d5f9b8a951acf311269fccb4f2ed6e4674449a3e304815ed6257e320dedbeb37

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 12.7MB
Sample261017-s2bljaff76
SHA256 d5f9b8a951acf311269fccb4f2ed6e4674449a3e304815ed6257e320dedbeb37
MD5 6889b65b52994c296031e4d35c3ca1c6
SHA1 1b99513b7d648e929150a682de5b8058c82e4be1
SHA512 f67e07b07abffc2741e5998df06ab815f3d4d0d8161897e3bb05a44c35bfcaccfa858b6ed8cea421bcd992521aef5bebdbd331ce9e98570e08ac9ecaa6c59183
SSDEEP 98304:oKMoMLZcpZE/Pn3NGNHoPy3beqBnZlmOj6EGRGNNK/zFEYDBvIdj:oN9p/P3NGNiyaq1ZspEUMoaIp8
TLSH
T19FD65A57EC6545E9D0EAD1308A769253BBB17C494B3023DB6B60F3242F72BE09EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5836	elevation_service.exe
4352	elevation_service.exe
4612	maintenanceservice.exe
1512	OSE.EXE
3492	PerceptionSimulationService.exe
2496	perfhost.exe
1792	ReFsDedupSvc.exe
4592	SensorDataService.exe
1736	ssh-agent.exe
4420	AgentService.exe
2672	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1f019b534b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8eadfa54d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e96aa614d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000957046624d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fc9d8614d5edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003d384b624d5edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf57f4624d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef27f5a54d5edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f8d82604d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec142f624d5edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3936	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3936	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3936	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3936	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5836	elevation_service.exe
5836	elevation_service.exe
5836	elevation_service.exe
5836	elevation_service.exe
5836	elevation_service.exe
5836	elevation_service.exe
5836	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe
4352	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3936	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4420	AgentService.exe
Token: 33	2672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2672	SearchIndexer.exe
Token: SeDebugPrivilege	5836	elevation_service.exe
Token: SeDebugPrivilege	4352	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 3296	2672	SearchIndexer.exe	103
PID 2672 wrote to memory of 2028	2672	SearchIndexer.exe	104
PID 2672 wrote to memory of 5196	2672	SearchIndexer.exe	105
PID 2672 wrote to memory of 2016	2672	SearchIndexer.exe	106
PID 2672 wrote to memory of 4724	2672	SearchIndexer.exe	110
PID 2672 wrote to memory of 4460	2672	SearchIndexer.exe	111
PID 2672 wrote to memory of 5256	2672	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4612

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2496

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9756a706fb2cd9ecf44b2ece9e7d5fc07d8b0622e090cba9f5c9ebac424acf3d
MD5 87c25edaac1d211e011bdb541386250c
SHA1 658b0be494d7a313d99a7e47dc555e9f3d4a75d0
SHA512 cf01670aab463abb04baed4fee470d1d9d46d77672ae0a00012b46d7bcd1721447343c4e3b2c5108c5e209a4ece2f84da0e6cb3dc63c14a80f43b31e5a14bfd0
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnflWI7f2Fdj:w3q6HjBevIdj
TLSH
T1C4D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9f2f7e0d69344b642aea3b56a929dd167111e35f8b4fa28cba2d0e6cb47c7df8
MD5 20d02e3569c9dcaa75832c23c06ca678
SHA1 efc6b56104971644a0a881e450271a60faafc194
SHA512 61b1b3d32e9b54d52d1ff953f08950b376c921c79846adbe586610c6b55e313770024738d697598598f8ba5790cffd786486c98c7eac4eac35eb5daced0ead0d
SSDEEP 12288:O1XLsswWkxy2lRq2czAUAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:8XYfDtczAU/KSWITnbD2sKJdj
TLSH
T1A165F12967E508F9ED67827CC8A2C512EB7378914760E78B03F49A261F336C85D3DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a8f3e6237400ad47d82f54d80743d1fd931cd613c9e969cf992e8c812359edfb
MD5 c73d8cda20c7a287498afc93bddef328
SHA1 f77562e4c3384af9e16f4f6aab1ef904b0f58f08
SHA512 35a84716002e270a3176bdcabbd31ca3fc34c8999016132c4997d9d85b2e331cdc5beeb8035ee50537bfb04b986d68371f40852ef0593105217b9ceaa021312a
SSDEEP 12288:jXZNYVLeyUji0h90ZD0wxpGZIVuFrHs/Agi85bpRaTbqGLIIcdJViyD2EHFrOHWR:V0Le5ji0hmxirM//KSWITnbD2sKJdj
TLSH
T109859E16F6748735D073C0B9C5D2A69EEA7130821B308ACB4296D77C3F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1cf8fbf963e01fbe0329b5a10f64a7c810e193c42cde50931e34b25aa7a6b5a0
