252708968a41da58eefa94b258d32ed2709add7b0eefbb841d191724763870ec

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 12.7MB
Sample260822-pmmhpsfa47
SHA256 252708968a41da58eefa94b258d32ed2709add7b0eefbb841d191724763870ec
MD5 76c4d0a706c1f62d43d22c702d190a3f
SHA1 e816d9b953ebcd0582de1a98a419469cc73cceed
SHA512 13b24c9f4195f3bd5b1ba4e2496d0f669a3cf6717d41bba6a300a5ca58c551c9199261a177b33c0f96b012433efa7e62533badfeb4fabcbc69834a6904382749
SSDEEP 98304:jKMoMLZcpZE/Pn3NGNHoPy3beqBnZlmOj6EGRGNNK/zFEYDXX+MCCr:jN9p/P3NGNiyaq1ZspEUMoaIXO
TLSH
T17FD65A57EC6545E9D0EAD1308A769253BBB17C494B3023DB6B60F3242F72BE09EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4316	elevation_service.exe
5552	elevation_service.exe
124	maintenanceservice.exe
2972	OSE.EXE
5100	PerceptionSimulationService.exe
4248	perfhost.exe
3716	ReFsDedupSvc.exe
2004	SensorDataService.exe
4628	ssh-agent.exe
2948	AgentService.exe
3436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\88a8b77a209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bc17c963132dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005572bf953132dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0ddb9953132dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000afbdd953132dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7969f953132dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bc086d43132dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2984	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2984	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2984	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2984	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2984	2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2948	AgentService.exe
Token: 33	3436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeDebugPrivilege	4316	elevation_service.exe
Token: SeDebugPrivilege	5552	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 912	3436	SearchIndexer.exe	100
PID 3436 wrote to memory of 3560	3436	SearchIndexer.exe	101
PID 3436 wrote to memory of 4040	3436	SearchIndexer.exe	102
PID 3436 wrote to memory of 4044	3436	SearchIndexer.exe	103
PID 3436 wrote to memory of 4936	3436	SearchIndexer.exe	105
PID 3436 wrote to memory of 1488	3436	SearchIndexer.exe	106
PID 3436 wrote to memory of 4716	3436	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_76c4d0a706c1f62d43d22c702d190a3f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2972

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2004

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2920 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2920 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 001bc46d8c99381bb427c9e871bccb94cb5f2c579d8132108c2129840bf073e6
MD5 47927815d50188e8ee0a4ba0f4a733f5
SHA1 454c7f9ae7357962c72b6a22905988346f1f58d7
SHA512 13f8d5dde02368a69e538d426deba0730ddc7d5df18a59ff9c9299b3075a4e563b811813823d73e550ecc2c88dc56c068e26095092910f8ce49e9c9ecddc57ff
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnifXQt97yluHmtEgTlzo3:P3q6HjB3fX+MCCr
TLSH
T101D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7477395df30853dade542645eddd3631686c3bf0590edf3fb4c41ba0a132c04a
MD5 9cc4a4b815e9277ddfdd353700b2c7a3
SHA1 b8f321557a6537cdb5022032c0b9dc9ea9f95191
SHA512 2d2a648426d4e0555db09f76e17e5f04545cc092b4f15270d945a9d4586aaf4b832bd57cd12300ed46d02eccf1a9c38dbd2d39e9b3718f4f7086298609716705
SSDEEP 24576:0XYfDtczAbfXQtkImAhMlI59HQOyWEtEgTL58wo3:ztcMfXQt97yluHmtEgTlzo3
TLSH
T10005F12877A408F9ED57817CC862C911EA73BC550BA4F6DB03A49A261F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 32c95afbaaea47012dabf6566ccfe33eefbcb1de3d11c8c029c44d5a753a09c0
MD5 7c69ac0176e9deb6bcfd8f941d4b42b9
SHA1 d534014d7cd816040945d3c04273e24e28aa2bd8
SHA512 d58aae5fafe47d5cf75224bee543a222c7ae46f5df64b6583c5207340852e2413af536fda8f41842adbcb566859a034d3ba49a0115e4c983bbe03e0872f7a7e4
SSDEEP 24576:G0Le5ji0hmxirM6fXQtkImAhMlI59HQOyWEtEgTL58wo3:GPji0AcRfXQt97yluHmtEgTlzo3
TLSH
T1D6359E26F6748331D073C0B9C5D2A69EE97234861B3089CB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5212acddbea19aaac25abe0782c06cff5e14ab99de8cba4ed10eddfe52abf844
MD5 a5e6fb79bc6a7262a9d7adbfba2df0a6
SHA1 7b3bc6b53ce2c707783db4051f529e06ef31f377
SHA512 3aab68803a420459ee366d113518204aa59ee12a329d70923eeac2b72b4e2558a47a1f4633daf9e454f09cc4429b428f3f4fcbd257dfaaec8cdec55fd14b9e4b
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyucfXQtkImAhMlI59HQOyWEtEgTL58wo3:I/ezSC6vUzPvxHjyVfXQt97yluHmtEg4
TLSH
