3e24c619132e3eade70ff5dc512a8566adf9ef8ca72257f409c2d086fbf8ca90

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 5.9MB
Sample261016-3r9exset4p
SHA256 3e24c619132e3eade70ff5dc512a8566adf9ef8ca72257f409c2d086fbf8ca90
MD5 09f09e578e3c32b748598619574d0b91
SHA1 0ef8fc88e52c58ef8193072b4402f0a2f5d11670
SHA512 5b92422f62bbbcabf7af4f7ad62ce6d76d24d91b52ea222af08772326939f7052bfe62131e7d3eba00638f5d4bc0a3a3afb23e3d833645fe00dbb3834202b41f
SSDEEP 98304:rY5tY4RMk6lxMOb56/tbN+kgYbJzl8o+k:r2Mk6lxMOMVbN+kgExT+k
TLSH
T1F956CF57A7A901E8D866C23CC4678603E7B2BC151770A7CF0664627A1FB3AE25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4144	elevation_service.exe
5376	elevation_service.exe
4256	maintenanceservice.exe
1196	OSE.EXE
5764	PerceptionSimulationService.exe
4980	perfhost.exe
2008	ReFsDedupSvc.exe
1864	SensorDataService.exe
4792	ssh-agent.exe
3316	AgentService.exe
2044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8b9666927465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3656-0-0x0000000140000000-0x00000001405EB000-memory.dmp	upx
behavioral2/memory/3656-204-0x0000000140000000-0x00000001405EB000-memory.dmp	upx
behavioral2/files/0x00010000000093af-194.dat	upx
behavioral2/files/0x0001000000009337-193.dat	upx
behavioral2/memory/3656-86-0x0000000140000000-0x00000001405EB000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7f91ecdc85ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016fc578bc85ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf424e8ec85ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061d75ccdc85ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000deea858bc85ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fd160cdc85ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076f9a38ac85ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe58da8bc85ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3656	2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3316	AgentService.exe
Token: 33	2044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeDebugPrivilege	4144	elevation_service.exe
Token: SeDebugPrivilege	5376	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1120	2044	SearchIndexer.exe	100
PID 2044 wrote to memory of 5608	2044	SearchIndexer.exe	101
PID 2044 wrote to memory of 4784	2044	SearchIndexer.exe	102
PID 2044 wrote to memory of 4576	2044	SearchIndexer.exe	103
PID 2044 wrote to memory of 1220	2044	SearchIndexer.exe	105
PID 2044 wrote to memory of 1636	2044	SearchIndexer.exe	106
PID 2044 wrote to memory of 3688	2044	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Event Triggered Execution: Netsh Helper DLL
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4256

