281789b5a8c45a4f199a19d1c8e9c67cdb796a6646fd249a478c65141b93b600

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
Size 3.4MB
Sample260929-wr28aa1ene
SHA256 281789b5a8c45a4f199a19d1c8e9c67cdb796a6646fd249a478c65141b93b600
MD5 b375a3869ec9140226572ba0513a134c
SHA1 34135bde8245f6996f74bcf18b180702b6b0f2dc
SHA512 348e86406b9bedb46ac9986675eb228bb8cd748b8f9521e59f9d5d72d095897a9046ec0786999c90cb9f3b34adde54458e67e9e75575fdc55579777898f615e1
SSDEEP 49152:R2AnNHSMv7BKdUj7WsyH+dcU0Qk2jhFd8sPV/lew23KS9OWlTPrhBJZhbww6z77g:R2AnEMv7B52HiCqXBFD0OWjBtfd
TLSH
T129F5AEA2E6A401E9D5B7C23CC5464213E7F1B925133097DB1BB49A7A1F23AE56F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2580	elevation_service.exe
4808	elevation_service.exe
2840	maintenanceservice.exe
5216	OSE.EXE
820	PerceptionSimulationService.exe
1028	perfhost.exe
1416	ReFsDedupSvc.exe
1576	SensorDataService.exe
4860	ssh-agent.exe
5816	AgentService.exe
4064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
	\??\F:\	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a68721fc3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a80ae113e50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000648e92d33d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca584bd43d50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000014bc9ad43d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c31de8113e50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d02bead33d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5052	2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5816	AgentService.exe
Token: 33	4064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeBackupPrivilege	1416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1416	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2580	elevation_service.exe
Token: SeDebugPrivilege	4808	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1432	4064	SearchIndexer.exe	101
PID 4064 wrote to memory of 2136	4064	SearchIndexer.exe	102
PID 4064 wrote to memory of 2932	4064	SearchIndexer.exe	103
PID 4064 wrote to memory of 4820	4064	SearchIndexer.exe	104
PID 4064 wrote to memory of 1588	4064	SearchIndexer.exe	106
PID 4064 wrote to memory of 924	4064	SearchIndexer.exe	107
PID 4064 wrote to memory of 4848	4064	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_b375a3869ec9140226572ba0513a134c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2840

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:820

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1028

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fd391cfc8ac739d5392bc27bde39045a13048f25a4246fc5c2a0c95a1f7fc98c
MD5 908a80c4831728882519ddf122278c2f
SHA1 9cf32dac319bddc6eb110c90fec934f1dee8f934
SHA512 77ece874e7962abd98125202b3d99f9b5bd802a3a054017433273cbccc3a66912a4f5cb93d628fbe51778ccd5fe96761af6cb041449c21ed8b2805212564c479
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnIJZhbww6z776rP:63q6sjBNtfd
TLSH
T1C8D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 39f997040d69458fc28d595795add7dda59b9375f4846da20384efc634448d82
MD5 f6244b57fb05895b69651e51fbf8c5c1
SHA1 dc1d33c37fb583dcad8b6ee0e7bbe5c9d6456b31
SHA512 ad91a7b5233802568da98e00d8171c4891c3586854e8ec8e20be46d634ac05b5e08ec45efaae39cc0d3222f201757a7543d33010bb722445244a11d0de270b32
SSDEEP 24576:TXYfDtczAIhkJZXYGbwinaJK5mlz776UfiP:2tcmJZhbww6z776rP
TLSH
T19705F12877D808F5DD6B823CC8A28111E673BC9547A0E69B03E4AA751F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b11cb5b5b0090545c1b6a54f57e2d02c6f9e3484c4c1e1e1e268fe45d899fd14
MD5 f944ac73de684418efdf7be22d354af4
SHA1 a6b0f2b39d131a7184be3165f02a5ed63f40db5e
SHA512 6c3603258e3afa80ff48c429c29099674a4f27fc62757febab0cd129aaaf341f77763248c745cab42251d00bd42e331e8f88f6c88ae14513b4a5f8fe321dfe90
SSDEEP 24576:40Le5ji0hmxxrMthkJZXYGbwinaJK5mlz776UfiP:4Pji0AjTJZhbww6z776rP
TLSH
T1DB359E16F6788731D073C0B9C5D2A69AE9723086573089CB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 15570b601251ea01082fa5d222fca6a6ae06268c21471d04f266ee9d108495e0
MD5 d4d2b310e27b1636f1498449d2a547b5
SHA1 b8f0c33681c11029c626dbe5558b3e9c9e6f8bb5
SHA512 fbc1b48c0b301bb1be06a666befa68c73709d2c5eea9234881e71be758035b88ae4c8ac519c6fc84224e75949a7e0cea54abafe5e85bca705ccc03c7746a5705
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyunhkJZXYGbwinaJK5mlz776UfiP:U/ezSC6vUzPveHjyPJZhbww6z776rP
TLSH