T195756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 96fb7edd78a689da6e3c95b7b9a231b66b9850950cc5f8acd6c8eb92a9f53ffb
MD5 7085b038d0b088ada07f80af3ef41c12
SHA1 4dfd181ef4631ea26523c19507d0d57de1cf9ac5
SHA512 4c819a3244dfb4efe65d2d8f3ec91858723209fddb523cba22e9c6bfba6b5c7a461531516fe608661a638674216289c583b3c2cf7790e3cfa86c622ccabbb7dd
SSDEEP 24576:BVbqPb88hv/l+6HfXQtkImAhMlI59HQOyWEtEgTL58wo3:BVO88hXl++fXQt97yluHmtEgTlzo3
TLSH
T157559E66F5748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 09ea183a08ce556cb754ae1015e4e7c8acd123bf2d704cc0aeadc1df446169b9
MD5 41c3c56fb8c9c2717e40798748516a4f
SHA1 69073ed5462e6e55f0c00fd486bfc0cf04bf64fe
SHA512 4e0d79f9cd4d13970202b5fa540db5258fc92552130cd8a6ce95bfcb90815f2ff86d50e1b9ba8853fd9a69d6b26d6f058d762f29a497d68503ea17c3058bbbae
SSDEEP 12288:FRGfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/:FRGfXQtkImAhMlI59HQOyWEtEgTL58wS
TLSH
T1E7C423A22A185082EF0305B5B136DC5595DFEF6C3E88B8E746407F0674386B2CCFBA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8012dca8e581b893291b44f07d7f217a83ada0728014f09be41a60aee37e4547
MD5 7642ef6943bc361a9a7421c707d2af99
SHA1 6da7ffbb468b1c2ac1aa0a642e494526d460c7f4
SHA512 fc5ebb1a176bf31cad25c6330777ce790d72b9a5e5687869547d623b8c96952ae97ef8a6832c1b9afc49b5a2cf1e92195846af829a00ca7fa6eb8f05a170d83a
SSDEEP 24576:HJIUffXQtkImAhMlI59HQOyWEtEgTL58wo3:HJIUffXQt97yluHmtEgTlzo3
TLSH
T1FB05CF3BAE28FCD2C67A4DB95651C600E7B2B8304F51A3CBD165830EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 68df6b2cc0a72548b168c9c12084cef149f0fd7b580e5b9fbca2ce505f033127
MD5 1bcb60aa88ffbbacab96148478462fed
SHA1 e99c07ed3b9749dfb073f440fec9ce81fc95134b
SHA512 db8293d72d071127dd1a7e3307bdf297d9895b2c4f8a254a1669c66439a2a44f8b7b80af479470648228afc018b6df1e102f566711eec388b723de68ae797edf
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:JQvGAdlCEL8c/yRNw5CsfX+MCCr
TLSH
T12C267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 037093b7ad041413557ca95e0d90442152cb7c55480a13c341a2487e264d81f9
MD5 f8e55394047a89dad2457ebf0b1f0752
SHA1 0cc295fc9997c4e81611fc1640807f982c32e183
SHA512 8fe70f4923337f00b1dd7157f3f91d98bfba5d7c96858a1121daa0f1f249f4f21959e2d0b4c88d9185d2a23cf83df68b41985802e027061592f41ad7ea2d27ad
SSDEEP 24576:gdewsAjhfXQtkImAhMlI59HQOyWEtEgTL58wo3:QljhfXQt97yluHmtEgTlzo3
TLSH
T11C15DF31FE74E032C77B0DB62B36C716546DBA200F5129C3E3A89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2c87520b26bb8f84b7907f58000e7dc0267864adffc4f2992948912c304e359c
MD5 e80129201a2290891a7d24b33cae4adf
SHA1 4c91e9612db97fcc0223ba74b05c8a3b0aeedebf
SHA512 121fa67901a6700e6aeb6e5a6e8d64035c6391022fc62bbba1313db9669d690be815cfb41e2336548b1e46ceea07891a1c452522fd59eada354c19b98a24ab26
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJfO:DUEtQevvqc2W1cpV2EI32I
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a015014676d66a19a22555459a8bedc8e16187e4d25c5cda9e54f4d9a6b69d45
MD5 0f74d40371ab7f3a52e9e65f094edbc9
SHA1 05a7460a8e9b8b86eb91caa1e1f9570f7368babb
SHA512 ec55c4c25530812703fffa5e3496097a65bb73262c4f4f79da75320d6637edd8c3a873699b3a90bcd6350669074822e3086331037aece8e263e7adf86d25101c
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zBfXQt97yluHmtEgTlzo3:ooqtVjnmgfX+MCCr
TLSH
T1DFD58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2845e6bacef2e20c6af5654b053e9e3007ea8db205e922a781ff08b5ec9fda6e
MD5 7dea31ffce4a7240ed17a2b87c4ce8d5
SHA1 80fa94cd906cd50eb8b64faaaf1330a3078ca6c7
SHA512 0f681b1077c899cafb42875d9ad6222c9258a705c3ec6791e0f303640c8b302678160fcf20010ded1d0544c02100dafc2ce8025038e025065ddba0e637e949c5
SSDEEP 24576:eAhGLJIFoiwtA5l7S53AfXQtkImAhMlI59HQOyWEtEgTL58wo3:eAMyFoiq5wfXQt97yluHmtEgTlzo3
TLSH
T19B359D81EBF955D4F5B3AAB899768570EA77BCA91E30D20F2150D20F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 85f511e14afd61ecf5b9da1abe2f0937f7d7efec3751a4fec6649bbf75ee23ca
MD5 1d3a40b421367e6bb510e03ddc1c067b
SHA1 0d2e13e7911a925556c143faf42b1b39098bad90
SHA512 5308f1f1c6913fcf04580eef860e3afdfe843aa0d10da302c916e6d986d4c0b992241db37ba1bcddcdc7a01fb4fc36f889df20a675250d9bc04221cdb68ee97e
SSDEEP 24576:LwuoOW1fXQtkImAhMlI59HQOyWEtEgTL58wo3:LwDO0fXQt97yluHmtEgTlzo3
TLSH
T1E305F04636A80CF9EA6781398557C536E7F3BC152A25DB1F0360C61B6F37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d4c56d01f9b0819d7f2fa97fe7f9863e93d3cf6e61575dc406ea4b42a6fc9cfa
MD5 83c819c5fcd7dfc013cc3694dd8d3b1a
SHA1 e7a1c33d76cad5ced66562ca7b3a67bbb1bb7380
SHA512 49df01f390eeff988aa24f2198a8f47563c3b024684fdff28adbf63fe3cb56584e9fee96f0bc0521406476678643876a6f81df5745951da81d434787cd2640d4
SSDEEP 12288:BBZ1IyxfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8E:vZuyfXQtkImAhMlI59HQOyWEtEgTL58d