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4980

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 33adb778460faf9cfa7295848ebd12e0bc897b4c110ffef1bb285dfa61ae31ee
MD5 62d5f2a4ef51f78cd696c4e65237e43e
SHA1 044d2f3f33655e88062410ff9d14927357904436
SHA512 8c40cbfb0bb54c9f38d437998426071e9c51297b452cc29efbef4ebe1448a8c8169836fd4981c190b486c39014381bd37f5868b3bd0b7e70d4bb4d802a22391a
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvB+kn3Hnx:G3q6HjBK+k
TLSH
T188D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 f340401f462cc3e36fe06b07a97e07673e39c1d3fd50896729bbaf1fd1d1fdcf
MD5 b8241925e2609d66497c196996fb4406
SHA1 906d479cc084a3b5a30fad6b27fb92c283db231e
SHA512 2abad10ecb482fb76f31922b99addf8f13f5259b8392e2716d8b9802304117fae0184e9e0af2bff6b6fa41f11ecd823dc18bbe78985689471828de5993ce5988
SSDEEP 12288:w1XLsswWkxy2lRq2czAiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:mXYfDtczApNyBo4kx929bL3Hnx
TLSH
T19585012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 85f1ca5b521453fd40b04a83837b0382034f2dbe66cd53d6e86545d101c69f6a
MD5 04e863651af42b807668b004fb07c2ae
SHA1 3f9a50e63bdd8290114db6072d688c4199d57e0d
SHA512 7d70643a2f290a5a17c82e8d5f706b6f170eb4cad52721cb4c0904bd09368f4e3142506244d96160980f5f0e725ada4dac5404973d5692a36a2d9da3267f8338
SSDEEP 12288:SXZNYVLeyUji0h90ZD0wxpGZIVuXrHsHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:W0Le5ji0hmxorM8NyBo4kx929bL3Hnx
TLSH
T1EF959E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3f55c97e100467d7eb1f328ef5e22d84ac007da8bf96ba15fdccb6ba727fd772
MD5 cfd479e9178ef00dd038e9785ff857f4
SHA1 b502c444da721eba75aea394353c81d6498b43b2
SHA512 1fb60de61cf5608a52b206dd364e685a03db1afca556b2f73114897827baf3de2e7c9740ce8d9fbf97dfc6704c459197cb1b070b3eaba08784ab854d087b1627
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyuKNyBo4kx929bL3Hnx:4/ezSC6vUzPvxHjyYB+kn3Hnx
TLSH
T12C755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e6cbb0d07457b045bd04050c53fafb9a1aa8862b103fc38eba3e525ea5c0b53
MD5 c21f49b23fd72938020bfb1f8121cfa5
SHA1 de387ece85bc6cf472093ee36de27da99a950eca
SHA512 6d14484be1e97426c401603aa1d13bf7e9e5571fb43de3cad0855819cf864eab0ba96e197e73789254bebd7715fe9367dcc88bf88532f63682a4ac52a5ae4b68
SSDEEP 12288:yVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98mLDAptNyvUgXZ32dT4ePc7N29CD:yVbqPb88hv/l+6lNyBo4kx929bL3Hnx
TLSH
T1D9559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3e17bb79f32072d1b1f45f1a85def30d4a5012e63eea8dcaf60b5e532e9d37b3
MD5 10ef080033358e46c9e452ec7da8085e
SHA1 5a8bedaa357f4ea4aa4d2dbbbb8d9eee2107d6ba
SHA512 da0737e83951fb6d38dcec66a8dcd66d3c9a8a724ea0ae146082d9218b7f141e2faf52db6c71b7bdeaad1c1add45d678fdae9cf7c65a789729939109feca1bd9
SSDEEP 12288:YSbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YS4NyBo4kx929bL3Hnx
TLSH
T1946523124B0C627AFBBD3F70749E8454CC35BC890D95DB94DE62ACBB58BCDA2CA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 120d773a88368801f92004f1ff23082b06b68220265fba960f81b22a7d5e66c6
MD5 5973b2febee62fe22c9f06f17a7ed988
SHA1 ce2016d703c7700f9bb56c251c771e6a49547872
SHA512 454bc9c0d1ddafb1c33b54ad8702fced0aa8ce75875992045b2e5a10918d9d1b1ba4e72079913702ed01e2872a7ee173c559bfb2e87574e30db99b5da9ef4da4
SSDEEP 12288:oeBNUbTVO86U+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oJIUNNyBo4kx929bL3Hnx
TLSH
T16885CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 86637cdb2aac80d02c84b161a933e0c242ea6718496ffa29484a32eae8b75505
MD5 43ab0efac95fa8b5b148a3625a3e9dd8
SHA1 c0a54cd7cb65cf53d08234135f96bbe9507a6ded
SHA512 bdad15b7a789c2aef50dbc2ded4dd78b356dd0f4168fd9f5add2cef188cf9e12ba67457466b90490630065e5ad27c123481653fccc8e91e6880f33375604cf74
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:BQvGAdlCEL8c/yRNw5Cf+k
TLSH
T131266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 839023a1b933fbe18983c67e5fef386a243ab190ce96b4fec0241156f6d0f4a4
MD5 be935efb632dd2def572099971c2c865
SHA1 053fed32ec6f92823becf0c66b161ed3a56c4e7c
SHA512 746e089731cc96d3f5ac79f4d0fcf259dcfa4bfe15756d87e8d603aeff915e1270ad29b99718ce7678042047d86ef70d0b94b69e08d5c26fd3775cb18db10202
SSDEEP 12288:pAwSfxL/2Dc3iDLLmt0LDQewsAjsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:arewsAjzNyBo4kx929bL3Hnx
TLSH
T1AE85E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5b6f5bd1c34c7d9ec7221dd557bb672548749099077e9930b9fe0592c4586ac1
MD5 9bd2db3750452b41a4e1d21915e9dc3e
SHA1 2cbd739d845ec837158bb443a0f907ff2e4035f2
SHA512 49f72019ea8b20918680f08cd2a6aed1b70bc16ebc864c2fbe173cd50b0c935c3eafec5c3317f97f9683c6cd6d77a2120f4cfdec8c9b05c2793fbb3aa3cc1716
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4+k:4UEtQevvqc2W1cpV2EI324
TLSH
T101474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c39759be9cab66ad69221aabf9b0b9f7a669335f3edbf34b667af1c9e0b6495c
MD5 f19eabfd5abca64f1d187da04c734eec
SHA1 39615b7d0744a599db1fc3d53a339ea498839808
SHA512 f774871136ddd3e4329ed10fe0838d71d2dbec14f9c057b5bf20481a62ce7c4790c9a7aa7b8dac42a102c4d55e807cce16ca21854b62563079d81b924839dc8e