MD5 6e1b4dc0ca58b97838a64f627266d4c0
SHA1 f5632e087ccbc599b1f28dc8667e7457d45762e0
SHA512 8d864fd06a9f5a9be2c1992bad762da378a75e9833970801402a844646d345a49706f2bc33ba9b10808edb79e74052a32b35bca77bb57838fdaebbbd2890e3ab
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuZ/KSWITnbD2sKJdj:O/ezSC6vUzPvxHjywlWI7f2Fdj
TLSH
T150755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 28a61e7f7fdf0c70a9c4e1bf94e474fb1865034baa5ad1934dec8fe01bae5ece
MD5 44138156668ec284d95b47fa21bd704a
SHA1 f47c2954fbb478e0150605af0ddbe1568b395e21
SHA512 de55ef80ef36f62be81207d5c3a8cf2325ac372570b061e2b7bdd9e341285330955f430ae6e50012702df9e40d0dd370a97deee308518ca8449deece21268b20
SSDEEP 12288:RVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98IAgi85bpRaTbqGLIIcdJViyD2Ej:RVbqPb88hv/l+6I/KSWITnbD2sKJdj
TLSH
T12B559E66F6748331D073C0BAC5D29A9AEE7234425B318ACB0246D72C3E67BD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 14ecad29e6a1eacf68c23ec96977247e3a3d60d00e894d5d1d00ebf1a84728d4
MD5 eab0ecda587c7d726148b67adcdf422b
SHA1 a320b8cfb57625b5080955a9c89465f02caa2d99
SHA512 dc24701c69df9c437e2e3e08b4bbea66ea4f9fb0091e519961bedb6a9bb1af972db9a44cd0cfb6ed467dc3dddfc88bffdcedcc65346e74b013366ae910b4aa89
SSDEEP 12288:VRrAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:VRr/KSWITnbD2sKJdj
TLSH
T1084523064B5A58ABE67B0EF165EAC0D747E97ED02F606E0C42723F1B1178D84E46C7B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3ca32934b37c837640c80f18f04645a92046a62ed04fe8dddd410c947fc920ae
MD5 e036dd8e8b24fc1b749258831bb5f5b8
SHA1 9f0d90c3a5a263b27133f9d096d6cf55d6dcd55d
SHA512 f0587462ea8256659ce6fea78ec33c28c6c0763bcce57f8d8ebcce094cbfec80dfd99810c55d3a5c5fc633d1703c5960c8fcbc99aa558e2612a07c705f458e59
SSDEEP 12288:ZeBNUbTVO86UwAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:ZJIUw/KSWITnbD2sKJdj
TLSH
T15565CF3BAE28FCE2C27A4DB95A91C240D7B278704F61A3CBD175830E9E235D05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1f504714ca14e3582ca4085a2c26beee611f85f56a5bbb76351ef85b060f24d0
MD5 9b55e4d1bc7f4eff281ed7d62d288e6d
SHA1 129ef64e9978ade6d2b6d5056203021e4440c3de
SHA512 c626ea33e6e7a04b66327968b2762d75282b7c1db271757147e748f95945a364595bb386a5bb5f6a9e1e41a3bbacf9012009f1855506dc4fd9d003994a417000
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:BQvGAdlCEL8c/yRNw5CTvIdj
TLSH
T174266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d907e0b6a694b49ebcb0d7493249451c50e9b3a1888366947a29ece65885867c
MD5 d96f2aff77d72837203fc889cd88a70a
SHA1 104689020cd3f6299bf7fe9ff7e569fa9c8ff7a8
SHA512 cbfcdea127d837dc4cca0802580bb4309573f3772865ddaff922c8d5ebe242348528e56d30f851910ba4aa8b5b9a2f8a949361f2ccfd2c973e0c0c13de371f0c
SSDEEP 12288:sAwSfxL/2Dc34DLLmt0LDQewsAjiAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJy:RdewsAji/KSWITnbD2sKJdj
TLSH
T13B75E031EF75E436C27B0DB21B26C716156D7A600F611AC3E3B85E9E59306C2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9340a68e8c2fc18b8d64a402872379827100b41678202de421c7aa4ee6f8abbd
MD5 935028f0b6e717180084f36b7887f52f
SHA1 43b2e32922185ecfbc96478b842a0d250baf033c
SHA512 2d54050f76d5facac36575603d6d12ef0ae096393fc915af4a5b96e0b1b97e5db244330e6dbc3f530dc9e09d83be8ac5b7084941e28b80056b300928c499ca52
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHQ8:HUEtQevvqc2W1cpV2EI32Q8
TLSH
T148474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2d79bcc6eb5c15a6a325583d4ba41a0965367b05cb9ea9ce7512e97b598f1b05
MD5 43ab39c7f8e435416f68ef034191fbe6
SHA1 afa495667a7061366f72b11e757f3967a20d09e5
SHA512 2c8c3a20e92a65e651e3369921483914443d9fbd2859942114a8e01c349e32930111c92d08e616dc89b914b17c97d22db50f28057d414d0e20dd6306d4c8e5da
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/z0lWI7f2Fdj:WoqtVjnm3vIdj
TLSH
T1B5D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8742deed0c5bba4d705457bfe8489466a6844fd1fb029ba6530d565a2d69cca1
MD5 4c1d3df0bc1d6b5350a129d5aef94692
SHA1 d58c879bde644f93efe3ba1f2b0e94e00d4a5f78
SHA512 82a9a196e22079c1c573a6d66cd1f841d6f024a8ebe11bfe996141d744fe42a04fe8083912808e69730447d8b176e18d51deee1bac1b8b5c0316973608c3c749
SSDEEP 24576:mAhGLJIFoiwtA5l7S53t/KSWITnbD2sKJdj:mAMyFoiq5ZlWI7f2Fdj
TLSH
T1AA35AE81EBF955D4F5B3AAB899B68171EA76BCA55E30C20F1160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6aa61bfa6da52569b9fcde33e80d477270d84e38507332ce9541e457d2a49495
MD5 a8936ff0ef3dad02de498c639280a25d
SHA1 59b30ce519891376694a2ea506e2b2e55628aa18