TLSH
T1B6E4129637A820F6D643417DD8B18905D7B7BC6A3B75A3CF021047562F32BE24D7AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 500b3ed9be6474713664ea46332c56366661b545840e7625698ebab3332bf0a9
MD5 d964dede8d982556b702fd23c63c82c9
SHA1 2ebb3b240dfc43bf4294fb3a19fd4c779bda1053
SHA512 d44242939e7336c84d4f0ee030963e854b3773c904489fc21962c0fd0b944b4ae21357fb56e6773ae091016471089c1bd6fdc13eac5f408eb08cd728f0e1fa53
SSDEEP 98304:YQRQyi36YOcPQLvw2gAf+PN3TfX+MCCr:PQyiKayX+PNDfO
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bbd3944c999c3ee921b6633162cdaca9803121adbb6d38de8d88a8b1ccfad409
MD5 0db98c733e5c2f10d92e2769f9c91959
SHA1 922efe6c16d5e7036aa86406655ca7c86edbf7fe
SHA512 e24aabc286982c8c728738592c11f40e826bc5fa210a04997556b5abf17f1969b0d497d6825799b20087a0adaafdbf9d8693a4d1307189a3c638ee0b62560270
SSDEEP 98304:5QRQyi36YOcPQLvw2gAf+PN3TfX+MCCr:wQyiKayX+PNDfO
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d85357221a8c93dcd917adbbde1a4de12e74659efe178296f3419821fb6c94e2
MD5 2caeb26c6fbebb2d6fb3bd404c821756
SHA1 b80eafd5ad542210925f888890653bcc38fa4311
SHA512 ec35e92ebb8edeafa1d8cb2451f13df2f35036ab61682b2bfdedfbdf29d7d8b136f08fbb92aac742d789c77fd982240bedcf5c56d2449c9fe236b5957121e1ac
SSDEEP 49152:968Qg55nhheWu7PNU3/RfXQt97yluHmtEgTlzo3:7thWRc/RfX+MCCr
TLSH
T1C1B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ca065e05ce6808e27707c3d1fc6ace2636471c106b20867c185e9f6a0eac52ff
MD5 1059ae664d46f28d5598392757a06347
SHA1 9f85c1cd857b0974dec2d3345312a0ea19186120
SHA512 0b74df41c508140272114173b4b072e706b7abaa13f69c7b622fc6ee0ef85ba27694a1ee6abd2e8f81ff9485e45637cdeb2cb29d476ee9c1aa4edded68ef0f8b
SSDEEP 98304:ky5112gYy5azzVvL69nLKnhZGfX+MCCr:lLIHmWhofO
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fb7ad8058dc675df87aff1420ef79235e81d5aaa85b714b6de7a9f7915fb5edc
MD5 4048b800eab660f735807e41cdf2cc4d
SHA1 02ceb2e7c99af6db583b925b947538398f12fc7c
SHA512 d664909da3d48b553119e12707bd57bda00a48ec23ab4e89c18803e2ea096085cb00db8fa2ddee95b803fef7262342619b3d121e04520e5a8f47e27bbcb35d60
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glLfXQt97yluHmtEgTlzo3:6u6JmVxd2dLfX+MCCr
TLSH
T1F5D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e748842015be34d79b428abf3d7be85812c48ccc9b6b5b7663f49ebfa0cca0f8
MD5 7d5aa147771e5182b0bce9eed16fad67
SHA1 03b21ebb7f00e59e4ffe907fc17ca50f162a6d6a
SHA512 dc77c0996c3ecfb6bed8882f163e53d61a6112229af47e47a61ba903d3dc28723a644cfe28e9ec59b243987a86090af88dccb861a82a2c7c0efde57dd4ef05dc
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4x/fXQt97yluHmtEgTlzo3:8mifPbRgfX+MCCr
TLSH
T105B5BE13F29900E8D05ED17887569632EA62BC460B34B6DF0A90B7962F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3ab4e1b63300acdded124ce083905e3481fa0c8c799952d7a2c22ae4ad1ee051
MD5 65057f32517482c05c7f347c68b58e05
SHA1 af87491b2d300c99c6b5289bc0ba5eafca039dd3
SHA512 65d6ab7753f63514416a40672b07a3295a90bc673f7a0b8367678ef3d07146e16f95034285377cc55454248b84607e404160795d6c322ab2d2037a3b9d099651
SSDEEP 49152:VSuZQIY0Be2KRRVtOnks6NMHqyfXQt97yluHmtEgTlzo3:75dKTi61yfX+MCCr
TLSH
T104C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3c7cddd801e782e931c822842876767c9673f6dd8cf0cb924d757bbdc50e4c3e
MD5 2528d0d29e4433890e5618d55df38c35
SHA1 6e6e49d5432fa0ba25efac3723970c38d8e7ab98
SHA512 2aa799c0bdb923997f35f7fe1aa5ab183d50b6ff8a18531079422b29b3a7418541604dd51f7337604974669141f5942c0bc72e5e04606882b48e3b97cc955c25
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wbfXQt97yluHmtEgTlzo3:ZX2iyphUfX+MCCr
TLSH
T13A95BE13F2D900E8D05ED178C7568632E962BC150B38BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 380fe58a53505f3200e782b4de4ce3b2308dc7a147074a04f3d2857a3d5b1804
MD5 a4aafbbb6693f8e0bd6aad73fa0fbd61
SHA1 2ebc9e3a3cba7f4d5955d27c9875bc6edfcf148c
SHA512 08564093ae56a54a08c288ba0956d38dca91183e65822590145e9e5362cbaf8c214ec3dc32b0703a1e1fe6f031c00d6b736e2533ec9c6bc4ecc2d5e5ff6c24f2
SSDEEP 12288:P+fXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:P+fXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T1C4C423A2391D5082DF0205B5E132D854E5CFEF6D3F89B4EB66046A0279347B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e6720f78a0f5fd6de579aa9a3fdf77b0323e4e6beff029c7b4150a4af265beb0
MD5 9a5c7244265e837774ad77734c1c89bf
SHA1 5952558bef238b5d5ec7e30019293fdf2dcd33a8
SHA512 bd124d98e3a8769232f627fd908b18cc3552eb6a161e2eda0dad2675dc4556d843ddeb424e27a9b8a4df11c11b6bcef670bdadf409c08aee37e195e543e6bd7e