T1D5756D15F5788323D0B2D0BAC5D6AA99FE7230865B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ebcaaa81e7daddfc8825f70a39ce74f1d801b7c46d3a29788963417462649df1
MD5 b8a792976f1d899148d0bf7b411cc3ef
SHA1 953204ce6b5a73def6425ff77ba7283fe6aa949f
SHA512 0d42f82b103f57494303cb0c796303c35ebc399e0f23e410e07b35ab3d06acd30b2718a5fa647c47ff384cf323fd3c5668dc1a3c70a2d20c3680b9184f7765cb
SSDEEP 24576:2VbqPb88hv/l+YEhkJZXYGbwinaJK5mlz776UfiP:2VO88hXl+uJZhbww6z776rP
TLSH
T1BD559E66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fa95255e8749610a24556c75f82d2ee6abb1ec1a5e37988d9edc3fbee8cd47a4
MD5 918740af9bcf63e3654e2a6c958a4426
SHA1 b1089ad502e126fba4ff5e9fa70713eb5383e9b5
SHA512 c3a22e9e0bac0ad860c8cb877d45dcb062d34085c4e889c1092f7d5f7d3ed3b061a58233c52830edd186572e21203c17921490de3548d170f8179b546e91d9d9
SSDEEP 12288:3LXZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:3LphkJZXYGbwinaJK5mlz776UfiP
TLSH
T1D3C423599B8CBCC2C72FE639787681B5B073DEC5F4C5742995A037B50ABCA62E21C072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 06b550684827bee33f3276875eeb0e951c2ebca0bf9166f3d653566f1d38004a
MD5 e0163c35aa068e41e0afdf08a22e0a27
SHA1 d530d37261ed3d5127726b4aef33d753b0d08eed
SHA512 bf9af83f2a51efda10661f5a74f03970c7a0207b6a75cb9bae84e542b2420c798fbbe27284ade66588d8d5bbf2e47ea412dced8a73c00ddc6a9b1c4f05420dac
SSDEEP 12288:JeBNUbTVO86UiZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/Ufih:JJIU8hkJZXYGbwinaJK5mlz776UfiP
TLSH
T13905CF3BEE28FCD2C27E9DB95A91C240E77278704B51A3CBD164830E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ea355a7a1f3627bfadaf26e91f3434eff6f0a78d0d2464f0e9d44ca672dd9119
MD5 6f1fb12c4d4b4459ee979f3928ef9717
SHA1 6acd7ff5a43d6b43478f40a4bc40982cc2d264b0
SHA512 5df91aba1c5df79c54fc69f9011a5ef88ecce5c2d0ac6f287fab963bc1f60882026fd383242af1987b8447fdc7525637829f3990e84fec7a84df0e79493f2c4b
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:EQvGAdlCEL8c/DRNw5CGtfd
TLSH
T1B7267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 25292247abc053a513b19bc518189632f4bf1a120383cf53ad75b4e042c392d1
MD5 d09d7dde356bb40eefc662a08b127994
SHA1 d226ea09de158ef87cfc7230cedb30c9c8251e6d
SHA512 6028aef188ae85b398d6338c78c63116792940a7c931410cda7c426db60cbd972f03f128f8f49a47f0eb44f3bad3a7123c45efd73ad3ab49116ea5a7114fd416
SSDEEP 24576:60ewsAjmhkJZXYGbwinaJK5mlz776UfiP:bljDJZhbww6z776rP
TLSH
T14815E031FE78E432C37F0DB61B36C316143DBA604B9129C3E3A85A9D59742D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e669cc48303efc31a0626ed666432c9668805eae3024f9afd9d6386fb7d14cba
MD5 341f0371f813511585462acbc0fc479c
SHA1 310ec2507727bbcd8761bd5e266f5143a34f487e
SHA512 89fafc70f314f29fa4b3438c340c6b25d142a155b1180f00444f459079230ec196b4682894e79f3dd34de442788e874e8d7afa16802e0ef69c70a9ddcfb4b8e1
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbBd:ZUEtQevvqc2W1cpV2tI32/
TLSH
T1A7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 af0eb80da39d218cfd97e1d969c8a4a61e26dc67f4d3e6304e6f22a5db31481f
MD5 a921fdac493671648e3d7e511f6aa31b
SHA1 c3a2f1727892ce4a921c4e902d0304fad04c819d
SHA512 d7e50de4e78ed48dcdeddb851f5fefa8ff559a752b9ed41560840457e29acb63791015ae41cd0a5d024393fb35e1e9baa6d6d3bd087b1ab80a9897b1283b9206
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zjJZhbww6z776rP:ZoqtVjnmStfd
TLSH
T1C8D58D0976BCC2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f3a583b868833154fc286471b2ecc61441b83d4d269b9857f3deb877d305007c
MD5 71ccc3071ceca80ba3a01d50cf5c1041
SHA1 ca72bb584c71a7444e2a1cd6e1547a5453814274
SHA512 f8a001e7fa3aaac080ba6964f95c25ec4677b480e838b431df88d9268b91ba4d77ff000cd3eedfeed4e176857239e97417b19ed0639458fba52f6f3d0aa405e8
SSDEEP 24576:jAhGL3IFoiwtA5l7S53rhkJZXYGbwinaJK5mlz776UfiP:jAMUFoiq5CJZhbww6z776rP
TLSH
T13735AD81E7F955D4F5B3AA7899B68170EA76BCA65E31D20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e8acdb0fdef24990c5d3cf36d28f4f176a962919139b7c3247be97a8b65f8ce3
MD5 19d1aa5b189357fc6616244aa92d582a
SHA1 b41345c876c2793f375a9002c8108199a5e97fd0
SHA512 c4a2922f0ccb8493e4245818c4cd174b2d03df36b2be803da56644770492f01988ae79f9c20af7ec4a81c0484a374f571c856af8b65fe6c441b7ccff5c769bf2
SSDEEP 24576:2wu4OW6hkJZXYGbwinaJK5mlz776UfiP:2wvO+JZhbww6z776rP
TLSH
T14805F14A77A81CF5EA6B92388557C136F7B2BC422A61D71F0760C66B1F37321AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ad4003625fc7f1836da8d6efc9bacc51279fc6d5e69f42998b443f5f30305a80
MD5 41f832d4d1b75f515312a6985d3c7348
SHA1 2415311557c691bc0a3ab73685b966871cdad626