SHA512 ee3281ea5986eefb0efd1f9d3d992e87c2bda6fe1618f8982d284216747aa4e03bc6d9d8cbf92e745227a0f2fba9c76f049e67458bc366e89c4c52d2099ec3af
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CRAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:OwuoOWO/KSWITnbD2sKJdj
TLSH
T12965F14667A90CFAE96746398597C136E7F2BC422B20DB1F0360C71B6F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b3d985d3db61a5f28e887f1d96d222d4b7dde9a355420502f79a45c6a0d8f582
MD5 c05cf4e733d67ec023da3c22cda5c8cb
SHA1 a79194449add1e45dc384957b8cabd7f78ff8fe4
SHA512 d050f65a1ba1bc72c0e6276ef47b6bd9ccf9629727485b5253516b7b0db71034f9b035f8f4104b0617f605980bf935d46856b8854a9f89c57e23e10814b1a546
SSDEEP 12288:5BZ1IyyAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:XZuH/KSWITnbD2sKJdj
TLSH
T14755125A17A920FAE1B706B8D9E58186D7B67892273053CF0271172B2F32EC56D3C772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3b8db5ad35d86798afe88d47b4b6e6bbb6830679cf4d419e9c783930d01002d6
MD5 75004c0c3f13c68b430d3af726102473
SHA1 794549f458afbe74eb2842f1f896c4f0e4c8df55
SHA512 46820543e35af0dfffd8254d11679124679f2804b8cf52d53f842f4cabe85e7ca9f33eb200788f87fe46d5e4daea2a6309b26106807dc1e622287053297eee9c
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:OQRQyi36YOcPQLvw2gAf+PN3KvIdj
TLSH
T1AA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a53a4cc5f9d41f8fa17f5e7071ef4dcdd1ece0b3425622c4098d7f868aa0a3d0
MD5 b67ccab962ebacd36670edb103af8549
SHA1 f37d7dee7f301d9d302b6d671f1c7f51dc0f2117
SHA512 0d84c2b46c4e328ab60f8fb36c3f562fcffa3fc032250227666871558a644660182c36964d8920aaa6dc816e2ef70ca30fcfbcd1cebfa8cf2961b4a5f6a2bada
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:IQRQyi36YOcPQLvw2gAf+PN3KvIdj
TLSH
T15C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ec0ecd13b6880914d03e1c8b5f2515b0e2780fb55176dca61a5900a9c5103fab
MD5 38d6f39bd4f75d71494d05c072b3a3da
SHA1 8a4e91b73ecb26b75e19666c6eba82d15535991c
SHA512 4aa03f7188351b0e36d9e5013d3567b137b729b3026e45ce84308ba093ef1fbcc52f19a9bc072dd789bbe2b92b62881f614486c0d3bbe3e2c4c4c0009f201bb3
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL03/KSWITnbD2sKJR:X68Qg55nhheWu7PNU3/ElWI7f2Fdj
TLSH
T1BBB54933B2F600A9C45DE1769F4A872196D27C718FE0E3DB851173161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a11b916ae25f8c3e9121129f1c7461ab2951b9202c758234fa3fa600a2905055
MD5 d76ed7575d68b9aa7abf7d0eca0345d3
SHA1 77bb302bdc54171d36efec58fa9e507ab2a5d7d4
SHA512 02218a740cf3fab4a5ac27d78737392765f66db29b566f1d3b468b1e3f93e5697644be38f7bd5ca76a254e0bc486126d8d7561848a2015239925fdc49465d681
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:Yy5112gYy5azzVvL69nLKnhZxvIdj
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 af8152ab708d8ed4ce8472648d83e57df36f7bae6677c1557240ab1504c0e9a1
MD5 0a6f93bae9ef6100e102bc481b327f04
SHA1 feb2678fbd6fb109c7824bf9eb9510d29f6c1b5a
SHA512 14d878e1d6c08c0cc70461d288cf34486a1e75c2cb8b3bf2fb9ec0ffbd97e29fff39b0dbec6d50b3effffa10338354c14e09d0f1940ff221b31cc267a2991cfb
SSDEEP 49152:XB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqlWI7f2Fdj:5u6JmVxd2dKvIdj
TLSH
T14DD59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1ecab9f33e85bda3d131e1bdbbd1cd40a5cf92cbb3030361a5113b0a88ce491d
MD5 8a1f1cbc57d7f3fe920c275c95f06311
SHA1 c73f855c48ba56505d89ad659a5bfd7dce48b938
SHA512 53f0a12fda2a88e0a74a658d7e5be50b398bc708786f0aca5b629e854efa826738a8faf50fe5315815b83c290478e96e6f7cf439e0bee9315dbefb30dd0a9fb8
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xOlWI7f2Fdj:RmifPbR3vIdj
TLSH
T16CB5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e73f6fe0e646c6b2cc9b9196a874688551072de96e857429fede9e568a32a0e9
MD5 0a55f3ed698222e9d9266bf1d3ebeb69
SHA1 6e1062dfeb59d761c02f95f36fd34a2aee52756a
SHA512 1d2e309d7764f067b2d556cccf5eae527d9e2a715898da357c1b83ab35bda493b76b685708abd47f219d65798c7d718dcd3681525325f937f90ad9f785103054
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqflWI7f2Fdj:U5dKTi61NvIdj
TLSH
T1EBC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3763c36e1a05dd15db0cf396fa8e6578d844176d9a2057823793d2a1038b51b2
MD5 e0782b3684ea1a2a0c7641495d6f5ef0
SHA1 0659dc5ca13b0830ce377a2dd521b1d3c3f25f52
SHA512 dddb09ca2e81a3b9abb64fd17ef529e84c4e8e8cdc59762160d29b7f197cd897ca82d18e647c0e49368c94ed57cd17342d8ed2338dea1eaf53cf0ce7affc34f1
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wylWI7f2Fdj:TX2iyphrvIdj
TLSH
T18C95BE13F2D900E8D06ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1aa7189b1c8371fee03caa4734a30c5d380cca9f18636c2892c616c6d386cee8