SSDEEP 12288:wdfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:wdfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T1DCC423A2391D4082DB0205B5E132D854D5CFEF6D3F89B4EB6604AA0275347B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5d94155caf1d986f2d9811406f530abde5a443abdfe0159858c6cfcbfe81fbb5
MD5 536c72cc58ae8919e47957dcc6f32398
SHA1 5210bcb592588efd6f5f808ae6538a545541fbec
SHA512 2964b856d51651c9a0bea84a7f5f701020bcb8762de31c71ac10bd56b70f209f6bb0392b7b888e8f211b7537fad9bfde30124dfe2b59d7890746e070397e9218
SSDEEP 12288:y3fXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:y3fXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T1BDC423A2392D5082DB0205B5E132D854D5CFEF6D3F89B4EB6604AA0179347B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b9e83ea1a501379ef01b6b720e8a5d57f3207fe3d473b58f0bdac4909a058a8b
MD5 868bf9d958fc05cee983ce85771c804a
SHA1 01cc12d2901ea116c5fb6ddd66731089ea2d1e4e
SHA512 a8d1c0f0800a9f3d88f3d68f85c6b8638fa49e77991ca35be4b6d486644ea62ce07c4a625696fde8536c645efb2d967e64547f9c9319be7a4dfc7be8cc808129
SSDEEP 12288:yVgfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/:1fXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T199D422623A2D40C2DE0381B5D532D855E2EFFEAD3F69B5EF56001A062E307A14CBAF55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8e7529942f98bf0ba2eea287c99543585c0636c732d424f70aafe4d70f64cfe2
MD5 56a2fc06e380b0a030a04e8ad4705601
SHA1 55251f0cdaa61355e65333cb5c1bbcfe5bf93bb5
SHA512 28d34f1305aef55f1f32018297c0381ebcfaac5fbd902886dde193568a9867fbfec6db8fe8496295ced8553f0148de55cf65e8268636e7229c8af2e7891d6bdd
SSDEEP 12288:BIfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:BIfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T11AC423A2391D4082DF0205B5E132D854D5CFEF6D3F89B4EB66046A0179387B24DFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c0b8938f7c616b00db6a03318ccd90d1ac7c0ba1c7d6ae96b1e24091b3f1e61e
MD5 357198c12d4f68f22acd1870055dfcc5
SHA1 cad57875f6d291ec769a8793213d0fbad90b91af
SHA512 afee8b9fd0b14b737da23660818ad3312c1d7e28bebc74899d65c1da48c136a9ad180c6cb6681925da8416caefd391918059744e5b4a0935a32ee5ede402414f
SSDEEP 12288:AZfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:AZfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T151C423A2391D4083DB0205B5E132D854D5CFEF6D3F89B4EB6604AA0275347B24DFBE9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b74de6d47163ec97a01bbddc83574b6f099794342c4551c7b6049ccefc584611
MD5 6b8fc3542242d947e5449838296f03f6
SHA1 b197e5c9cc6457cb2b7155cf70b70a9bd6916291
SHA512 79c4410179dcaf15b9671ac1288976fe638e4d004564d74b4b5bf67071f83c51524367f8c4198181475f46a119883cae0aeb897706bddffb484d55da8c802d0a
SSDEEP 12288:4lfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:4lfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T13CC423A2391D4082DF0205B5E132D854D5DFEF6D3F89B4EB6604AA0275387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5bb4d08d44e4c2517946a66661e6e6409635f886f86d7b520635c0e24f69d6f3
MD5 a70439f6bfa1b2da2d8dc15bc7db6ed3
SHA1 84ab74590cfaa437ff6dc83be8f9b78b310ce7f5
SHA512 1552bf814a2edd41aaae3d236390822dfa659f65d28a0e3fae30763697738e8cccdc1da9461c6a448646400b8aad717bd46bb7e92820518502620ba7589ba9d9
SSDEEP 24576:KZMSzFVSO9fXQtkImAhMlI59HQOyWEtEgTL58wo3:KZMSzfpfXQt97yluHmtEgTlzo3
TLSH
T13005F1A5735418F5ED53813EC9258906D6F3BC6A1B60C65F03A436266F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f93cc52966bcf8e9a4a470abd234b623034c4fd8db4691fb8b704da309ebf745
MD5 9061459d536eaad01233f8c1ced9b783
SHA1 697314458df6ecec0dbe6c02ca21910bf700feb3
SHA512 c43ca4f9455a9ad5d5f595b69250f5724b496833ab5860046d6803929b7f50e855c20b79498b10d7c8276615dc4d5c1cf8a7040ad2a72846033e0493176aebff
SSDEEP 12288:pCfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:pCfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T120C423A2392D5082DF0205B5E132D854D5CFEF6D3F89B4EB66046A0179387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8f64fbf59e3bd2fa4bd0debac013e49c9268adb9fb326d4919afaf05321a8bc6
MD5 d21b32b524d09e20aec38c00d93c7fc5
SHA1 051326900323df6b25ad654f9a7ddeac6daf3646
SHA512 4029a58edd15b25b2b0f3de1c6a4aff01d74f625bae5fa7c32d0f7cc62895b3155f72dee61a4695e4f5c8b09e3153002312bcc55e8a2a7ebafbf25354bd66ff4
SSDEEP 12288:aWfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:aWfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T142C423A2391D4082DF0205B5E132D854D5DFEF6D3F89B4EB5604AA0275387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a0abeb679bab0e62c7d9e4c4c01ae81065790c7d0cc5e338c7f1a8f5ef167aa5
MD5 39f8820381e6145665c666e18c75a2f7
SHA1 52e4228f7c89cc3b492cee97dbbdde6588ea164c