SSDEEP 49152:8CbRquA/m2yL5zifFiV+XenmE3/z8B+kn3Hnx:1oqHVjnmj+k
TLSH
T13DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 efc7020a0745a08a2213354299e77a929c6bc3338b1598b2c7cb6b3fa2055030
MD5 0c873fe82b79bb33600c7d511d0a3a78
SHA1 4cae6c87a8a554c259473f57e6c4424256e2009b
SHA512 b66c8943927b521e635a08299a65795a9b56712e6affed5ecef2e029b4e61e20eec9e7834baf7bcae1d99eae93a8d27c05b52e5ff5de65f33c48b592f3fd8bf0
SSDEEP 24576:OAhGLJIFoiwtA5l7S53eNyBo4kx929bL3Hnx:OAMyFoiq5lB+kn3Hnx
TLSH
T11C359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a66f49031fa069ddbb97fdd348244c196c88346bbdb967d6dcca614cec650972
MD5 d074c8617e4d6af4d3844595495e774f
SHA1 eff8600b069be8fdddf5d027bdc9d80c5a7eba42
SHA512 a1170425bdc9db0f970af7bf6bbe78e24c9b59717135000c9337380601986f10c22b8187b6cf9c33f4f1445a13479166d001564b2a0fd9a83d9f07bf56e8ee2f
SSDEEP 12288:xmw5HEjsChNYBFgl0WDm+C1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:swu1OW3NyBo4kx929bL3Hnx
TLSH
T14285F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 77bb4afb119c3a19487aa492d9f771fdb846e9d7ed8f2265b4d0590079476c72
MD5 dfef9d1e93d1dd6c64a181c599690a0e
SHA1 9b403ce956be5eb216d0f90d15f42105334718cb
SHA512 eb974faf5c6b7a865c9efc969dfa766e097013a5bd2cbf52fd32f0d8ac9c6dd124413427a038ec1845db695f9c0b49aab3f9de03bf12e7dcad38283a9cd90dc2
SSDEEP 12288:TUZ1IyELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YZusNyBo4kx929bL3Hnx
TLSH
T12A751216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b4fd83d7e8ecccf33ec28a71627f55542b05ece5a7af32a305a980ea38965cbd
MD5 aed2410816350a11898f0ed3fdf0f7b5
SHA1 45acfe164b76a1682e14dea36e54ddec9753d6f0
SHA512 d606978d9dd02fe6c8339b86653d89cb3e9cf98c8157f6c71c72fc7afd7e70c8bfc14c8f361abd59b96d0ffa8a6abd7eaa8039e5d865cef875461af245473eea
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:pQRQyi36YOcPQLvw2gAf+PN3y+k
TLSH
T131666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dac335eb9bb8addab4489e41d8862b17dd81158ee9c0f2035c302a5829763bb4
MD5 cc5e2ad23ec39e7b3a53183a32d45972
SHA1 78d3397f0251afd874d68f1855eb46b07d11074b
SHA512 01d0b71cc0f3df0cb550b9e5c95e5d7dbf5fa201d00ed31dca22fad6469b9fd1bdcadcbcdbc9a5ec5ffb0781082cbc5518ee8a97654252c2c8b9347d96539911
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:NQRQyi36YOcPQLvw2gAf+PN3y+k
TLSH
T148666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 65681bf5e5819094a62d5387ccb712e9c3dbfc7e1370f51e85640c26adc25ecd
MD5 d0a94d9991022e9ddbbb20d57ac51bc0
SHA1 ea209ba9c127ddbfe6b047b6d657e5ec36268782
SHA512 c00a2679cfb01598c5ddb7e38de80c959257e9e75370c455746535e58d64baf892ec44fca5ec79b2c8cd9fa1893c3cefec472e776cdd913e8a8a251e20efe5ff
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL08NyBo4kx929bL3R:M68Qg55nhheWu7PNU3/UB+kn3Hnx
TLSH
T118B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 89b41c7635ae14c6e5da5a33267a205e2fc623b8cfffdb5a1a814776d376f350
MD5 c54b3c0eb5803c2c6714e4351c9778eb
SHA1 1edd58497adcc100e15b8539d514a6f1c0ebb07a
SHA512 4480ff15c688ac53e97dce3816db604bd58f357aaf84546cf2663e0b78c321db435875ebccc772ff96909a19dab4b77d89dafd1015b40093672a86cab11125e2
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:Ey5112gYy5azzVvL69nLKnhZN+k
TLSH
T149167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1abc19373bcf1181685ad459ac40477f2d45db0898039943039732d1a4633f0e
MD5 9d645b04d37fd7db29c4e941efdd82cb
SHA1 2ea1200684449d8dd08793bfa164ba879a7081b2
SHA512 ebce9bcfb45be72df55391404968e91f3ee40503f587c8762de09060a43af4c4fb17b6c91fc4495f9bda45a05aaab72d030e68401994df8cbb30eda3449b16f6
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gleB+kn3Hnx:Pu6JmVxd2d++k
TLSH
T12ED5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0e2215335ea09672302266ee6516208ded377afb3d346bcedc9caf0132d3613e
MD5 096603e0961cb71ba7459799164f8b58
SHA1 aad6fe7f65c8b1ba5a3583a650fcccb416e31ef2
SHA512 38c28b7f475083f4032b2c96352b6f6bd4c1a98064f348aef26dfba5c179e6c81164c553dbdf20e15dabbb8cbf482e65cd3f9978471526dcc224828984ebb82b
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xWB+kn3Hnx:9mifPbR3+k
TLSH
T19AB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd216699a38b008eee7d2fa44d00aa317e2f4398c970a1aa16acea4de4e63e16
MD5 cf9634eb1dc8b63df46a9f0072d8a741
SHA1 e7c7e796c986127101ae442437d65de5afec0fd6
SHA512 ac56603a70016e9d96e08ed3a5a5f826b6c15428c572037372af8f4959a93303a2221375d8900610c68e31f29576a530956d6f67500d72e51dc4ed02d42539a0
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHq3B+kn3Hnx:c5dKTi61x+k
TLSH
T18BC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 46c10b70a0927c5081514060753fd3fc95cfbc6269565d50c137ee3aacf29441
MD5 21d2ee65bfbb466d98918de8fbbb66a5
SHA1 67dd75e0be55c00a9c53e02bc1356ba48e7a73e5
SHA512 2ec9fb99a669481d1c019bba696116f0222b91f4cfe2e9fa79ee0b37b824182da9a14c11d6fa50d6461d26378b802d81a810fd9bf2cc9fa19a2e1a2ea2ed423c
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wiB+kn3Hnx:7X2iyphT+k
TLSH