SHA512 0e445a5165947f0879a2a1806043f600ab0c5bc54b8dd41dac30b4a88a9a45acbca6d72285e94d4bf68265a7cda830b8ff83b443eb2d8902c6382774a36c328d
SSDEEP 12288:JeZ1IyAZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:sZuFhkJZXYGbwinaJK5mlz776UfiP
TLSH
T165E4125923DC74F1D26B923C98F18255E372BCD663B553CF126022A91F76AD29E38332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0c21842359b3136cf48afb5f289076a4b7d9f15c5dde7f897700bb9ef64c1c2
MD5 7129d968612b56f1f9d2c1cb1d30d100
SHA1 a3c72d60204c5a22a4a1bf876d7a09793fe09390
SHA512 d0faa2ab6849522371e9a1eb067710cf59fc420be57222fa86549d40bf7db33ff69ba1cef3fe9f4b0a96b39a596ffb1357352b56efca0970d20135a3f57abdbb
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UJ:9QRQyi36YOcPbLvw2gAf+PN3xtfd
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 459e1379e54250a48275780de6d1b0aa20f06342011fda22b9dca049b4b3a7b1
MD5 2875d13198f59672e4a3fbc163b37ee0
SHA1 52ed9c93a6eb12a00c4c33def20461ea7008c76b
SHA512 5bc1f6e0a8fba20fb447b645913d204d7ad8bbbfa2ba82337f9111850f15636e71c9bfb4cf5d29ed14aed35380e22554da3401b3cf5af017b4e1fcacab74da38
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UJ:CQRQyi36YOcPbLvw2gAf+PN3xtfd
TLSH
T17E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0629e14c75dc020271e6fef0a41585167cdf02aecd732fd930c32fa8074ba728
MD5 4a17477a020807e4e515e6eb834a67db
SHA1 d0fff20c844afc9ed3a3c823fd89c744f0be670b
SHA512 90a42533262952d2779bb3025e22fa63c59b41bf803625ae27d2e1b97de7b2e012d575fa85ab11aac1b66fc18970b870b19508201282148688c0384656975bfa
SSDEEP 49152:I68Qg55nhceWu7PNU3/TJZhbww6z776rP:SthLRc/Ttfd
TLSH
T18AB54933B2F60099C44DE1769F4A873196E27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 727e05732508ec0636abbf04b6f5ba372c29aaa4694faecea3ee72eaf9be216e
MD5 7daa01c5c0f75f09944e602a3dd79967
SHA1 34520983d44c39290374deaf0934b379b4f9cddd
SHA512 9055ad0f8991aabd9c9486d355dcc06dee6c711d9ab22c0defc33d5bf3eff66333e2e3a8439671e2a136389afa8c697a1cba56c051bf8887725aff22f85cea20
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99v:Sy5112gYy5azzVvt69nLKnhZktfd
TLSH
T194167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f74e8419a8579578cd9cd15009471b499c76f7c8faaeed83276b62771b5cd634
MD5 37d4f760f2d9145e06299bb1cee95ce0
SHA1 777a071d5754aee09609de9c6c4faf094f1a8ea3
SHA512 dfaf5bca84ae407f53b68104069d1ece05ae78637a91c4ddad06da903fbda9706534716a69b1b309e61bf96f890a21655cef1a5ad1835f26c8a852e4c48caf6e
SSDEEP 49152:yB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glZJZhbww6z776rP:Au6Jmdxd2dZtfd
TLSH
T143D59D13F1D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 95c8be31faf4f9b7f790d51a8853e98bdfa275f83376e66a2b1451475bc405a4
MD5 842f848e90c35097f1d11c5df5d06305
SHA1 b78b0b6be83600ee412ffdf06c3161736cb6c74a
SHA512 45cfd425e5ea6053974a0fecb25178cbd7475544ad8f77f2c97b92832182c49d2cb60718f41cc0b7e403fb85192501cd15e96bf75d8192426eaac70060ea541e
SSDEEP 49152:/1hpsNoJpF1A63U44CwH7R4xFJZhbww6z776rP:/mifPWRStfd
TLSH
T1E5B5AE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c84d6a722a59184e816beada276b0513d3ee6fe270aa2dbccdcfc2347613e411
MD5 37b39fab5a159ab0126cd8daa9130aa4
SHA1 e8dbc70d2f7f9e422553e43978e4b82609fe47d0
SHA512 ff350a036fc5740864d776b2706823683e057d8ceef4691e4185bfb42025cd72cb296c105d3344d708a2cfca69a939080ec86bb4dd73468c4af73addda574f56
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHq4JZhbww6z776rP:A5dKii614tfd
TLSH
T168C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9d0bc0974ff31ab6e999fa4bbf6cb1917539007f02f52268ad6b52e0773b380
MD5 c661b939b70f5703243102174b5e3a66
SHA1 006803ef03dfc1df2888a12e4c9a0bfc2ee39280
SHA512 8661d4b1a6b23947992b456bf4d3fad7ea094d554c762928c7282bf5854fdf4f49da4f7014214786906decf6dd8002da87285140ab58ff4297864297b955ff35
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wJJZhbww6z776rP:aX2imphetfd
TLSH
T12F95BE13F2D900E8D05ED178C7568632E962BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b4eefdd86cfecb7781486c8949f0f44d1f5757b3f363380499244c36695cd3d1
MD5 573bd54c8bcf68c57fe98ee84424ff88
SHA1 47889f5d5ec04c428113a9b4d3c54e314b1a2303
SHA512 be7a9581db1d9f30839531942433602fd3f15f474b5e07f9df8c8db1d29e25b63bcd055ca82ff14517bdc3d3ee9ecaff384960bb21e26ab017eb8cf64d6f4a44
SSDEEP 12288:/EpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:/chkJZXYGbwinaJK5mlz776UfiP
TLSH
T1E7C4234DAACCFCC2C21FE279686681A5B076DECBF5C53079665032611BBCB66E11C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8955d7d18b1f89ccb88191ec66630e3c9d4cee5eafd6d74942ca7c00f61f07c9