SHA512 d72dd6db91e1c1b013b4461df25cf8ed0d5feb2141bfa7b339072c47c982da38b55a1d61e565101d05720eb630a4ff7772206d220456826bf6602b9b4e06f6a8
SSDEEP 12288:QyPz5L8xfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o3:hzyxfXQtkImAhMlI59HQOyWEtEgTL58d
TLSH
T140F40157376520F9D6278238C8625901F3B6BC3A1B249AEF136047362E377A19D7FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 fe9efcd73453aa33e73ae091ddcdc3632bed1663f1190857c3d2bd4fa80c23bc
MD5 3dfef6a782d6e3667bf5750c73884b13
SHA1 a8d199ef43275230f17d62801a1454ea01bbc753
SHA512 069eeca5211b9b0e5dc5f0d35eff76344a427803b8cceff64a4b89b01ee76b8e8e797fe8bfc7bcea59776ddcd8bdfde41049d4cf70fd0aae25f55d63717546c8
SSDEEP 12288:7CfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:7CfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T19FC423A2391D5082DF0205B5E132D854D5CFEF6D3F89B4EB66046A0179387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 07cbc711b1b8efdd642ae7ca28c367250755d3cfb37242326fabf8b63f11e060
MD5 d63bb427c82fd381e50dd0a6886b84a1
SHA1 44e8b62f2598c9d23ce7f6f90a06fbc48a67b41d
SHA512 9f16a606ff7fdb70c1b93afcd2d5db1972a588160da479b644427e640f9d51b781c92f2f997fba8e3d5c3c1488e4d8221f51a0ab7db583744b5c923cdfae8341
SSDEEP 12288:+CfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:+CfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T167C423A2392D5082DF0205B5E132D854D5CFEF6D3F89B4EB66046A0179387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 8acbe47117ecd815451a3faa6db489d7c85557d78d564ffb57f4626f5b6066d3
MD5 fada3e8568aa167c86d26b2f09520280
SHA1 63db11d774dd750fca445de1f53c963f8841a423
SHA512 a5acbef3c3ec124c5afbd900d1e707391baab8eaca32598f52c698274e7c4e345c1aaaeb08726cc18fdfa23f1b06325fd737364036ef7c62e615b9a30a85ad2a
SSDEEP 12288:yyPz5L8xfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o3:vzyxfXQtkImAhMlI59HQOyWEtEgTL58d
TLSH
T1EEF40157376520F9D6278238C8625901F3B6BC3A1B249AEF136047362E377A19D7FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ea496f8c2753b20ce543d1fc6fdd021dc8fdbc53e18b5ea94d1104ea86b10d93
MD5 2f3ef2137971f990686da1bf4fcf19be
SHA1 0c842c099905d241063f95264272c2271794ed02
SHA512 52825a52424c2e7aa58c95bf116c32bae9fea9bcbb20298033e4098b9913390fcff1f008af3c3fde4cdd9b56d4168d6ca073eb7b0a3d729fac77c3df4d86139b
SSDEEP 24576:bTHaLl3z0zDnfXQtkImAhMlI59HQOyWEtEgTL58wo3:bT6LljcfXQt97yluHmtEgTlzo3
TLSH
T11205F1A5B35018F5ED57813EC9268906D2F3BC5A1B60C65F03A436266F333A11C7EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a2ec1ba8f321245a2ac78fee1f30fec66d8b74d58d13c0b23bc2804722422882
MD5 08d497a7e99c23379201c4d5e8f92d87
SHA1 c464b612311cafbfc160be33d9967225fc35eb46
SHA512 c51adf634a536eb2824d45fffc6d17b6725fc17830840bc06b33bdf585f94f15f2e1e1918d18cf9fe943c89fa20a28a4c014801585a130138188ba7df1b2a9f3
SSDEEP 24576:l37d9CHKy7GZzfXQtkImAhMlI59HQOyWEtEgTL58wo3:F7d9CHKyapfXQt97yluHmtEgTlzo3
TLSH
T15D25CF90F3E810E4F1B79A35C9768511DAB6BC591B61DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6f845d73fa660265f116d7bcbdd4d9ecb6603595f7d42e72547014bbedbbcf48
MD5 30f8f1a290d27f401fc208a3fe9543ff
SHA1 195d8ebf7aa777f7c532522b3fe304c1fef42b53
SHA512 1e5b49825feb17fd71a0f3184cc55666eb7fdf60beeb202e019d7f18b0ac333a1477526e53c54a5f00cbd1c67fa3db52b1c2fd67a9ff7c63ce4e53b09371c6c2
SSDEEP 12288:TXfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:TXfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T167C423A2392D4082DF0205B5E132D854D5CFEF6D3F88B4EB66046A0179347B24DFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4e100fc87ee68ee0eaebb8eae682a7fc1f592accf9f434e7ce470e5f10f1c623
MD5 abe18a5d9a32961496360a2ac93dd332
SHA1 e600991454fa067d76ec11e6640b187595a07d21
SHA512 bc147ad5d6d5fcc8d26b554082cfd778a7ae52deabe6ac568330d520f89906a792c299fa1141a8c673964efec7e2d97d65893787120de6175031f962589f594b
SSDEEP 12288:XRfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:XRfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T175C423A2392C4082DF0205B5A136D854D5CFEF6D3F89B4EB66446A0275387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f2faafcc2ba6303eef86116da3e37ca9aff5351b3e9b6f2e7c47905d87c6467e
MD5 f04d0d7a0952a099577593f97db6c047
SHA1 e491eb8afe1057e14956c4c9a088d52df64689ea
SHA512 a594dd69aa74463624017b9d46bb5ad8d4d276a53096ad1ce6bd6aa08abcf748e28415ad61ea4be0ad39903d190b094df1d14653e158d3c0921a10521a1e4b19
SSDEEP 12288:ekfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:ekfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T15AC423A2392D4082DF0205B5E132D854D5CFEF6D3F89B4EB66056A0179387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 74785c0b4aaf8389a6e4c9c000e63f6e6de62f2abc7485f002d42e72babbfda8
MD5 71b1218b3513e2810935f0629eadf391
