLSH
T12965AE1E22E802F5E1F6D2B89DAB4417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 a336a45d6e357fc13f8e7d1df1e97f8124952fb7c8baf75a221a64e13f3a7556
MD5 02fe0d6c981142f44e1090621daa3f08
SHA1 b7340f16852703ee15bd7b50286792c09fe0a65e
SHA512 f438f1d88584d0e3b78753edc20d2de57964154e5dd010b72e889d405f78be43bdf815d5f015012f31e7ad10459f5a424ded1eaaaeeb1dc8e35c7c96dc7de9c0
SSDEEP 24576:BG88u8FpJqH1vzria7/mOM3tBZPzwFa7/wOifnz20:E7ZFPqVya7/B4ZPzwFI/wOifnzH
TLSH
T18895F165B7E102F1D477D13889874663F6B2B4250324FBDF07A88A661F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cec62687cee0838f5bbdc67c56ed3935fe7d41439e1789bb50da3a314459650f
MD5 377de02e8197b8e6db914786deeaccd1
SHA1 a9c5e876dfeb7864382aa43bb91770d193ac5a45
SHA512 9fbd6e22c11b3b4a47d0e12a60076561c1e47f681b9354e6a7bae70e9d7b5e84e51eedf9985b35b505a106c2fcf9f05325e2c468e0d5802ef2162af01f8b3faa
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjK4ZPzwFI/wOifnzH:yG05lO43bMYtH
TLSH
T116D5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 62d96b65860b42fa8caac75458a1778dba26fa0e4354bb2c044e1cc3666ad14a
MD5 a2eeae5a7f9ec573a2af9ae9adfa542f
SHA1 1e4e4f8f751a03513d94ec2ad33071c75228b0b8
SHA512 63c3036c72f82be2a123d1d38e4f29c01e68f8c7195ca936afa5fff308dc073caf3431ec94dac300a11ee73783432607a8543f492d73aacd081c41ed0649ea37
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnMM3tBZPzwFa7/wOifnz20:La5POZ3lJt2pasx2+mC4ZPzwFI/wOif7
TLSH
T12265BF5EA7F801D5D679D17DC583861AE5B1342153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1936b9610ec7e742790b8674ace6e359d368109edecb469c4aaecc2162f00ef0
MD5 1e5a64f9c54e2b6108dfb9c0fd01088f
SHA1 c1353d99bcb90871d0a0e63f448d73dc195aab56
SHA512 68404833c3acc76ca7b2e83f048a192553da8eefe14dfb36bd79365680a4e2d3d41e5d2331c1a724c098d11673d56e5d48347c938a28004e69b12aa5e40206d3
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkmM3tBZPzwFa7/wOifnz20:sNc/zEOVHFh4ZPzwFI/wOifnzH
TLSH
T138857B1623E901E4E6BBE1BE89779546FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ae2d0c403985c499e72db700c79acefb7116d7f9943aa9d0065bb05e58b1376d
MD5 fcabc666d2c02565dc1218104652040f
SHA1 845a9e611ca985ab3edf00446fbb9d8df282f560
SHA512 85d94de6b210873aee192d3f7136b3961ae01a2df56eded928b4f24c5f2e14e5ede5fa6e5e04db3eba7ae4b3bd843ef24906462e8a17b030bbca5b1575ecfc35
SSDEEP 24576:dzkNvNnaFeYhJNtmZBmAM3tBZPzwFa7/wOifnz20:dzMwBtOmA4ZPzwFI/wOifnzH
TLSH
T16455AF6EB6B846E4D1FAC6B58D238512EA727461073293CF5390C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 bf9ef4eb167470fafdf4048afdb39151d0d7757c592c503624edbdfdcb58255c
MD5 62f2df73f00112559e9f22d93d8a90e6
SHA1 a5a1918c904e356e29aa055a966e74e5f86a6485
SHA512 056087abe0b6d2640606833a3f462e44b2855dfb22e38f2f2a79ef2a8c8834cec62ddf8a3ef90e6655324186d06456c1cf57985e2cfc13bd1f5d39ea8a13e5f9
SSDEEP 12288:eHvUrBFrEjwaQlcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ePUr+NQaM3tBZPzwFa7/wOifnz20
TLSH
T15275F11F62E918E5E776A17D85838709E771B4621312A2CF02E1813F4F67ED8AC3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 19a8f0e83198bb0a109178b338f1189baa8cfe015de7d081823a42c94a36e3cb
MD5 2777a2c11139626fe3afae98abf38927
SHA1 556a856acc72c9ee6b22592c0b5b51a808ed8a84
SHA512 bdf5d003e9cd3560c5bd7106240f40c7d72df00aa56a904a21e3077a20d37f7ac0709021562c35882e64c69e79cdaf54f40d3f5b3bbefc3b7db430c2d87139f2
SSDEEP 24576:iD3FHshBIYQgATM3tBZPzwFa7/wOifnz20:iDVHeBIAAT4ZPzwFI/wOifnzH
TLSH
T1E085E17DE79D04E4D57AC2BCC6A38606E77138A9032266CB06D0817A1F6BEE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-78-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/432-83-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/432-310-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/432-77-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/1244-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1244-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1244-53-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/1244-279-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/1508-119-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/1508-113-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/1508-122-0x0000000140000000-0x00000001402C7000-memory.dmp

Download

memory/1828-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1828-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1828-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1828-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1892-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1892-329-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1892-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1892-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1892-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1892-106-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2776-380-0x0000017134610000-0x0000017134793000-memory.dmp

Download

memory/2776-398-0x0000017134610000-0x0000017134793000-memory.dmp

Download

memory/2812-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2812-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2812-381-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2812-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2812-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2812-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2824-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2824-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2824-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2824-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4204-76-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/4204-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4204-309-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4204-6-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/4204-319-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/4204-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4204-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4556-66-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4556-294-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4556-64-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4556-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4592-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4592-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4592-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4592-38-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/4592-51-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/4764-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4764-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4764-131-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4764-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4764-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5400-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5400-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5400-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5400-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5400-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download