MD5 b2fe0caad2bf0879a5d33f92255a56e8
SHA1 092790f34b9429f2ed1b5f5317b64a9c1d67e38f
SHA512 7cb58ec6965a98c852fa45be3dde4cb74ecddcd27d0c5d42c33740ca1a11cb98911b909893fbf9cb83c7ae988381c2a685891e9a48fa07eefa5c7ebe9ae7bd4b
SSDEEP 12288:nDpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:njhkJZXYGbwinaJK5mlz776UfiP
TLSH
T113C4235DAADCBCC2C31FE179696681B9B072DECBF5C530796690326117BCB66E20C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9c491af26c9853001d780828c72775b9fa3c7a89c1514df82e5c6aabe1591efb
MD5 44ce8b1d415cf6adf09e0f33e7f6d0fc
SHA1 0b819466e7c3cacd33355a298b6cb5f68feec41a
SHA512 560ebed9b75c0dc4bfc6a90cb103ebee575a249fbb1f2a5ae682d40704ce099c6f579b29bc876a4b1220ba231e77bcca24cdca50a48d3029e374c15e2aa06e9e
SSDEEP 12288:KlpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:KNhkJZXYGbwinaJK5mlz776UfiP
TLSH
T17FC4235DAA9CFCC2C21FE17D692681B5B072DECBF5C53079A69032641BBCB65E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6d6fc8094ea192f0f15c76a76aeab5efd2ab23cb2ea02676c3d69da9d50f826c
MD5 7db1a1388a6762641063e9b289d2fd2e
SHA1 85eaa77f2800d822519b45b4a40361d0c4207201
SHA512 0e75fbc70efdabcafbcb4f852e71d34a6654d0365a648cdbacd80dd8ad7d64cb84ddf1e7fa25a9db1e713c72cd666db127c619dfd4c301bd6b2fa6a2fdf26300
SSDEEP 12288:6VmpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:jhkJZXYGbwinaJK5mlz776UfiP
TLSH
T114D4234967DCB8C2C52FE27C98728165F0B2FDC6F2A171AF965036650FB8B90E138671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 38e1754180645b9c5be36a95fc7effb415aa0a1dbedd2f5d51ea40b92b2d5b6f
MD5 68ab72dbdecbde4feb444f6e2d3b27ff
SHA1 5f7d39cd7cb7ba7deb9c4796d77bce5d6eff2c9e
SHA512 e437cb1ab0b2c3bfaec86c72de716e6dcd6fa9c2a6ce5f68e1f6b607b084bccdae38d1c466f78c42f1670d2a4b6865150b63dc9163e290dae69b6fcfd47f70c4
SSDEEP 12288:FupZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:F+hkJZXYGbwinaJK5mlz776UfiP
TLSH
T15FC4235DAADCBCC2C21FE179696681B9B072DECBF5C53079669032701BBCB65E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 15ce37f20971e630463ec259d77c32bebde57bd0996a0d744d52bddc1de5184e
MD5 62e0d9630f0da7212b008394a22251f3
SHA1 55cec2b05037347c4579e81d5340a999ac1b5dba
SHA512 2c94bdd6e29fb8bd6e3e53322112e62e2b996fe35c4c0835aa48d48985b4c472aae57d19aa2f9286c93def287bd4023508ba9b974994cbce249ad1399622d618
SSDEEP 12288:xXpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:xvhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1BCC4235DAADCBCC2C32FE179696681B9B072DECBF5C530796690326117BCB61E21C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f38751bd94318ce26905155f3b441533863e6a02d6f78143e134ae48e9c3dbf6
MD5 8a2349c58dc979dd6bd9b891c93e2647
SHA1 cb009a7b20c1f52221cf0c3675430b2f418c73cd
SHA512 061264f097bbbc5bed42ca37f40a226797cd74064f85e496c1718b711eac2df150b55121c7d13e76b3609493870a9c5841b4c164a8126946e5a5de640fc38a2e
SSDEEP 12288:gLpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:gbhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1A0C4235DAACCBCC2C32FD27D692681B9B072DECBF5C53079A690326117BCA65E10C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 bb45e3b9e6b103435f2c6f2c24371ebe8a292fc36cb1d75936ed6e664c6fa62a
MD5 5a29e2360544d04201f29071e02a6502
SHA1 620bbfa6d62ad0debca790851ee4c1276cf04d67
SHA512 ef8afcd3b4ac2e1819fff752795485b55827e86aac6af46bc362841c49f3df4ef503fa558dfcd951516c7d2c092fc7b66245e0a7494d49eb60e97d1579b3b389
SSDEEP 24576:4ZMRzFVSODhkJZXYGbwinaJK5mlz776UfiP:4ZMRzfeJZhbww6z776rP
TLSH
T147050299B3941CF0DC6B813ECC258916E1B2BC9A57A0C61F03E436661F733A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f42bb14ee201646939adb00a34c4f777de91b80deaa4006f75e0d528868e3656
MD5 dfb0d0d39ea69296b2db2d76dbce148b
SHA1 fada1c91c94caf78994fd17033e9b84afcbc0252
SHA512 ec027200df3a45bbd0f90d98decd7618179f12c7c46fef39c2763eb678252456e48cbf2128a29866979aac4abd7efba307e35d63f4d85db999c2e136737f7acb
SSDEEP 12288:uApZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:uAhkJZXYGbwinaJK5mlz776UfiP
TLSH
T17FC4235DAADCBCC2C32FD17D652681B9B076DECBF1C53069A69032641BBCA65E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 aa630bf4d2a63151eabe576107a721b8d3c8b95cb9c0346eede2bc010403665a
MD5 005f0a169c0b863b9b97b774834d24a8
SHA1 fe7b111afe7bafdb19435344e6178cbffb7cc0ab
SHA512 910e83266aa640e53ba10b13a5cef3296d0684166dbee3b350b28e15f95ba3e63ec636e3ad6c4fc65745bb28ee7f9f01f032f98ad5faf5b179356daeb716a270