T14E95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 3b8a4447ddfa8f4baa9156b082679729379b256d2fefdefae00d309652cf8b08
MD5 809deb18d3cd61dc8eb759ac23105d91
SHA1 8d5053d7b2e77b4e7d6b91e1f59b5a2d4818467a
SHA512 aa35b80ba9eacf8df8fe4631810a68aef5ef03851f461ccee3aef01af5d50a91f5bd97148fef02c151db6074ab230dd775117695c64042012d2db0bfc4d42a60
SSDEEP 12288:MzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MgNyBo4kx929bL3Hnx
TLSH
T1FB6523025A0C627AF76D3FB0644A8098CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4ef7050ff1efddd1df3f065067eb8b3c8bea1de4a4c851c22a7e3c8576dc97d1
MD5 b1802ddd8f978419b28297feebb88e29
SHA1 93e82f40beb55c8f65bcb3bb21070814102f85f3
SHA512 a4edde71eb3544f495be419429404b76ca842a1598ebf275a4d956486628fdccdf202251c5fc4ecc3226c541981e1d25a745549d88863452ac87c37b737ea5a9
SSDEEP 12288:QwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QPNyBo4kx929bL3Hnx
TLSH
T15B6523125A0C227AF76D3FB0654A8098CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 52b79e326545415fffd833639d13a1e84db28b0d6ad34a9a0890378aa5dad4f9
MD5 1ec4591d760d290de18aa06be435ab56
SHA1 4fed9f08de0c9ad2adb29c64cee21d1b82422def
SHA512 98ea831c950bc3eec648038255b40a217956663d09fae0616a10cd2f465be2a88ed95ae9991b139248c96747ada49297eb66688dedd556200198ce9286123978
SSDEEP 12288:piLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ppNyBo4kx929bL3Hnx
TLSH
T1DE6523125A0C627AF76D3FB0654A8098CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 95647e58258e555bb73ed4b70d3265d8ca4b8d89d96f1bc7f04537c7a5360a60
MD5 a8bb4695545708b6cf6d9a6e1435619b
SHA1 85dbc989679f08f718a756b7011f641767232520
SHA512 991636c2cd66d15a4d1bc5fcc85c85e0f1bbf71261c9fdd2d0214cab75f453784364d68cac113e35ddad8619ad92ff8ba06aa994d5d8260e32c9441f7c2606fe
SSDEEP 12288:CVNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nNyBo4kx929bL3Hnx
TLSH
T1AE6523025B5C12B6FA7A7BB0D8568054C835BC8A5F7297DFDF1248BB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 58d687110a67d85eeabbbae3d100bac4bf4a7d450a761b9ca1aafe549d37fa69
MD5 4bcb341364838304219c35f8e7e7f898
SHA1 82f294b86db33a77e1f38738421b18a636a03160
SHA512 ff3546e3f4f47bb0ec6b9a7e5f4c9d9e51a80ca4a6009597d8820147e04be979bc6671194d45cee1fe4cc1903915a6ba69fcfb6254e75cbf2876d4b6851ec457
SSDEEP 12288:e1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:eqNyBo4kx929bL3Hnx
TLSH
T1376523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e8f04e202c0dbc615a14505e835f7e992b60f2dd9047de19a22e79512b38dc01
MD5 18c69d66975ab060129c68bedee2f491
SHA1 0b82269db9ec595044e437a58568e0e1ba5655bf
SHA512 867bbd69bb223630b71a75b910e941241b1d8d646e27870e02d6d9e2a13a021ab87b86ae8e9e30b7f15422749413cc194954a686a6256c7ac5de509da264055f
SSDEEP 12288:EMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ETNyBo4kx929bL3Hnx
TLSH
T1906523125A0C627AF76D3FB0654A8098CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5c241276888235f3d8d6b30feb5174aa574dd78c2032e0da1f5bc47ef044ff4d
MD5 08f7233eab1ff14026fb7d6a6f86a7a4
SHA1 526a5643bc60b80d275c604487b794ae061ab0ea
SHA512 69b7489693160b4f843c617ed0694096da7ede993cd8088f35be89e56775894e2e7dffbe602f7b2ca2a3b6ef7575ea2494f242eb8f263674a10f5b9e3a52f64d
SSDEEP 12288:rYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rHNyBo4kx929bL3Hnx
TLSH
T1386523129A0C223AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 edb5cbc68432120bc052fe9d50a03aac977b86035a8700a5b630d7663fb88465
MD5 1af7ec21161e3343489df6593da5105d
SHA1 dd150a0c84f8d21f8a1d54e8f2b0bb42b7cb7783
SHA512 dc570618a7cddb4d09e902fc672bcf62911c505eb9d3cdb63651cd03f09c55d5be34cff7d0e4144a88b1d9f4e827ef7f6cb12b24b2fc0ce8f3fe4b51de218415
SSDEEP 12288:IiZwbEzzFEoS2cPvyQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:LZMUzFVSOvNyBo4kx929bL3Hnx
TLSH
T1E4850195B39418F8EC67823DC8158906D6B2BC4A0BA0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 43560cd1125e0172bf6642f1902573bde8afbf5697f3a885340c4998af5ab673
MD5 8e0de98b22d1c0f221abcdc586c61d4a
SHA1 9f5347f9ce50938f3bc48a34660c56349ebb932f
SHA512 bdbba69f9603dad6546fc75f80459c0e3f5efd2a822134def0f9597e7e162734f72700bcc52b2d1710185583ddd6387e311ef3e9634c31d953e384faa334b43e
SSDEEP 12288:SnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ScNyBo4kx929bL3Hnx
TLSH
T1E16523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ce967a85aae4a4267fe6212e207e29d3f505a4b71ba3f2a93b249cbd6816ac82
MD5 c49dddb272da5465e96d51d8f92e7387
SHA1 02e8c0c8dc26f3bee32b2c7fa5fb33343b246f38
SHA512 7da3dfded99b10e1a5f0386fe3e547dac6814dd48fae5ed927fc958cdc266b0f2d1333af83afd4c35a869528bc5882d0ee3aba8a0bb32909c35b0f7f24e2580b
SSDEEP 12288:jrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:joNyBo4kx929bL3Hnx
TLSH
T1806523125A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 ac88b773631b4ae95d7e3d42141e3202fb2da13cee79049275e28867a1039e9e
MD5 940e8846a27d43547a09461a99bc5b1e
SHA1 b9152c8f7f0c3422b7e698743327b5da8fea757c
SHA512 28e99982cdbff01aeb9345b6d53a2ec5e7db6a9fb6cb8bf98c2e5064fb6a5c2be5399eaa5d20f7042df3ae97562be771326d6d73889b751ddc85491e1e7e35f7