SHA1 95a9f4275f733879207628e447cdec6594485646
SHA512 09c6b5705ed4e5500a33add36c4284ae5f7b8ddb15703afd3a21f80f49209964ae6f9b05439f2034f52ca038cd1ad68a91357badb23367caf7dc37882a89d090
SSDEEP 12288:CCfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:CCfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T114C423A2392D5082DF0205B5E132D854D5CFEF6D3F89B4EB66046A0179387B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c61c26dc18dc37aeebb679f4661fce4e96eb6fd0350f9c2d4ce7254d58705ccc
MD5 08df0e9833da096406c7420c7e0961bd
SHA1 9ffcd04d556d096ba0ca2e03b561003e3bffee10
SHA512 365817514c45e026e765b15e4ee259b6b0bb6c416370cc248f1f0f7aa82124caeade408be0c812d8458e9c78b4bb19cd22ffc7b3e4d0342c2e8e9c088b405320
SSDEEP 12288:KXfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:KXfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T1D7C423A2392D5082DF0205B5E132D854D5CFEF6D3F88B4EB6604AA0179347B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 cc37ef8f28a7f8a42a1b151d7a368aad27cb13c8690965aafa7e509e61d7cb09
MD5 be962cbcc715542cb4761d97dcd86500
SHA1 db00f539366eedb871c4794f7937851df2811d59
SHA512 5bb88fc4237f65d9094e2866a2c5e56a3483cdbf30ab2603628ecf9ca6c56414b5b17c47bcc3583bd676f2352fb4177d6148d69108cff2f3b06743278b740ff5
SSDEEP 12288:XqfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:XqfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T1F8C423A2391D4082DB0245B5E132D850D5CFEF6D3F89B4EB5605AA027A347B24CFBE59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 c213c2076df9293b0e5c7aa71f1b66e2af7608a7d7bc7132e5deb127322942ac
MD5 be35f381a0317c35dee5d7af7a5ecfad
SHA1 070e5a720c9620a150a12418b92fe91deeec5fae
SHA512 73670e8317a82962bbdcd4f1ff4b165e759cc8df6f80a505863b1b300d7326afbc46c9c5371f5bbc2385e81d20ba2fc065205dc94381c0ca2f7968b3ef41dadb
SSDEEP 12288:cIfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:cIfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T1E7C423A2391D4082DF0205B5E132D854D5CFEF6D3F88B4EB66446A0179387B24DFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 89e752f66976b83976f244135f7624dd88c26df50d4a5c80e79f38148bb41026
MD5 dbfb63defbe35d85c9efe37319203f73
SHA1 deb4c5c90a40df1a0b03df7f4048d27d41681094
SHA512 28ecf3684537fa9cc565739f4e4b830935319872a6169e003c8ae24d283f0f84f51d2a155235c99b8e3cb304588021fbeb8b26da65f4c4eb8fc269d4cc2658fb
SSDEEP 12288:wvfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:wvfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T125C423A6391D4082DB0205B5E132D850D5CFEF6D3F89B4EB56056A0279347B24CFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 47d396120befe73622c3e0262db2883870c7080917cf54eeff62ec4359cb2668
MD5 5501111e429bee94ad1687ef810a31e0
SHA1 dd853daf3ec459dbfa597507c9bc12ca1dfea41b
SHA512 8ff67907e58d1a175e27589089cde798c9b1508c4feca7236b1e3570ea4ea1bf1f82f0aeffff2d1853744054c06d511c5586e4ca46c68f2aecb2acabc142cb2d
SSDEEP 12288:VIfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL/y3:VIfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T100C423A2391D4082DF0205B5E132D854D5CFEF6D3F89B4EB66046A0179387B24DFBE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 7d4539981a85ae00a24a6869b4248ea5370675cfbd3dd42616f81fa06cd2fbbc
MD5 44d8a7a411e1d1be5f65891ad189cbd0
SHA1 51a1af599a170694c000b13595b4e0ec2ed9ed63
SHA512 0e590f3f99c2d2aaedf1feaf167c919b0dacd8e91cb7de8df493e10c6f269915c8cb3ac40fbfeb561a33f1638474b4d8ba7638e4275fe79529cb11add0b5dd36
SSDEEP 24576:rfwvok9RX6wkyAImfXQtkImAhMlI59HQOyWEtEgTL58wo3:NMnYImfXQt97yluHmtEgTlzo3
TLSH
T1B735D029EBDC44E1E177913C99B3860AF6B2B8691B31C6CF025A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 89ebab478815f1f58deb02916621f3cb0c1022159effc1aabb3dd14135744b9c
MD5 efad3a77dac0c57a98638a84711a8253
SHA1 378d48fdde51d61e1c398c4fd56d1b0eac4fa356
SHA512 2bcbe1763b59fc6750e69a555bb2722470278333a60cd42b77f3d380db3db2d64d20159a2db8295f3d447aaf45c01cf2e6f85102cd35b035edc2ff242f7837c2
SSDEEP 49152:QYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07fXQt97yluHm+:+ySzPzfX+MCCr
TLSH
T1A1066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 82fa8de06bf8077256cd792500bb6a17a80ee47186832814365ea0a5808511f4
MD5 2947cf53ced7ae9bb550ed1832d1956c
SHA1 8f92398bffe10af4572e07dcdbae6fba703f1eb3
SHA512 e4a4ff4e68e0f566228471b2cfee492f1d4f7d4ed58ac9003fb8e408ecfc648b64fa1aa2182babf36c28497854dc3d72a6e985b2d7ff8ea27d23c3ccd29b72d9
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYNfXQtkImAhMlI59HQOyWEtEgTL58wS:l47JUQj1irIhCnDHUPfF/LfXQt97ylud
TLSH
T10265AE1EA3EC01E5E1BA927885158A5AEA71782D1F31DACF1270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1968a1cae3766716a6a176a2fdb0f56bf138661c097513abc8d42f924819e0cc
