7813f9f276b80e2ed39ed99397161055a4af45ca2d7e7abd67599f7d9a83876a

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
Size 4.8MB
Sample260701-t734eaav5k
SHA256 7813f9f276b80e2ed39ed99397161055a4af45ca2d7e7abd67599f7d9a83876a
MD5 b64732f008e82b38f6de25cf8182340e
SHA1 b9ac66a6b9f332d1a0d81ddd0ca2fae03a99be47
SHA512 9c630983862f0c374252b7cbf56fcea0f6635093bfb8ec5f25618bcd9655ead8652f21658fc19dae607d0f94a9c2b7a652aa2de00e4c3696ee4a3f292a17ea27
SSDEEP 98304:QlscWLZK3L49ndP8kzJQkEZk9XvnMMzMMoMMxs5nU023W:QL3+QZk9/Znp4W
TLSH
T1E236BF82F79184F1E985467A21E7673F5F36A700933AD5C3DBB02D6099222D1A63E3CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2832	elevation_service.exe
6636	elevation_service.exe
6316	maintenanceservice.exe
2856	OSE.EXE
6232	PerceptionSimulationService.exe
4616	perfhost.exe
5044	ReFsDedupSvc.exe
4380	SensorDataService.exe
4816	ssh-agent.exe
2384	AgentService.exe
6020	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c7c42800e819cbc6.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_88796\java.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058bbfdb47809dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071b1b8b47809dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005b678b47809dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2832	elevation_service.exe
2832	elevation_service.exe
2832	elevation_service.exe
2832	elevation_service.exe
2832	elevation_service.exe
2832	elevation_service.exe
2832	elevation_service.exe
6636	elevation_service.exe
6636	elevation_service.exe
6636	elevation_service.exe
6636	elevation_service.exe
6636	elevation_service.exe
6636	elevation_service.exe
6636	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4216	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
Token: SeTcbPrivilege	4216	2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
Token: SeBackupPrivilege	5044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5044	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2384	AgentService.exe
Token: 33	6020	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6020	SearchIndexer.exe
Token: SeDebugPrivilege	2832	elevation_service.exe
Token: SeDebugPrivilege	6636	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 6600	6020	SearchIndexer.exe	101
PID 6020 wrote to memory of 3932	6020	SearchIndexer.exe	102
PID 6020 wrote to memory of 4244	6020	SearchIndexer.exe	103
PID 6020 wrote to memory of 1196	6020	SearchIndexer.exe	104
PID 6020 wrote to memory of 552	6020	SearchIndexer.exe	106
PID 6020 wrote to memory of 2468	6020	SearchIndexer.exe	107
PID 6020 wrote to memory of 6912	6020	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_b64732f008e82b38f6de25cf8182340e_coinminer_elex_glassworm_magniber_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6316

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 319c4d42caddd6b43b7967d7b7034f96ab7fc7670359ca2bb873bc9db913b386
MD5 36d6fcd1cc94f181b638ed9b309534e6
SHA1 876f92cce41fc7b4aaf0415835ca1f0f33614ed6
SHA512 54c736b23a722bd36c25f76be171a0dbb1f4b076d0044b3480057ff65e508e331b2cf3c87bd7a50989568c0ce99b270a35e2431d8d21a0de3132f7fc57cac30f
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnFe30jaNf1TWbdz:43q6sjBAU023W
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 037097b5352ef09666d599e82838a0b280b55c72410d5a952ca48b7eb691b10a
MD5 325ea73e45d1e00fdfe5518ad7d5ee3c
SHA1 f120848e343e4fd667ba214c22efc83605e4518a
SHA512 bf0b009d57724767178cf425a94cb665a5574903c23b6fc51abb5e694e054228971daf1f566ef6e61a2559ed1508bd36af5d1f13758a704b215871469ea073e4
SSDEEP 24576:9XYfDtczARgXe4i7ojhsP5Lgrk1TWb4AN5:otc/e30jaNf1TWbdz
TLSH
T1C265F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5a4f14741f344a5a878d27ce32d9ec7bfd7d603a9f7a1b4191efcbcc9eb3bda4
MD5 a6ce816fb192792fc7247234899bd91f
SHA1 1dd9131bbbb08a8a11f5b42457c1fe30e43e856a