SSDEEP 12288:0yPz5L8ELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tzybNyBo4kx929bL3Hnx
TLSH
T17675120773A431F9E17A6234C8960A05E731BC760B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 fb4e39eae3f925e55b10236bd15c55f004fab3c116eb92aaa6cd2625e34137ec
MD5 5a4532a1da8852faaf385e064da8da36
SHA1 3f75c56dbe00388c30a816e3de6bfa14f8241b98
SHA512 f0c4a43804a9414734af39122675549c0d662072bde481c1e965c14a4e854b0d51a8a6019d794b8af1847e1391c56d891f68efbec07f5ba037f98267d744ece3
SSDEEP 12288:xnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xcNyBo4kx929bL3Hnx
TLSH
T1C66523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 bfe95ce6626bf883b6e432a4394a3968eb2486eb9a7705e01fc577e8a01bd0b4
MD5 3f49cef6b83651c8e96501ac75612f63
SHA1 0ed315aa83248b7e485eb35fc0c8d0a18d5e43bc
SHA512 0210e9dfd78930c5d7bd2d524fcb987cf5dc50cb545028ce0e59f16219e815b1e44bcffbe3a2070f7b4862cfc5f8bf9b15bd6092dca080ca326f0eb0c71c7a90
SSDEEP 12288:lnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lcNyBo4kx929bL3Hnx
TLSH
T1516523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1d71ccf77db6d08317d9e986d28809b6ca7b8fb77a51fd00c070dedfd20626b8
MD5 dc40e806daeeb1ee6da6bfe39ff679e3
SHA1 a1841b449c1b4d902afb73c90094e13d76a0a0aa
SHA512 d6c79bf1aee001f20df71b285a134161d9b5c00504440f68149625ccb22927963ed05f02b9acef460585af7e23c0df370c268be83894ef9b890017a66c2e4546
SSDEEP 12288:6yPz5L8ELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nzybNyBo4kx929bL3Hnx
TLSH
T18175120773A431F9E17A6234C8960A01E731BC760B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 69f8d7fd4467d8b3d92d4ae8aadce001e85584c08bce7bc3148d27b0d137b777
MD5 97a04f3512f1450729dc0d810550dde0
SHA1 6ee39280e47fa1bd9fcf0b8199997e2af1286fde
SHA512 a30f6a364eda25b9f3bf4c8473697229598901fbe853e24047ae8a48dbb5cd04ceeaaeb4f0b90ad9ad38448e38b9e384ee80d1a9cb517f0d7ad324337b94b469
SSDEEP 12288:5Cd98WYoaLHF3z0z04PDvhSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:kTtaLl3z0zD5NyBo4kx929bL3Hnx
TLSH
T14B8501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 71c12f8cd6aa023a8e56a359d1eb45fdecc65c73f703f3fa459dde305925f823
MD5 fafc35dcc7458906b7394081e5d5d47c
SHA1 cae05a29a1d9f1fb0502b3f207cf057def78c0fe
SHA512 e5a1d37bae7d508f5dedcd14afc2d37b4f4c72f22ce5237c364fa4c2067ea0bbeb368a0053b131999ebb61b4afa6712a2c85439fe099a3b4101883b75cdd4685
SSDEEP 12288:bi4e7xRdTfgwCHKy7GLbbdIvhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:b3Sd9CHKy7GZ9NyBo4kx929bL3Hnx
TLSH
T14D95CF90F3E810E8F1B79A3489764511C9767C9A1B71DE8F03A4656A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 5478383b7e4a9c397c2585ac94c89b1afe6372108df88a087d71bda6b288607b
MD5 3b3b4663727d13fd9337fe711c6c6a06
SHA1 faa21b8f8c0233e5946cb1aaf36b1567d7d4d6dc
SHA512 94ca7a1011c6218ed836420bdbfe980d8b19c1031a55de36113b874b29f1188d6f18479cd8bb24f13d3e205ffd04108ffea817012404cf53389a21dd756571f1
SSDEEP 12288:YCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YJNyBo4kx929bL3Hnx
TLSH
T1646523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 7e717d0d4aadc890807504c21ef1f86b9cc02183954a7a5cb13e20f8b2f1d4c3
MD5 58bd4a138d06b7288a3ead6be1697ddf
SHA1 105c13cc852eaa5f1c13622749bea1805a28ff63
SHA512 532e19509f26bfbea2b9959e56668fffd98d5a075a67fee85c074b96383171745cb6f9468e2cf84f2a68468a1343453bce3cccf63368dfdaf95226acd3308e0f
SSDEEP 12288:MkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:M7NyBo4kx929bL3Hnx
TLSH
T10A6523125A0C227AF66D3FB0644A8594CC34BC8F1E9597D8EF67987759FCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6eda5d557a49b7f6da4e00adb37086d9b363846533a6e5e4e8bb19548d55dd60
MD5 32b9c6760ac02e57f246d98b8f369561
SHA1 1b440b4848bae52e6a10ebaf0d111f083a8624cd
SHA512 456c892bcf07705db5973f0ad1490276a7c4286d6ff2d5553b759c2aa8c613e6e2979c6e71a0d18602002a89355fe27ec4032ba008dac321f9ee316e559f1efc
SSDEEP 12288:8hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8eNyBo4kx929bL3Hnx
TLSH
T1FE6523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 d547875042540e105dc6c4c1327bc8fbfcda65684837b7057c6593c494f49e79
MD5 b2a8dcc9f99773bd799b3c0baebd9b5b
SHA1 eee02dbef25cd0566062f03fcf92ef6da1ebcf03
SHA512 b4ca8c9f087f079ca91d62973b35dc27f1b8fb5dcd6d008eaf4849394f262f154ffb538d06e09ddf2f7ee4beb1480b15a9d5aafee7f2eac81031487bf03a6b21
SSDEEP 12288:TnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TcNyBo4kx929bL3Hnx
TLSH
T1946523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f01a8d0a508bbbbdcf60bcdf06c652c937c66372558c5cea59a6abc2954d6236
MD5 4f0e90f5a3cf8b260b44dd16adf1a3a1
SHA1 58c3fbf230a9a9e7fc063983cbd5ee170079ce76
SHA512 4f30aaca17f6f0bf17afdd830c0190e7a70afb47c2b2673112c9fa738f124317ce187b43f8168f5bdafd6ab28df3abbb39a10bc9aa610abd8272b67bf3c6b834
SSDEEP 12288:gCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gJNyBo4kx929bL3Hnx
TLSH
T1CF6523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 7cb6c5a7c2c9786e230ae3329db1e0219e84fa787d5830a7d08fcbe0b300a403