SSDEEP 12288:NcpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:NkhkJZXYGbwinaJK5mlz776UfiP
TLSH
T16DC4235DAACCBCC2C32FD27C696681B9B076DECBF1C53069A650326517BCB66E20C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 11f5e67326ec6b3447feb67e51c901efcdf74fd36420ce645066d77270db59c5
MD5 54c90d3edd05e919fc2e1602fd6e28cb
SHA1 e31faf091e139394c02ed35975c5f1c044d74011
SHA512 ec8cf76bcb75d7df9b0b23f17526fe1e05e00b0084a29c4e3bdb8c29581fe3878aaa0e1e247beaa3e2c195e28ac52f1f085e33b1e4acb5c45d44449f3bf2d32d
SSDEEP 12288:9yPz5L8PpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:0zy3hkJZXYGbwinaJK5mlz776UfiP
TLSH
T1C1F4020B77A830F5D13B923888620612F372BC7657609AAF17A017761F776A19E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b72e4191f4a25a512a47dac4ae61123dee16115c90c9aa06c2a0a80eef429617
MD5 a1d4c4d06f57489c393979d127a60844
SHA1 201fac18414f35bbb0563ff3c817906a629c5a1c
SHA512 f1c15fa01d3592043f7ae82cf1063470be6185de2a51ece0da40e339895f5bda0bbf28961e13cd6b60f5326b3813baebe75489ac712a695657c43c4632852cca
SSDEEP 12288:jApZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:jAhkJZXYGbwinaJK5mlz776UfiP
TLSH
T118C4235DAADCBCC2C32FD17D692681B9B076DECBF1C53069A69032641BBCA65E21C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 24d1797365273bebe4b03b0181d1619191ee3cda0c6bc58ecb5417ac87b15bc4
MD5 d7be5bd5e90a9d2603894b646a8b7917
SHA1 3ff7c11d2a501a4dee21a1a6883799d671e80a7c
SHA512 92428303ea1b1df389fb5c3a3417c9aa68524ca978491c9bf3c36dee2ee977981e9e9cbc7a690872f3cd9ac55a7053d98d6b8c7b699b719b7e7e08ec05215126
SSDEEP 12288:nApZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:nAhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1FDC4235DAADCBCC2C32FD17D692681B9B076DECBF1C53069A65032741BBCA65E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2467889a987d70b15abba02fce92dc35aa352655b3ef84c64a6e055aa2f27c4b
MD5 2e4b7a9c4ef62853f4e7c8d655733262
SHA1 c6f3cc4267145d8a85ace6225277d849e0df4734
SHA512 4b55d6f736a8e08d9ee13e230df93bcbb2bf23290a151eba2a87546e20c08b2ff61c87b40fbc67b6239d46cab8c44d3d74ed6904aa7223c387ac29544cd5cc25
SSDEEP 12288:yyPz5L8PpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:vzy3hkJZXYGbwinaJK5mlz776UfiP
TLSH
T134F4020B77A830F5D13B923888620612F372BC7657609AAF17A017761F776A19E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 325f2c4c78a0ba88a5a75061b260b1417d573f227df066da52c8ba63a35f6c62
MD5 0922af72168b5c731961f08a18f8ecd1
SHA1 58eb2006224505599a9f79563ebea5b7a0f9530d
SHA512 28d9f1ce323ddd7468b4a9fc7cdf9346ad9149af2be948cb2d81e0d84e2b1558287b3d30a217e6db9902acd9b1f6da2233469232b39db3ad47794f6ff5cde4c7
SSDEEP 24576:dTDaLl3z0zDdhkJZXYGbwinaJK5mlz776UfiP:dTuLlj3JZhbww6z776rP
TLSH
T135050198B3946CF4DC6B813ECC268516D1B2BC9A47A0C61F03E436661F373A15D2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8994fefc3256343bf5e598f15fd39ca65e5aafae4ac12cc1457e440fc42fff4f
MD5 c3a05cd5896830b7445db66211b4225a
SHA1 4c8071e40ba1b336fabd334ba18eebb644ccbd7a
SHA512 056f7208609d9d042f75555f6845618732ff46606e907b314f16d33be58199af69f99bc4135c971083a15cf247a602558d44b401922f28c8f753adb4ba7d8dc8
SSDEEP 24576:Y3vd9CHKy7GZJhkJZXYGbwinaJK5mlz776UfiP:ivd9CHKyaeJZhbww6z776rP
TLSH
T12825CF90F3E814E4F1B7DA358D764511DAB67C9A1B61DA8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0f28674bdf620ce2091a20f75a8d57d7e23907eb31a3afdf6e9b2d6218a80cd6
MD5 8e6cbb8abd04bc3ca5b734df557e39cb
SHA1 de536b074b24888113b94101c207c69a276d3bc6
SHA512 072f5634abcf6d15802abc550d4151011ebaa8cbd430799111372718a71afebe8d2a4a33c9e26b72ba03b05017fa77170582646607ab3dc11126bd9e0f7eb72b
SSDEEP 12288:6FpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:6thkJZXYGbwinaJK5mlz776UfiP
TLSH
T1AAC4235DAA9CBCC2C31FE27D692681B5B072DECBF5C53079669032641BBCA65E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 1f19351919a8760c76f3eac56b969eda5247a2d7ed3a692ee5316ac83b5b900b
MD5 4cfc5ebbac9e977dddb882d3e9503e56
SHA1 e65e5f2012c5bf3646e1f7c00f96855f260cd84b
SHA512 7979d9c306153ccbc06d29ebe19577f910fb8167828bc1a37c71358f38b302b62ae6b72a8c1a6797f6baafbe741bc0019fb8b81b96a173b73e1ee0a805158e4d
SSDEEP 12288:OvpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:OXhkJZXYGbwinaJK5mlz776UfiP
TLSH
T10FC4235DAADCBCC2C22FE27D697681B5B072DECBF5C53079669032211BBCA62E11C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 4fbed6f64c6e28c2895be46960044d5e23726b044e466f1f29c427cb1ab97809
MD5 5610c6645b734b2d3cfdbc545db8647b