MD5 6386eda29f8a8749a2749735a8cfa59a
SHA1 e20d134889f0fd8a810c41c7eb51db7ca1b2449d
SHA512 e286da74b25384a0d91cfc01340668a246657849325f72cadb70092abf7808da202a81b55190551900afefd799dec1e7c1e34ebedec2eb1e54d8a9b60f454a0f
SSDEEP 12288:uzAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:uz/KSWITnbD2sKJdj
TLSH
T1EE4523064B6B48ABE5360EF195DAC0DB87DD7E923F60694D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eb77b84bf8ed77ed0630f5d510293bedf632806f02a08fed6df302fc3b888b7e
MD5 856745c97e5e32e66e8140735dc072c9
SHA1 9ede189a3d9f38475e7d505b8a619aee42dcfbbc
SHA512 b193e48fad2625056790c76a479070fca5d46d9054eee77ef744264a3ed3607f5f1212bda305cc7df00435325effa3a832b1658308ac10d90ef8273871432ce7
SSDEEP 12288:lOAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:lO/KSWITnbD2sKJdj
TLSH
T1044523064F6B08ABE5360AF155DAC0DB87DD7E923F606A4D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b70d366c6c9c2f96f7bad303aab52c7fa9cf50cb230d201104694a2b57af88e7
MD5 49446122fc42270b2f8d9e06f1e2f3b8
SHA1 e026d7c37042b64e2e848fdb5822cd9a322bb5bb
SHA512 631058553d6e634820feff2c37e73613c7f33b39b0535e9322647536305bf66eb7175d9252d7670a346bf874b053f723c9035653d9005e53ec41b27690d35578
SSDEEP 12288:a4Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:a4/KSWITnbD2sKJdj
TLSH
T1F84523064B6B48ABE5360EF555DAC0D787ED7E923F60694D83733B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c3e7e4e8456e9762f933ca43822d55b4fca4b9c3ffe6359fe207109decff24ff
MD5 3d561a1e129922d0341d22e2c4db93ab
SHA1 42e61dbd6378fead753f41edbe1ee087d7b4d20f
SHA512 a6ce5a82eec75d2799c5224d958961f1361d8c9e542a5b6ad32906522aff18b148ae78f29f69380df2fcfdb076c34eac8b7c172baa04d862a5b29dfb3cbb506f
SSDEEP 12288:nVNAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:j/KSWITnbD2sKJdj
TLSH
T13C4523060B6B04DBE4774AF489A6C097D7F97DD13B306A9F43622B1B1674AC4683CBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c43b560ea2d15e22cfef5051284c0c24a3e09210d3852f0a1a47608744896582
MD5 86c8c13fdfd811407cecb10cf2144327
SHA1 7d5e3ef38edcc40dabedbd068119177469ababe6
SHA512 de074ceb94dfedbdb8050febe5e0d62a2b43832e323ed790ded373ff10a853fdd5fd4038b3a43d3688ad7ce61953ae2cab991574cb9b2983da722ab6448869b6
SSDEEP 12288:VFAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:VF/KSWITnbD2sKJdj
TLSH
T1C04523064B6B48ABE5360AF155DAC0DB87DD7E923F60695D83733B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6e824a977edd2e8ed39695080e138e4e9cb7ab7e98c4f383ffba31f344a5795a
MD5 6a9713c35d4d6f9c132e51d8cb944d77
SHA1 e00d494e917f2b572ec7c07899b06ec3a3986892
SHA512 b4ddf38b1b291e8f6d2dde02ab4891ebec309a719eec73aa920acb8ed15fc61f283bd85ad3dff3a07de6450b52e7452351ff494aaf26350835188d1b7d94a233
SSDEEP 12288:EKAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:EK/KSWITnbD2sKJdj
TLSH
T15A4523064F6B08ABE5360AF155DAC0DB87DD7E923F606A5D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0bed0b181d2690593142ac710a5556131efdb18e02f95d35436f8e976b557c5b
MD5 47bb8f6a6024cef7c1f7c8403c648360
SHA1 52ad2caf7307cab956c9cd9fa920a373f1c13ac7
SHA512 02d241df545a2447afb3dac13e2c6149e0136f54ee858110834d77c752d748a77bbbb2447d108a82386cbef0bc095d06454fcf54c74bcd90c020c511abe7c578
SSDEEP 12288:7GAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:7G/KSWITnbD2sKJdj
TLSH
T1384523164F5B08ABE5360AF155D9C0DA87DD7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c4b054ff4abf1f03c3f6d2d0246a83973e88a134de706ae61a09fef88ad1d217
MD5 5afa41ef25e6508420f2b357757e85c3
SHA1 0b5c99a44c85f8b0a9333408e7af941c40e350c0
SHA512 62b8f5d41a696c1df76e2a1d054ace426514dbcb48bfd5b2d99c5b5ce7c7340b887c447e5b7331aacfae5cbecec59cb66cb416be98bbe3bfbab5cdc0dcfa97ca
SSDEEP 12288:tiZwb6zzFEoS2cPvyuAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:wZMSzFVSOu/KSWITnbD2sKJdj
TLSH
T13565F195B3A018F9EC67827EC9658946D6B27C561B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1d1020a648806de42a0918856b5e70c1712ff90653cc1913f51066b2adf8577e
MD5 42765897c242bc60f5d1cf71cd66c9f5
SHA1 5b4a5c8657fe563167c5611a2fb6cfb89b9fc81d
SHA512 c28a862275d6b5db0c9574bc9437836fc0d5f3a8d8b926d67f3cec9159b6bafabe14b9e3873ba4fdd34af64462cde010214cb2f7e22d2d610c7e43e9aa65ba2d
SSDEEP 12288:AXAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:AX/KSWITnbD2sKJdj
TLSH
T1044523064B5B48ABE5360AF555DAC0DB87DD7ED23F60694D83733B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a9520d5d0c72172b9be7f23dd76571ecbf2378e0801340df72fe46fb0bb37652