MD5 4107bb1a1b750377dbf12c1a8f5a3b4f
SHA1 40ff6f08692cd21c51fad171968821207cd712fb
SHA512 71d087415c4122767443d0ba29e5d6065a0719a44cbfecc50c6d15d51949335268df3578d6c72e41321d8e9699a0166ba9aa0ed95fc57f52307a3fff307e8f97
SSDEEP 12288:mPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:m0NyBo4kx929bL3Hnx
TLSH
T1CC6523125A0C227AF76D3FB0654A8554CC34BC8F1E9697D8EF27987B59FCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 6f4cede897668f2ad62ef4ec3b5185a4c00435e30490002effd560057e7b1647
MD5 bab9111a01c180a93988a6157edcbddb
SHA1 89d7df7e88beebe8f58bc06567c32bdab62014b9
SHA512 2f659a3ab0e84cd12ea35bcafac4eef83666e9536bba2e0d320069fca47dfd46f1421e42a531837f3765a8cf3988c60c087a155ad995933109f50ac129ae9224
SSDEEP 24576:Rfwvuk9RX6wkyAIYNyBo4kx929bL3Hnx:xMnYIbB+kn3Hnx
TLSH
T18095DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 528750475405d6e5bf4343fe0dfd50b58b3c8fe6f0eab701ea674434828af14b
MD5 25e571a3ef9127c9d09811dc1479651c
SHA1 ae02780fe1284640494da36ef9f4ed88ee814ee0
SHA512 6b251da89736087c706fd61b99304db8e9162b27e48117f577a19985cff37000b2abaa495ba887816ec73130421c04797c82b311c9ce1635f0ffb5b7f65342a0
SSDEEP 49152:iYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uB+kn3Hnx:cySzP2+k
TLSH
T1F1066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c6605b083eb9e75e1ee730a3b214744f6c78759867b689b64ea7b44410113f2d
MD5 09b6a11b6012ddbeb2425cc59c2ab8ad
SHA1 34e076f105f8f8799f7148fa7c94916e237a0de5
SHA512 d7931b4bbc4fdd9e400e592d6afce6a480b3d3f4c36c652b06c2a2e9017d718e35652bd26184093ce3102b60b3a2ec390fdcd2d67d573578eb9768959fb4acca
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY/NyBo4kx929bL3Hnx:W47JUQj1irIhCnDHUPfF/eB+kn3Hnx
TLSH
T11C65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 c560f89e97999d83e32be955ca611c3a2bbf5bebf64d34369a42e76a1d684720
MD5 f071bafc7334efada56855741142bdf9
SHA1 0b16ca55ceac98ed242465897f373d45b2145eed
SHA512 5dc2d0729f65e45e3abdbe3a1e5b3746bb8f36bed5b16de4b085529ce98dfe24d5b3c7835331fd4f08c4b09e4c5eaef23e2fa32b412ad395ce98c6ac7cf0c362
SSDEEP 12288:5usfXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/sNyBo4kx929bL3Hnx
TLSH
T13C75F00AD25812E8D16E6274CB468A40F7337C5A47E1D3CB97D0F87E0F7AA905EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9c77b0fbc757c3edf1a496be35c90051f63e169775445adfd40773f344466f3b
MD5 835af4647be2be8dabdbdb2edfb21bdb
SHA1 4816078a7982113ee9bc22ecfc0a91321133d899
SHA512 73f7edd5b23fd717b46a41dc1ff069e475a14373eb46b0be1fa1cbbb82ccbeea6138dcff6820103a6b01552037e2cdb338a97d63d77b57ad7b7681067deebf0f
SSDEEP 24576:JkFHQUPb+k9x9a2qWRIthRsS+q5PZiygO:WHQUqUiaIthRsS+q5PZiBO
TLSH
T1A13516417666DB4FC6A940322E32C1CCAB707D41EE04AF0773C9873F9576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2ee7531aca2fb63fd3e8986c8f0dee83f8e6983956eae48d26c1d81a65c25462
MD5 cee3bbb75d776364add083875081166a
SHA1 6a2f37917867d64221582f54b365e0c4a94f11ac
SHA512 597c1f3d07a62b0cd874d2216d14c9709d2145ebe238ef928f149217d90cb74f735c53ddcb9d9564baa26c3ca498dd2f5df22bf32e5d41a0b69b49014c1a81c2
SSDEEP 6144:5mM0KWl7VEpHLek4ZNZl5lBURV5I1a/h3I1SB9OFQytMx2QytMx2ySZoxaal7g7A:5mM0KWIwkybQ9RB9O9Z80xyOjK
TLSH
T1696508816137E78FD1B62032032A5B8C77A4EC06B7096F2773C9457AD82AB51B0F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 017a83a52a9f31110823efe38d5e191a41bacaf1813e7749e0231361b517520a
MD5 4ad5fae8be01fcf414e11addfb237d73
SHA1 3968bf90b504d19c66e339ad6075dba9073471c0
SHA512 30f28af8ee4f57bb9da33f49dfeea99bed8986d2cf1c2c6353e004f3696e6b4a3d9b130fc33267cdbb4c97dd9bcfe48fa5b97e7980b245f1236d70dbabc0befa
SSDEEP 12288:267nLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pcNyBo4kx929bL3Hnx
TLSH
T178652312975C663AFA7D3BB0645E8124C839BC4D0F50D6DBEE1258BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3c6fbcab851f755ecf17642c994432772fe2292ce313952023070991f2b86a9e
MD5 95c32c832fc0ac28b5db54fd6668e7af
SHA1 896ea54db918379462adeffb1ed6b3f2ccc859a9
SHA512 496f1a975d76f4e020d0922ff771f66e9784e9b7d79342f094f1c369eba7ab74478c9a08f2b87661deb7b3273b7aa79d6a041b1eed9804837e63eb3241cb7941
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYKNyBo4kx929bL3Hnx:Ggb4mBIBhGFQB+kn3Hnx
TLSH
T1F565AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 6bfea8aa47321c273addf701ab40abaf65d4ddbf7649fd836d36f9a64c15ec5f
MD5 0de9c9f108b9c75aa0b442bfc0c12940
SHA1 b50be2e10b64b412808cca12bd75d50d0ab45fed
SHA512 95007e896e7cda5666878512f3b36bc152046dfa3cb794b49f4a84b1cb05a5f8fd35bf2b8403863a46c01655f2f0efb893f262c5b1d0cd1348a4afe22910f931
SSDEEP 24576:+8kNvNnaFeYhJNtmZBmdNyBo4kx929bL3HnxtvM3yReRdqmCAzxj884:+8MwBtOmaB+kn3Hnx4yMRYmJzxj8Z
TLSH
T1AAA5E12EBAB806E4E1FED6748D238512EA727851073293CB9390C13F4E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 969e8045f07ca21456663b48f3612c46a79c6423fd98578b7a55cb47baf2feb0
MD5 4fa1b7eec7e6d169f16b68aad986ae2c
SHA1 1441f1bda9a0c29495eb3b05056ab6a0c87ccd22
SHA512 f95fd66777e601bf772b4b0b0b95781fde833e42b70cf34b551d50ef4efcc8b78eb2483198075d0c9d6cdc4a3f8d9713e8b9504fff18e629f483c5d85537f0d1