MD5 81153887e0b4c3567dbf7e38d051dd23
SHA1 2fe4a6bec495b60fd10539d265e15f2055f54a93
SHA512 381f1a9f51ab37694df9856cb1a9f73203d33b3193644adf2148fbe8750ef0ba67229eab4840976820483f25b7197ae7ca25e17c097650c81f1aedc0ee1a4141
SSDEEP 12288:iNsfyfXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nP8:7yfXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T13DE4F15AE25801D9C51E5179C7228A40F367BD295BE1E3CB52C0F93E2F356A09DFAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a0696cb0fd5eedc229fbd92b082a815ea1cf20c83c02ec417af6ecb09ff264a6
MD5 3c3780c6247935763c5474067e65f916
SHA1 4801eb390f8c201233a14a7cdd244ac218be770a
SHA512 ae1fc2b2366bfa1e67db13dd28ad90d6a89b6777f841ebb3c6698676959e5ca094f8b2cd091bf4e6ffcf40b1dcfe0038ed1d0bfffa44204e0066aec1c88dc3da
SSDEEP 12288:36k4U3fM9ZtpkqIReQRRWVu7WX67zmKhXQsR+aREPDS97/Uu:36xUPzRexu7WqacHRbqPu9B
TLSH
T15B452840766BC75FC6A940325E72D2CCA7703D01EE056E0773C88B3F9576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 21a3602e9c7222eeebcc72179c197ffbc15637bcaa35231c4a47cd212eab81f0
MD5 b30b38e101530057ca79353917f6def9
SHA1 81ca8f37b20eedff688e4fe817a4adc7b18e5058
SHA512 3b355588a8a8090cd2d55a1554a17796cbe4eed26353edc2a951199b26d828def56165494baa1d3db013a0faf291bf26fe592aebacd17cb369dc692d43497f5a
SSDEEP 12288:8te1tJfPw82mVLye0S6Wlo1Ie51OcXyrSd4u8fY1Cg4EMGGWY:8texPwUVOWn0dZMVWY
TLSH
T19475E9C16137A38FD1FB507207265B8CA764EC06B7096F2673C8053AD86AB25A1FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 52bfa1724077412e8fa1d452f8bd4abf4652e1cc0532d1bd4a6bed8610602516
MD5 ab387969e126b502a90bb5dafc486ec7
SHA1 3026daa17603fda1578070d1e5fd2832be31cfa3
SHA512 6a27ddb38fcd03aeb7e19173973a0c939afaf215fec45ae45abd9f7456bbfc1072f1717e9c2f7112445ed235f312483b47009e81bcd9044fac65fb169e9dc0a3
SSDEEP 12288:CM7afXQtJWDG3mAhMlIeyoWuWRsOZsvuQ9wyWgZxoMx91EgTqMzNp/8A55o8nPL4:/afXQtkImAhMlI59HQOyWEtEgTL58wo3
TLSH
T171D423627B1C5482EE0605B0A13AD824A59FFF6C3F48F4E7A5006A057534BE18DFBF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6c126a7f96c5a829444fb4e498d947700c652769f9dd07b0b4971924b4551e66
MD5 c99c67a871900903228f0bcac7db1304
SHA1 c2d757b57921ce98d4270b290fde3dadf8e548f0
SHA512 feb02e2db77a8695f4930a9e7c0ea4dea117bca1c96cc209bc804f840ab03b44f176fd930fffc52bb12ca4418fdf475f18e88b9dcd4fec0a4703983f29152c98
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYcfXQtkImAhMlI59HQOyWEtEgTL58wo3:Agb4mBIBhGFNfXQt97yluHmtEgTlzo3
TLSH
T1A6659E1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 33e6907aa135c126eaef2a91fc8b0d9a3dfb169b4a75f6ca6be9a5b4c50a63b4
MD5 b1449a619e98cea4faf4ad62039c9c98
SHA1 99bd3be4add15b3dc9493a4b3f1e4c6564f6156d
SHA512 869da9c0c2dc01c8292816ab2f48b8d360cfc73c93317a4ebc1dab773e7afb0ce374eaa84cfdb4c709fa61d33cac3c76e8437136f8567932202cc6bffa8bda8b
SSDEEP 24576:5G88u8FpJqH1bzria7/m9fXQtkImAhMlI59HQOyWEtEgTL58wo3:s7ZFPqVea7/EfXQt97yluHmtEgTlzo3
TLSH
T15235F16576E401F1D477D13889428A63F6B2B8251364FBDF06A88B512F23AE14B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 848b821fedb49875868e2bf487ccc7c38eb19564d0400242525d52ecf821e5f3
MD5 d0d4e4875b189cb9eb150a8cee71ef1f
SHA1 2edb77aa5ddf05089974283ec1d757e026308785
SHA512 45cd479c5ea32a91d0ec4f631c19eea68b2287aa46d8b73fda1595efa4298fdf7e9f8d90e833b9108c2a9519692dda16ddaec5c5d717f13b49aca317ff85bf54
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZfXQt97yluHmtEgTU:qG05lO43bOfX+MCCr
TLSH
T111D5CF6A62EC11F9D1BBC17CD9C68A0BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b72711b87ae75c618ad2a8f6343740c71f1c42ccfa43ea7d4574d1b55dc9c050
MD5 9b2a1597431ee5d128b030069760c819
SHA1 72fd1855a66a7669ebe6fabf7d840c950bcc5469
SHA512 ab6b8f9bc0a71e1c5c336d8c5244bda6754a894ed45b40bcfba12ac6e0f1faf4545ee9b89950ff2ab018c1479d50c9898aa1d7dc5caca0e0acc7971c6944ff0b
SSDEEP 24576:bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn7fXQtkImAhMlI59HQOyWEtEgTL5e:Da5POZ3+Jt2pasx2+mRfXQt97yluHmtQ
TLSH
T16B65AF5EA6FC00D5D579D17DC5838A1AF5B2742513319ACB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aa6e20c665904486c7e0a44ee85799438b516d9487c4cc63260930b8380c29b1
MD5 b0f549956479b238040be61a963b47e9
SHA1 711530333c31ca0c361664c7c354188b17637f4d
SHA512 cfdb0a01a4dee617da4c36d8cf17c903d9c927502812170c3e74f2f80ac4282edff95bb483f5660d9cb05d943201a46a84e8d9841092bd03aa65d570029f5380
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkVfXQtkImAhMlI59HQOyWEtEgTL58wo3:SNc/zEOVHFkfXQt97yluHmtEgTlzo3
TLSH
T19D858C1623E901E4F5BBE1BE89779546FAB17869173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2a3114fae1b384e97b2ea9460f34ba01abac1f485c777e3da6d0a00f031a7c6b