MD5 d4fc3774fb161f7037f2845f49f23b43
SHA1 5a18837ca33a6695ede39a44b28dd9ac0ba56165
SHA512 328503342e70d04ca360adf8ffdfda96f9207c190bf0bca729923a7038b52cb77e4dc17bef69c2803a868e23afc4d38e53a62b4845c427577953c0ed36b51007
SSDEEP 12288:G7Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:G7/KSWITnbD2sKJdj
TLSH
T1014523064B5B48ABE5360AF155DAC0DB87DD7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 46e851ea5999e0dd67b3041406726dd18595e3b97e01fa51085833264d087f36
MD5 af1d5ad7203478f92af0f3bd0a27c570
SHA1 d81168620872e6692baf71d7aca6c28d3cec9375
SHA512 26f60772b7481c9bd74658184e379212bfe20c6b3c4f84662dce3f1e56e01863dbf54e042dd6c8d0eea3bbed6fe6e5bc4962d0a828143ed7eccfb66d1bb7dcf0
SSDEEP 12288:UyPz5L8yAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Nzyy/KSWITnbD2sKJdj
TLSH
T12F55020767A630FAD1374678C8A64546E7B678721B209A9F43A0173B2F376C09D3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b2d595c57d36e485e342fb3227d27a5fe6e2feb3f83db970d7e6c070cfba7cb1
MD5 eaf94f762741c60ac6a132adff75bdea
SHA1 d739fa8985a551830529eabb0723908e29f38369
SHA512 5a3d1c71690f017d55596dc59c9d5716a6eaa5926c4fcd04c597e3479d32b4cd7ff71699f18dfa83bb6a7b3ac01e8e94cc350b54eeee2cf8727b62fa6f28264e
SSDEEP 12288:OXAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:OX/KSWITnbD2sKJdj
TLSH
T1434523064B5B08ABE5360AF555DAC0DB87DD7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 575671ea9d8e12e6b8175f782e99e68c53c8727efd57bcc1db51e10300480523
MD5 9ae31e424d2541efe28f32453b1ec01b
SHA1 4fc27f08a6fc4904f4cd844cc26cc5a562885aba
SHA512 171c428ec76c98dcc8563cf41489dd97ba13f494c5433c5dc18a7b167dd1e1a622391605011642f9fbe23c975684937f26ab9aa137e8c1ea476239a05bf0dfaf
SSDEEP 12288:0XAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:0X/KSWITnbD2sKJdj
TLSH
T1084523064B6B08ABE5360AF555DAC0DB87DD7ED23F60694D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 569000dad768fb490e6a41725d20cd28b0f56299ef9ac24a66fe9cbbac32d3e5
MD5 12db70d96eb307821162a1bf63297f76
SHA1 6bc81099c059863163c1cfe70b86f1609510009a
SHA512 8e67701c6c2652a9e697c1cf8894879748f35e659a53f543237817822c32ad9c80e75a58fb9007d1c91dd0f2ebb2368f1a4535d33bedfbbe69605e8c3dce5b7e
SSDEEP 12288:VyPz5L8yAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:8zyy/KSWITnbD2sKJdj
TLSH
T10355020767A630FAD1374678C8A64546E7B678721B209A9F43A0173B2F376C0AD3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 11e2210a0888f5a8b2c0fb004d7ae68afc263daf78291e92330617918bff7a3a
MD5 bb1c36e8942e9cd6039e1646bf75c9c6
SHA1 825e654310016de28f8993805aca473f93b8ce07
SHA512 c1c78fef95ae93b1e342759eefed006af581364e429ca3ee29a628a980324baed6ff2cd00a5a5f3a9cf2cbca08bea2fc440c829b0466db100a7271ceb2799600
SSDEEP 12288:DCd9eWYoaLHF3z0z04PDvhoAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:uTHaLl3z0zDo/KSWITnbD2sKJdj
TLSH
T1C465F195B39018F9EC67867EC9668946D6B27C560B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0332f91641560f7fe34c4eab278a9857dd5736f411c493718d3ab47c11109c9a
MD5 7690c13ec974dec3d663147062f24998
SHA1 2037e84ebc974a7b0eabec2d19098160b2d27294
SHA512 408797f5c8a337159f053928a8ff6fdacba540c5d646f33375346fcb5941f70b450a00d818905c57107259da386a52d81e72fb75eb48b6c7e303eca7bee54eea
SSDEEP 12288:/i4e7+RdTfgwCHKy7GLbbdIvxAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:/37d9CHKy7GZk/KSWITnbD2sKJdj
TLSH
T19875CF90F3E414E9F0B79A7589768512DAB67C591B31DE8F03A4261A1F33AD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 676b6dbd13a3eb6a70e5cffceab4df8821a04f112dd50184f8b41d93399524be
MD5 3b0bc6275079546d1e87a0510f4edc66
SHA1 88cc150722cdf77d20760f56616b03ac23324203
SHA512 d5a068c6f8377da5461a8412b0f2a2fbe17a321e0cebc902221e290523cf7c40c9a9201111f333123d74be7d77a913d3456564bc42807ba7ee6973ab5918ad1f
SSDEEP 12288:7YAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:7Y/KSWITnbD2sKJdj
TLSH
T18F4523064B6B48ABE5260EF555DAC0D787ED7ED23F60694D83733B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 be59ecdabab60a9777c63e49c25a4aefa422b303f92afa75d3218d8b5dbb16cd
MD5 fc7dfa996027dda8714ef60c098d9a27
SHA1 5c98d3969e66845baaf65f5764f653f6d332a4c9
SHA512 31f7c9c4fe2e1ca7a2f9d6de6ba175224c7a7393db1530d4439d31e40da0b8aed423d715dd92f5b59cd86c3b4bd486dd4ea638b72d44ae30cc449b3ec12d0c00
SSDEEP 12288:cSAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:cS/KSWITnbD2sKJdj
TLSH
T1D74523064F6B08ABE53A0AF155DAC0D787DD7E923F606A4D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1adff19866921b68dbe98321cb60173c461c539d7d38af30f6600dc5a3ce13c2