SSDEEP 24576:FG88u8FpJqH1Rzria7/mvNyBo4kx929bL3Hnx:o7ZFPqVYa7/BB+kn3Hnx
TLSH
T18D95F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dd45cbad0c07f6f6eb6ed7c8a29a3e48f576e126fd034a322d664a84a51f9e2d
MD5 469a6f545e2f6f695e8b9559992283dc
SHA1 84d3fa02a8b9de8d6b6cb09ae4dc00eb00624abf
SHA512 d93a6ab9b65a6ce87ad261f4464c6a444c801f184d27413d40b2dc962c6a10d404a538e3044316f1b8e70f0c4d3e0cf29c8c9964bf73bf59d07edba2af7584bb
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0B+kn3Hnx:SG05lO43bl+k
TLSH
T126D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6e5717f292ed7b693403bfca0f16f2754c6ae0cbf13592b8446a47e97dfdb2ac
MD5 cd6768bd86e9df995e3fe80a4a88b117
SHA1 0669bf18e58763c2f82c0b78007ec9d6570bfac0
SHA512 87cdde742ef8f13628cdfe30dc6c02acb74a8fb991a30f78889ed60518896f6514963d580a5f05f8107bbe0a7b7a61d49f02300c6d4bb0e79b01aa64c0852231
SSDEEP 24576:9fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnJNyBo4kx929bL3Hnx:Na5POZ3+Jt2pasx2+msB+kn3Hnx
TLSH
T16765AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2fcf8a1050df012b9e2266552da5ed2e4bdc6406a5e022621c4b940b9455d13b
MD5 54febb45bffb394e95992cde957a1520
SHA1 30d5c373a3f018fd9035fa2df655f37181f4001c
SHA512 4284682534200917a6e4a621b25f238043572762581945be430d0618a5bb3dce73cffb2f0d8a440b49ee35830d687e207de72b376b303420bf012ffe37deecfa
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkXNyBo4kx929bL3Hnx:MNc/zEOVHFhB+kn3Hnx
TLSH
T170858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 58e3106f5dbbceb7faecf0ad695511b15d7e973873317765e97f6b06b30d253d
MD5 a366366963dbce9c2fc0f1394b96cce9
SHA1 b73fe086926664e08b5e2631d4e97f5ee22a4e09
SHA512 ef3bb3adce250f02ffbe325759f9ac70b31356be8eb18838aa7892e1635c44bd9bbcd56f824a708db2cc74b473fde6295ed1501c61f950c7b98a1c0c135685a6
SSDEEP 12288:y9Hck6j5ZI79VyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:C6DIcvM3yReRdqmCAzxj884
TLSH
T1CB25126D73BA10B9D177D03E82830543D2B2B0758762AACF5694D07E5EB3FD8B938A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 e77a45f75338b1b9264e271b29c1908f8715ed55693bb934c450fb87cbaeba6f
MD5 36f6d0b57db03f481352041043c1430d
SHA1 a34d61a325c1e4b7eab05601e275cfecf34242ba
SHA512 9db5f49d694639e720c5d1764caae8d9a9457201881031612d53b36c77c227f83acdb92e946c3542984ef4878e19686c5399fbf8832719799161581f50c302b8
SSDEEP 24576:jDkNvNnaFeYhJNtmZBmdNyBo4kx929bL3HnxtvM3yReRdqmCAzxj884:jDMwBtOmaB+kn3Hnx4yMRYmJzxj8Z
TLSH
T185A5E12EBAB806E4E1FED6748D238512EA727851073293CB9390C13F4E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 d6ce9a47a4a297fba2bc0980f43c794dfdf19b5c195eb87089a879643bfad797
MD5 87a9f633540fd8bbae8763b937febb9e
SHA1 e8f23a8259bbbfaa58b2ef07e46ddd6ee34d6fd2
SHA512 d9e95e54b461050252fb4745beaf83d51fe722a37dcdcad616f8390222e28cc9d168f46f42feb8be53d19286457b74c4a3c28f91763f44c2749d5f1c7fdfae27
SSDEEP 12288:IHvUrBFrEjwaQ0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IPUr+NQrNyBo4kx929bL3Hnx
TLSH
T1E575F22F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 5049ed96fd17b225b434142444e6ceca16f6a9ada1bf71307c3bcf213877fa5f
MD5 2e0f4d9039550778057756f2135a1c10
SHA1 42b1ac9e065c17c60385152c2d178f39602b89af
SHA512 aec3e5f5aabcb2c4da1834a75ae7081c8fc93d8d4142cfe28e8b54dc843c98172ff52d102eed5df9c8ad1971ff30bcadc1db6d933d41f47a2ee544408aced17d
SSDEEP 12288:VQcMxWDXN1Dp/fshBItT1IQgATLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:ZD3FHshBIYQgAANyBo4kx929bL3Hnx
TLSH
T1AF85E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-70-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1196-356-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1196-64-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1196-63-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1864-110-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1864-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1864-358-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1864-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1864-116-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2008-98-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2008-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-378-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-377-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2008-104-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2008-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2044-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2044-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2044-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2044-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3316-145-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3316-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3316-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3316-140-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3656-195-0x0000000003B20000-0x0000000003B80000-memory.dmp