SHA1 a4806eef93b50e4ac2d6d96ecf650f913c545e9d
SHA512 20aea0b7a8b10a750cd5baf0fdf534854b7a1a5e72aa50cdf227d60028257d5a497f27283a4c0c22a12d5a8f5631a82e13ea05c078a37e67132aa91c3ff4ddd1
SSDEEP 12288:hipZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:hKhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1FDC4235DAADCBCC2C32FD17D692681B9B072DECBF1C53079A69032641BBCA65E21C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 568ef9c396e6d1d30967fa77f786811923f0ea317cc55924668dec48d4407200
MD5 7d9aa9d5fff65e2d525f160d23b77b77
SHA1 f3c4c19934c8f5b7274524eae7e9909f553c0a25
SHA512 07b44b497257d3b10c2356a7c1410236b7a089be4b079cc5b16d18f37abfb4a9c5b1d3b605bd7890932699e7f166a5fc4e960f06e17f7d443213e214e7cccf5a
SSDEEP 12288:0ApZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:0AhkJZXYGbwinaJK5mlz776UfiP
TLSH
T146C4235DAADCBCC2C32FD17D652681B9B076DECBF1C53079A69032641BBCA65E21C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c706139dcea5af309f3aa2fdaa07077d42aa023f13320c7d0de5255dc7d443a3
MD5 ac2656bb5e4f05dcfcaef551d1afedc0
SHA1 207f65363314fca6df4d9c6a01b925a9506da882
SHA512 4753f59308e4caecee04612d09d4fa5a29d3204d29c419e427c08f591f7db018686b88897a4099449dbb3ff57d9d36eea1eadb2838916ca39dc66cbf4768023f
SSDEEP 12288:mFpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:mthkJZXYGbwinaJK5mlz776UfiP
TLSH
T11EC4235DAA9CFCC2C21FE27D692681B5B072DECBF5C53079669032351BBCA65E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0976178fe7e7c6e29411432d4ad59203112a3ece604eb8949ddc55e810ce3b3d
MD5 39c22c03368b39075a253e5f188e5e10
SHA1 c6f0bf67f27f641c94b9438562eb0d02c5f850e9
SHA512 9289938aa46daea6220e7336e2a76081d2b017c547b3f49828cc3f05c5e5544d093c8538c90ecef8943bd6a1c1c8185f5220bd69080ed04c684f864978b4c302
SSDEEP 12288:/IpZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:/YhkJZXYGbwinaJK5mlz776UfiP
TLSH
T173C4235DAACCBCC2C32FD27D696681B5B076DECBF1C63079A65032651BBCA66E10C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 b5ca529bfc16f897ee519b73cf20d48fef62625abf5f404d96dff2a4ff3fb9d4
MD5 a1745205785c19f01fe2af173d30d42b
SHA1 a15e8679f493471cbcb79156f8bc3ffb98e01bab
SHA512 7b46e56e93bfaa5426b1ee46c610f2139c89f5afc611b2741c502dca4c608fdbbe1cdddc93de68f21b392ac93df8966ebe117e9db2dc3efdea3bc4669323f6be
SSDEEP 12288:EupZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:E+hkJZXYGbwinaJK5mlz776UfiP
TLSH
T143C4235DAA9CFCC2C21FE179696681B9B072DECBF5C53079669032341BBCB65E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6644c08bf343f0f3eac3657959b57e27c4554eb98c505af5013c5406515ff7f9
MD5 d025f3ad5f0173ee60224a5ec16e3642
SHA1 46780ba597eec57094cac10c71edbd717ccae296
SHA512 182d26a4fee149d1801670c9fae453434396172a6267f258c7cf23f5ce8d21432a2a9226360b796d95c4ca9680cd58618a2c270b67f92838b10232fb5b29ae18
SSDEEP 24576:JfwvUk9RX6wkyAIJhkJZXYGbwinaJK5mlz776UfiP:DMnYIEJZhbww6z776rP
TLSH
T10835D029EBDC48E1E177923C99B7460AF2B178591B71C2CF029A536D0E37ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eac761a3638a6d433c0dc9193661d91adf02f71b8a51ff4bdf3e611ec3f0d5e6
MD5 69d2460c30134933979322f5723c5acc
SHA1 6fc9a31388a58755d8f0aaf8ae91dfa722fe72a5
SHA512 d54d2d1bb84f1a4c6f42420ddbbaf88ef825575e4aed9365724e6a257b33de0f78855ae3961f3968a9dab70829b22a7afe6c216ade5dbf7ff6357d1eee5937fa
SSDEEP 49152:TYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pJZhbww6z776L:mySzPRtfd
TLSH
T14D066C56A1AC01D5C1B9C1B98B1BCC1BFAB134490335ABEB03E556931F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fae362b8001882b6807bb937d2d88eeeb8d566048d433072a785d0093a604997
MD5 16b63692140a59e410f39c56bdb84e80
SHA1 91de70d2e59456979e6fdc457fbbd7e2def1252a
SHA512 4802a667b5e2e769f2fa7550eb3136890f40a12bc00a8d6a96b10e674ba9c5c68489d49bca4af2dea19713b6e77695ca969db1aaaca39e2aea51ee9785d35bea
SSDEEP 24576:347Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYyhkJZXYGbwinaJK5mlz776UfiP:347JUQjTirIhCnDHUPfF/ZJZhbww6z7E
TLSH
T18865AE1DA3EC01E5E1BAD27885154A5AEA71782E1B31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 62d5856b2ce9fa195a12b4a72df19fd476049f00e4f56f6d029954467773acc8
MD5 e7a0aa38fd1cfb68549f90b3773da59a
SHA1 20f2d0b1f0bcf9c024f78630a8b14e8964f3befd
SHA512 085bd47daa7241b9927df7f8bc8ae77a8f4bcfd1fe35a7c948efcd7a2662dc0bb1d327592b3c51b911fecdbd17010c9dead69d69bbd63208d040af6e91375d4b