MD5 83ed29963444e8010de6ae28e281a658
SHA1 7212a0eda8fe9d3419496fbb17ba9ed6fff6af6f
SHA512 2f4e34ecbf5a375cb144aa15c02c31fc8bdfd1f2516b341121914bd0524e2d09bf67e336da16cf930523707465c4627e2e73adfe0e48858a5422fced77a14e1d
SSDEEP 12288:7xAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:7x/KSWITnbD2sKJdj
TLSH
T1DD4523064B6B08ABE5360AF555DAC0DB8BDD7ED23F50694D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ed1d3e0138a2c867235bddc458659d52134a99f1f9f64cbf5ddbf8b729f73a8f
MD5 1c342cbe1f62edc9bbf4d8b5f06625f8
SHA1 d239fb16a05a814e3e497c5da8d6a63105f7f31e
SHA512 95b3f161abe3d15efb0ff60360af08e508281f30e7301b795419ed5d3f901d62fe933b269f1f58dcc018dd65f502336180350b33fdbc87b34fb3125e213751d4
SSDEEP 12288:/XAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:/X/KSWITnbD2sKJdj
TLSH
T1654523064B5B08ABE5360AF555DAC0DB87DD7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e21c6fb158cb810762cb7dbbf3328188b3e6029087abd329a021921ef4df93f6
MD5 6777167ca7a14b36bbb12423272a2ddc
SHA1 52901b8581b61794b182e2ae31c68b7fef481c68
SHA512 2a8a29598853f0b90a268fa8a2344592d24244740882a902ea1ea873c9c74b5b5442ff2f73dcdefafed4dd7a70d619fb1d570981a5c7cf009652f7561c746e33
SSDEEP 12288:KYAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:KY/KSWITnbD2sKJdj
TLSH
T1AB4523064B6B48ABE5260EF555DAC0DB87DD7E923F60694D83733B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0e01eb10727a802a21991a5aca2e6aa64d760eed0674ec052e26fc6b653b6887
MD5 2873b5c9e2798d5294bfdc2fc6519fee
SHA1 8501e716d81b54dbc1c467f4b65e79aa8bc607cd
SHA512 5d0f8cbfa9f69f7a1ea13a24b127e4487a3e4da24cc689b0d064c952b2eb60b839689390d1233d4dc77b4767ce759049b63d49956edccadbf58b184e3abb17ec
SSDEEP 12288:PvAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Pv/KSWITnbD2sKJdj
TLSH
T15F4523064F6B08ABE5360AF555DAC0D78BDD7ED23B506A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f127dfa9a1b71b93777592a9fefaae1e5a5e53fe80cffab5798eff1167df3a52
MD5 191d4095973af9d120ba33d53633f991
SHA1 8303c5f5ba0e228c68afb10ab101751633f44d3b
SHA512 6ad5c2d3c10fc51d61ad00797ea0bc3b077ca039f3ac21c002d392fb1e3bcfee3331e900ab17b79001d909e3446e3d434a5b82d5a12d822a929aa05b6151d4c3
SSDEEP 12288:fFAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:fF/KSWITnbD2sKJdj
TLSH
T11B4523064F6B48ABE5360AF155DAC0DB87DD7E923F60694D43733B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d435e4708bbef1588d4aaea7a75f8ae770df6256d2a7c8990eb5f3c5c3d3fbcb
MD5 5295cdb4f7e00d151edb7ee3c3b258db
SHA1 0176770044d57df86120f7f6b4ef9fd234e8df7f
SHA512 f901206c9e25358be2e422c0a182754b6a3d76df4a4c5c674f6df544b1922145ae83782bdac904b563b7d263a95fccb8ab70f9eee7fb5208861e7682bd694846
SSDEEP 12288:JfwvD5uX64Lk3tRX69qkyAI5BAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:Jfwvok9RX6wkyAIj/KSWITnbD2sKJdj
TLSH
T13A85D029DBDC04E6E177923C89B7460AF6B178691B31C6CF029A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ee3eccfd79092174e6625ca374b518aa6df6632dabb2ec12ba083538ee0b25e4
MD5 8982bfb302314b1afb83e29c4792c874
SHA1 c66426e90512daa102cb4257e9e1400b15c62921
SHA512 9c66b6dec103f3e27a1c2683c591cbd7fc9dfb03e89125629d7ecc58fe30d36ad8106519277f2ef265f58c32387da0f7005aad572de18ac7b276c70039f7572c
SSDEEP 49152:YYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0alWI7f2Fdj:mySzPivIdj
TLSH
T12C066C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d209420936385166d0e78a3d9b9aa39e0e3db4e97b14f37199fe8e2abf5b8cd4
MD5 e4c919425e381897620a0a7e3f712cb0
SHA1 67674b12f3f315d425fd86dba55a7a63f204d508
SHA512 63e3dfadb87857f4ba141c2b770ffcf0384aa378012690213dd32e87c388fe854b191b8edaacdfc943dce158049d3ba5c1ba0e492a626436d0bb20e99c22733f
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYW/KSWITnbD2sKJdj:x47JUQj1irIhCnDHUPfF/qlWI7f2Fdj
TLSH
T13465AE1EA3EC01E5E1BA827885558A5AEA71742E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 74bd88a5f99a536951a7be8e046d351b49d593a5b0d060f2ea8c3bfc3cd27199
MD5 faede49a5d7756c67cbb8d544de3085f
SHA1 fd45551f194146a26ca7b11a4ab96f5507cb1fe9
SHA512 bdb9f775f7784960707bcc30caf0e004892ea310a3c10da82c347d047db327f2aea58b168e544c380e3de0aff571cf94b7c70b3615ad9d9c0637f21b784df900
SSDEEP 12288:ENsfHAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:VH/KSWITnbD2sKJdj
TLSH
T17555F00AC39801E9C06E12B5C7968682B3677C6157E0D3CB53D1FA3E1F75A80ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 55b286218674dad21769e0a97c134aa5b8e061e12b8c0d1f07bdc3f95baaedb3
MD5 5f4db7441232c228d467af3e40e39c58
SHA1 daeea875b7f752e9b70899d6098cd572bef45c3c