Download

memory/3656-192-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3656-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3656-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3656-17-0x0000000002990000-0x0000000002A13000-memory.dmp

Download

memory/3656-186-0x0000000003B20000-0x0000000003B80000-memory.dmp

Download

memory/3656-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3656-10-0x0000000002990000-0x0000000002A13000-memory.dmp

Download

memory/3656-86-0x0000000140000000-0x00000001405EB000-memory.dmp

Download

memory/3656-180-0x0000000003B20000-0x0000000003B80000-memory.dmp

Download

memory/3656-191-0x0000000002990000-0x0000000002A13000-memory.dmp

Download

memory/3656-0-0x0000000140000000-0x00000001405EB000-memory.dmp

Download

memory/3656-204-0x0000000140000000-0x00000001405EB000-memory.dmp

Download

memory/4144-32-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4144-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4144-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4144-24-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4256-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4256-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4256-61-0x0000000140000000-0x00000001401AC000-memory.dmp

Download

memory/4256-48-0x0000000140000000-0x00000001401AC000-memory.dmp

Download

memory/4256-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4576-375-0x0000022621C10000-0x0000022621E9B000-memory.dmp

Download

memory/4792-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4792-130-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4792-122-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/4792-363-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/4980-87-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/4980-93-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4980-88-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4980-361-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/5376-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5376-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5376-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5376-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5376-167-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5764-76-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5764-357-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5764-74-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5764-82-0x0000000000730000-0x0000000000790000-memory.dmp

Download