SSDEEP 12288:EbsfbZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:7FhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1C8E40109D29C52D4C02EA279CB568641F333BCA593E1E3CB52D0F53E1F79690AEE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 2948bad62891e9d364adc7ab287b9911ebf15460b3082adcf5daacdccb70ad2b
MD5 3c5faf73afb73056f2cc113880a4ad3d
SHA1 d122b9805312f117c68cd5ac72c3ab1bf0d373c1
SHA512 db4a7409c380c5f7f68e245c08e1e889e57b786d49740dacda1c7251163f92a3235178fad71bb6d56256d20841c630699f70a7394819e8c084f774623556c894
SSDEEP 12288:CcsYRBq+xISP9uDWiITiIc8k7BSlLjRzn2iPPLf:CqRuQuaid78lvBn2iPP7
TLSH
T1C35528107626CB4FC6AD40325E32D5CCAB707D01EE05AF0773C9873F9576A59BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9bb17a6610dce8c3de1c6896c6ce00a26055590b20e4cf81c44cecf7fa66c3c0
MD5 ac0ab730cd7128eda826156f6c4f33d3
SHA1 3899c405eb1b6886aa45bac057186e814260c4cf
SHA512 43e35f94031a912edd7869ccbad3cafcb8743a6dd6caaa91e7d149b94b0fc0e81fe92f0a86e6492ba72eb288f536eea44947d98d63a5d35fdf1296d301d61b3a
SSDEEP 6144:MKI1vTPrPq9C9haLAvJDQ3ubnKDeoHrU13Xrr4IznKDeoHzSKzKyXOY7Dt7X42:erPq9C9hLD0ub2c3Xrr4IzZKxt7Xf
TLSH
T192650B41A136E78FD1FB503203265B8DA7B4EC02B7496F26B3C9453DD86AB45B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f561e8307aa5a7a2a3d1a6f483fad971120974764e40313556f4f6266a92aab6
MD5 17f11626f89b1bf600dcbfe20f5dafa9
SHA1 3e6bd2e20cdf2d0f856cf21d26f301c8e7f6923a
SHA512 4c4a3a83da1916ce50826e9ce4fca2d5effeec7feb389f63b164e2a494d5531743b779998fd9aa915f746f0076b55f30a3556100d1c309817741fd51435b2374
SSDEEP 12288:9M7DZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ:2NhkJZXYGbwinaJK5mlz776UfiP
TLSH
T13DD4235997DCBC82D63FE278246AC1347037FED9BBC460EBA55033A51678ED1E638122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c28c060a1eeedfc34098505965f081b22b507903de3e30cfeccd3ecc811c9503
MD5 ba0729bb34de8356a920960a9612b5b1
SHA1 90023645c2e760215f0ded36db178172f877c4b6
SHA512 00c1ff68f2a1cf8332e0fc45de22378db19ff93f020cb4725a3720021e1a929f63e1c07687a2be359f44ee855b64093376eeac18a296a11e122aa734f2e0d83e
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYnhkJZXYGbwinaJK5mlz776UfiP:qgb4mBIBhGFXJZhbww6z776rP
TLSH
T18165AE1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 eae2ec7bbf5132df141e2e4703a9bfaa6a2386e432551aa5be030cd8830d8c84
MD5 47da0a33854ab951d12094ac1a86331e
SHA1 c1bc4672a21f27fae2635816d045c83763924460
SHA512 d2b8db0c1083b857c2b1078b95ea67e6ba48531b9326fbe4b06ecfa5d1d2f791737bac2aeaeb7c598a805c4e9aa130d74222657d52dd76373c11700d3e474ec8
SSDEEP 24576:bG88u8FpJqH1bzria7/mChkJZXYGbwinaJK5mlz776UfiP:67ZFPqVea7/uJZhbww6z776rP
TLSH
T18335F16577E401F1D47BD13889824663F6B2B8251364FBEF07A88B511F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4156f62afd4be8e32effc10afe3555077dcaf41e75fe67f42c8f11998cc4b45a
MD5 5b3999a26a09c2a83d94e250b4234cc9
SHA1 481cd3e3cddd951b0ac52d22e3399375ccba7ab1
SHA512 b3703a3fadd6d777f82c4c16d32c922ce3f219a8341f9495941cd6fd6cca41cfd30253be3d1fd865b261f0efd84638a0ed48ccf2d7cc7db76a20adfa777f3c6c
SSDEEP 24576:lPUr+NQOhkJZXYGbwinaJK5mlz776UfiP:lJQ7JZhbww6z776rP
TLSH
T1E505E11F62EC1CE5E67AE17D85428219F672B8521351A2DF02E0517E0F67EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ceca5e5a6ff768ac3452e21e4e77acf06e59217b88b2c8e0af8520a3f67e2bac
MD5 1fadef4ae85f67404d05f5c1428e0f39
SHA1 e084209c4358d6007ac78828607baa28a4583f19
SHA512 7fcb13168d91ff66600a8d627ba433fc49448145e4623998759c86a686fee9c75d120b701a19eedfac8941791d011a0f31cfd5a72e72111312bb0436a74f1602
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLJZhbww6z776rP:VG05lO43b8tfd
TLSH
T146D5CF6E62EC11F5D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 119edb79db4f000133fff7937e8e2c9823c61451405d03b8bb7cc02a7bb41910
MD5 65c86b276649cf94756edbb53edc0424
SHA1 f0b91e87b7b3983ed51afccdecf9412e15d33e3a
SHA512 752fc525a364a85e5a1f39f914127ce2f8746fdbca213e8a75c99e244139a11ada4ca3654f4b0a56c3e292ef2c425ddde4a9f383a9a4224b9f98849831602926
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnohkJZXYGbwinaJK5mlz776UfiP:8a5POZ3BJt2pasx2+mTJZhbww6z776rP
TLSH
T13565BF5EA6FC01D5D179D17DC583861AF5B1346253329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2c716bc04d8e5ed7684e4d38d9e069eca007434e0e86b9011d546a281cdae60f
MD5 7d742261f16d41031d804dfac8096130
SHA1 33a4d7954a030a9341dee2eb4fbe0e9b68f5c9e3
SHA512 363b8eea39812a928abffbbee0bec38c96e18ae6b9b0d4c99e0674a25fb9052f48f62616a1b823f66fa2cc6d8e1bcbcc9f19b18bf7868896f4ad90ac033b4753
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkahkJZXYGbwinaJK5mlz776UfiP:RNc/zEOVHFOJZhbww6z776rP