SHA512 a033a9fadc5d590b474100679e04dd7b62f37a6a981af82735a50e18a7215f3dafdd25fdb99608dc1d20219e72a50fb42dd26803089d31cddde3d515b196bcba
SSDEEP 24576:EbSVFUPFuUqSDC+Xo5w3UI9GmalPKXkz:TFUtoSD1oCE+xa9KX
TLSH
T1D6450701722ACB4FC66940365E76D6CCAB707D45EE046F0373C98B3FD476A59B6E2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 800fb9ce4b5d258eb0961a4f15b03e252286e586ba318be556e95889a82fa0df
MD5 ec24dffca543ad3d3af070f221935d5d
SHA1 5d714b176df4f9dbf92c62bd7ffe136fbbd5a1cc
SHA512 c453e88cdf41a676649683fadd32a1a5bc68fd85319d9a889d6e2bdfad73923db5fd86af0bdde14ba794fc0305155610de5dec21f67e456ccc46c717789720ea
SSDEEP 3:OlH/lQzptotval/NErO73U/5l3yjIl/lllo3mCllltGlslslslslslsl6/:KCzptotveNnQ/7OIXymCtEEEEEEEQ
TLSH
T10D8112380F800B25DD5AF8324857C784D3A2F20DE480DBEF210111532D21AC8CD92BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e275562bced588b4f64b008f6f970609c7d6d32c70b415b2b34090a420db2e3b
MD5 9bb4ae1ab1d6db66fa2e726907240b7f
SHA1 e652bf1498dc37f40b4083bda6c6fee5e0953ba3
SHA512 4ca1cf0fe550d9b69b9d793a1f9e3bae29fc83f6f297ba546d3067460d580806c0366e279e8792d8d6c86f83415b20c9361a3c0cf523bf0797fcd47a8816b556
SSDEEP 24576:H+gY18Iah0pkj2PLuwAIKsrtrGptmnKC7i+36QJVL4:G18IahhtdmKC7i+3fJV8
TLSH
T11E552A0165B7EB0FC9BA903B423286CDAB785C07B7453F0573858D38986795EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7f261b82eb8eef19eaf18ffe56240a48577b3568c52620c4d802c8956f8e86e6
MD5 fd2be26fc2c42e6473fad4e82a17876a
SHA1 06ad73a44562a69512e7e0fcbffa54509d839819
SHA512 33d09b112e76753c4099a5d090d9e312b43d23f0462513397ff07e9a7022b165d0ab8241fe38090a6939eaf0b4d71f17bb39f51f80ede20aa191e15c90f321db
SSDEEP 12288:TM7PAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:4P/KSWITnbD2sKJdj
TLSH
T1364523124B5E5C9BF5360EF055DEC0A6579E7EA12F10A5CF92223B1B2174DC4AC3CBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f2d61d79266238d0d6dbe2cca43032e7327c2c9af28785ca1bdd7e7ccb84c450
MD5 1babc18f7173d308fd057041034d9a44
SHA1 b86d4df2a5eda18fab06c8f41b48dca56079b21c
SHA512 25c42fe663594c1e9a0664403b08f50547eec55e4bf296db1c094dbeda64abcae0d5a63448f05500f500b015fba4c20e4a2b543b72831838d8e6a8f303ada5d7
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYx/KSWITnbD2sKJdj:Xgb4mBIBhGFQlWI7f2Fdj
TLSH
T184659E1E22EC01F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 23a6521568a5e6b5476abaf0b58a26b8e0f4d2976448759852666e7829f1cfb1
MD5 5e416988398fefd7a9c519dd5efda6d2
SHA1 b86ee32077efe65d7bd2e996c56fee23b5b746ea
SHA512 ab7543c6d51fd400383bf9f39c1b0a7bc3c20f8fd29a9584214000f02035424e1635ac91dca2ec23c9634406c57323ba19799ad21f9d30d8d1d2e0b0f56f845c
SSDEEP 24576:mG88u8FpJqH1bzria7/mG/KSWITnbD2sKJdj:t7ZFPqVea7/NlWI7f2Fdj
TLSH
T1F885F16567E501F1D47BD138898646A3F6B2B8211360EFDF07A88B561F33AD44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3cbd3e54f0b539bf8546319d4703b96cd284ff013f535bd62c8f71c7cd9ec03b
MD5 2033bf920308985dcdcd1318197ada5a
SHA1 ed80629409e7fa9608e7b271b8f178ff2f012631
SHA512 5c73b279a665efb3ec2d9ce37e50b2e8d70a3d97ca270304c64b6aa878b4eaaa85033ba1c70f4937d6062575d16ed5ff84c44206f32805b6b5499fe4aab1dcba
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjslWI7f2Fdj:tG05lO43bhvIdj
TLSH
T1CAD5CF6A62EC11F9D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c7aedb0488b8c22f1c4614249a2f997a1d7c735d3d0eb87325c97a809cc6f49d
MD5 f5d59ab376c9d79bda22c7d83ae27a5e
SHA1 618d415e20f0eb12f234f4af2f457f77504ad801
SHA512 b1324a924b8817c9287f9e830085c8f2e084a95a95ed7f76dbc0d43216ceb3240caf6aa979d9a477783874b229f4fdd264b6db349003ceda04f270cb1a2111e2
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0/KSWITnbD2sKJdj:ka5POZ3+Jt2pasx2+mElWI7f2Fdj
TLSH
T15865AE5EA7FC00D5D5B9D17DC583861AE5B1346253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2b7207a595d333f997969e8fc537c1c4d7f1135420102df618aecb111e67d07b
MD5 f68821b28dfca7c38b172bea1258710e
SHA1 b4db78c0a171c14fa6e99eecb6aac66ead623819
SHA512 549e11512b634ab4a8fb82aaea27d7d7ec54c78e0e80c8a87d74f71a7b0e38e3fadd9758da3b4a9331c87936b10b2682a89eda6ac24000359c156eaf84cc72e2
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7Fku/KSWITnbD2sKJdj:2Nc/zEOVHFtlWI7f2Fdj
TLSH
T12F858B1623E901E4F1BBE1BE89779546FAB1786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d56f9f79c0ce31e78ffd3e3d6dec4041e7d2a204bae59cf5e7a82e57a84375cd
MD5 2be47a9f3adbf6d8bbf627d9940ea97c
SHA1 13c8bd5fd1c9faa05e918af4ee7f7a659df712b6
SHA512 0ebe6b865fd6380eaeeaa386156f8803e72ca78629158e447cc3e3f71d8e475344cbaa094be48bacdf12b4a6a08e321dbf270a005dbbc0b659342033e4487639