MD5 3a7fad5f9bc0665b0f3c6420fdf8b90a
SHA1 723c3dfc84f964fd944a7edd21c59d12cc3c4a89
SHA512 91eff07907d7210050986e4d2715b188ccf90bf5c56d0f60761729a761d8198f08bbc1b4af7bfaa3823ab33071c910c61a93ed3912940ad262cc2d118f421fc0
SSDEEP 24576:E8kNvNnaFeYhJNtmZBmvfXQtkImAhMlI59HQOyWEtEgTL58wo3:E8MwBtOmvfXQt97yluHmtEgTlzo3
TLSH
T19055AF6EBAB805E4D1FAC6B4CD238512E6727861173293CB5390C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4789711788ef6e8a6fb47af9ea040c0158312a85f84299acb50cf142bd073ed4
MD5 5e17a21dd66a6971a2d114555ab14998
SHA1 afa1da396040ab3598e2e6064d0c8c82bfdfc26f
SHA512 3c90e3aa2b0d3f343f2f05e260d23898de24afde3e74e8f738447b5bacd06ef98209d4b64bf3dc79b5ea9c9b3844278ef80132da12dc0806a2aa747e0ab9ea37
SSDEEP 24576:KPUr+NQpfXQtkImAhMlI59HQOyWEtEgTL58wo3:KJQpfXQt97yluHmtEgTlzo3
TLSH
T14705F22F36AC18D5E676A17D85428619F772B8661711E2DF02D0813E5F37EE8AC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 e80d98a7c516d380e6da98e914c3917821a20b260acee07132342fa2afa988c6
MD5 219bd91bf8c1d345806910230889f3c4
SHA1 99654d5c95e07f7c5a1b4c58909ab4ee7ce43ab7
SHA512 75004f84857c0153eec2818bb60cbce14a91443fc86cb9ef01187399a624a7e85a33955acf5738ff15ec1dfc71c811238e614fa7e38aa4bb9572b9827f3abc98
SSDEEP 24576:4D3FHshBIYQgAefXQtkImAhMlI59HQOyWEtEgTL58wo3:4DVHeBIAAefXQt97yluHmtEgTlzo3
TLSH
T1DB25E17EEA5C04E4D57BC1BCD6638906E7B278AD072165DB029081B61F2BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/124-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/124-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/124-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/124-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/124-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2004-102-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2004-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2004-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2004-361-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2004-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2948-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2948-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2948-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2948-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2948-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2972-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2972-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2972-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2972-346-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2984-245-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/2984-9-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/2984-1-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/2984-0-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/2984-77-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/3436-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3436-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3436-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3436-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3716-380-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-379-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3716-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3716-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3716-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4248-84-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/4248-364-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4248-83-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4248-78-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/4316-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4316-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4628-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4628-366-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4628-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4628-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5100-360-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5100-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5100-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5100-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5552-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5552-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5552-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5552-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5552-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download