TLSH
T1C5858C1623E901E4E1BBE1BE89779546FA717869533086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b1250c4bbf4d115efdb5a240af4944c8f0acd47ed24b32140c81a75d987b3fbd
MD5 c44602c9e8eae7f8c4666a9623dccee5
SHA1 68f7060f322395831c3533e99a9546b93a394a1f
SHA512 20e09159809f231d3e0cf262ec16baf0a36d1e08d73ac71dd0edc8356e5c46e12694c7fb4a3ff4f069858c61291aa1d007a0f4e33694247bf026501f5d51a07b
SSDEEP 24576:5TkNvNnaFeYhJNtmZBmshkJZXYGbwinaJK5mlz776UfiP:5TMwBtOmVJZhbww6z776rP
TLSH
T1C255AF6EBAF846E0D1FEC6B4CD238512F6727861173252CB5290C13E0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1c879f931adb0919ebbee15e5b0c8dbfd477b5c8befa8bf4e8a8019981f0cdc6
MD5 1a4ab0b741cc36bbcf479d624c76bbab
SHA1 6a3a6470ad242e3cc2f72dcf7aea0dac8f17f7c8
SHA512 0d4a6ede3b2704ef02844eed0e1161092a6a3603849dea3d9e943e164268d2ebf4bc768e26f8ff203e733ecd1b626f3d700e2727cd868f01e943275dfe553cdd
SSDEEP 24576:ID3FHshBIYQgABhkJZXYGbwinaJK5mlz776UfiP:IDVHeBIAAsJZhbww6z776rP
TLSH
T12D25E17DE69C04E0D57BD1BCDA638606E27178A9032265DB02D091BA1F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-67-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/820-73-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/820-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/820-312-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1028-327-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1028-83-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/1028-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1028-78-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/1416-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1416-354-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1416-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1416-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1416-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1416-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1576-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1576-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1576-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1576-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1576-308-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2580-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2580-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2580-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2580-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2840-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2840-50-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2840-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2840-46-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2840-40-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4064-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4064-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4064-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4064-343-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4808-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4808-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4808-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4808-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4860-342-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4860-121-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4860-116-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4860-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5052-87-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/5052-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5052-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5052-0-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/5052-177-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5052-202-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/5216-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5216-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5216-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5216-301-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5816-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5816-135-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5816-126-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5816-132-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5816-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download