SSDEEP 24576:x8kNvNnaFeYhJNtmZBmQ/KSWITnbD2sKJdj:x8MwBtOmOlWI7f2Fdj
TLSH
T1CB55AF2EABB805E4D1FEC6B58D238512EA727861173293CB5390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 17d2f5cdf29caef754835ec2e3ad9b00e491ea1b05dc3b53126ba30c0eba4ba4
MD5 75e8793df1cc8ae1c3c36f987c2b2fb3
SHA1 57ea4a39fb73c65aaa7a94ba543c2216419b313c
SHA512 acd181735e6b64ff726cfe0e95fac698394c5c7ecbb4823b542063b227939c17c3974ba6748f06e9d2456259b9c03141f2cdbda3e87197c0675d970f013e2fce
SSDEEP 12288:PHvUrBFrEjwaQ6Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:PPUr+NQ6/KSWITnbD2sKJdj
TLSH
T1A365E11F17AD1CE5E676A17D89868619E771B862171192CF02E1823F0B77ED8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 72d6766dd54607d59b9f2cf5f4b57b97baeae89fb55ac8c78f1be09e99b21a2e
MD5 b5ef4cdfb05e0f4efad9cf9b9f4e30f7
SHA1 7fa443109127a4a3406eb3a35c7ec79c8f3cf2df
SHA512 aef6cf576ef1417704b3ae3b230e870ba5b79783ff2624079b80b8477eda88d154e66a7fadf1b4759d5d329aeeba4b82ff20ebb70dd5b532c77f0025fa0f1f5a
SSDEEP 12288:mQcMxWDXN1Dp/fshBItT1IQgArAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0B:cD3FHshBIYQgAr/KSWITnbD2sKJdj
TLSH
T1B875E13EDB9D04E5E57BC1BC9AA38506E7B138A9032166CB0290817A1F6BED47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-57-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1512-108-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1512-51-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1736-111-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1736-319-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1736-112-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1736-118-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1792-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-87-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1792-332-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1792-81-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1792-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2016-331-0x000002640EB60000-0x000002640EDEB000-memory.dmp

Download

memory/2016-395-0x000002640EB60000-0x000002640EDEB000-memory.dmp

Download

memory/2496-77-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/2496-72-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/2496-104-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2672-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2672-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2672-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2672-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3492-62-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3492-68-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3492-103-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3936-167-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/3936-7-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/3936-138-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/3936-1-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/3936-130-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/3936-0-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/4352-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4352-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4352-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4352-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4352-287-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-128-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4420-132-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4420-122-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4420-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4420-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4592-316-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4592-98-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4592-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4612-38-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/4612-47-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/4612-102-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4612-44-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/5836-171-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5836-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5836-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5836-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5836-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download