SHA512 7445326e91ec30aa8bff3a42120744c8d76e541b40b94d1f51e6ba2c1831f0c288dd4c3b6a4c1b335e6bc812b081605d959fa09580a69573ff70b252929f981c
SSDEEP 24576:w0Le5ji0hmxxrMKgXe4i7ojhsP5Lgrk1TWb4AN5:wPji0Ajye30jaNf1TWbdz
TLSH
T12E85AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9b17ecaa4e32604b110e4913cc96d2cd702a80ecd2600511ac5c42758bde4268
MD5 34ede9acc5115350f5f201b7b7bd3db4
SHA1 c5e945a21c130cf1979b03f4904595dfd5de9170
SHA512 6f031073bd7d7ff7ecaeae5da7d7f3042c974f2b6c952e846f486f718cbdaf4346d860109a197a90e856b2bdd30a0edb369d12be9aec422c0039c4351cc7c2d8
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuYgXe4i7ojhsP5Lgrk1TWb4AN5:p/ezSC6vUzPveHjy+e30jaNf1TWbdz
TLSH
T1CC756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 15d1a960cc047aade2baf7a586ee07efccd0e50faf0435508b1ca8425fedc7fa
MD5 f0730c504bfe0cc8a3f4e5ab5af122e5
SHA1 a71a08009bc2f683cf889917b2f035ac37306613
SHA512 c68f325efe12641c265f42a9eb038bca4f21ec77ce51ef2ff9db201dd79670e05783dc142ab5433ee6bc256f8780295765b621ba4eac67b2a695a42140cab8df
SSDEEP 24576:MVbqPb88hv/l+YlgXe4i7ojhsP5Lgrk1TWb4AN5:MVO88hXl+He30jaNf1TWbdz
TLSH
T1E7559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3170d0b5028750aaaa488e25d6facfe96070caba2ea7f1a0c6034af57d036182
MD5 3d99e9f0351c63a3821fabb3ecae31b0
SHA1 0fd66eb3e07b3f8d62571404727d9219ad8db0f4
SHA512 01eb86e5991fd0e3ed7220eed7f8e6ffa7efa0ba363286ca2f8d65a43db59ac5fcb47573bcafad61703d99f11cc561bd9598c311c96fc627991eee1652d277b6
SSDEEP 12288:cLKU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cLugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13E4523929F5449C6F38BC3F4A0F7CB91E9A11EC071444E6B47E0FE9319BC89ADAD8059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e42a6a76ffa29d25700db8a6ed6cf6fcad279e19bc31e41f90f85e2d1d13d2ab
MD5 21d4b1dea23f7b6ad7608160d46ce8bc
SHA1 ee38d30f845eb450b3057dd2ba74ec649439ea4e
SHA512 7eb3eef9e7e92a16faa2f2b113935c85167796cdf0a33b1b80e5922ae619dccbde722e890159110d4ec3a4c248c18a6dc2be5b933c30bd2ed06585ac40a9be4c
SSDEEP 12288:+eBNUbTVO86U/U0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+JIUdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11A65CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6507bf4161cb2d34adaa6df1510ca0855b6510ceb93d4c329ea38feda5154721
MD5 75fb591bd090f4c1252262b79ff352d7
SHA1 4bf7ea3e45d0a1b6b237524bd0206d6f8d446bea
SHA512 f1d6bae98304152f696244342548832deb03648192eed9eefa46db228cead13ba8e1187cf0020bdadaa6725cf6c5259cf4ce5e70f9749f416f4584a17eb841bc
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THM:QQvGAdlCEL8c/DRNw5CfU023W
TLSH
T141267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5d9ce13626f698ede05b198bd106ecdfa2a11519154d24cac8e15ecf8c6b14ef
MD5 6f644f51c87d518dc3da6fe85d97f149
SHA1 c0fcdc75949c3626d49808fa83d7cc682094a16a
SHA512 23aca7623567f698168fc53826b6045f3a5c55b603d6e421d7c6980e404e6d31e723e3d4c80f8cca194dc2df6bfd8c7bc250ba5e282e5974f7401a4b53f86f77
SSDEEP 24576:10ewsAj7gXe4i7ojhsP5Lgrk1TWb4AN5:Oljie30jaNf1TWbdz
TLSH
T14275E031FE74E032C3BB0DB21B76C706587C6A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 744a325a192e5d4c9c8d39f58a45d9038f8ee8e5bb6478b7edd757881dfb042b
MD5 41e5a5197ad6e507c8f8adbc705ec2be
SHA1 bba3dee2fa84c0fa9342886678e920a7aeb1c213
SHA512 24263779a7e5a5f3ac40d3fa948e854af961d092849f7a1809fbcedd2e65f7f6089eb96565934c92a14fb7631a1c0d5e3e53830e0150e16c17bdfbd6615217c7
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHap4W:RUEtQevvqc2W1cpV2tI32i4W
TLSH
T10E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9886266619fc68f206d048325f9bc2fac00482ba483816d92eb23e3b68159d81
MD5 64ca96536684d2e29336f49196bc497c
SHA1 37144d5c657c4c3421b7f5ac0a804188d43982e7
SHA512 3ab05659ce5bd42c21d89b1064ac10413a8d19347151f1f9ede5f6ef439f7785d3f58661f1cdf4876964d25a267fb4cf5f4d4ce455542a287b5e1c5226716613
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zCe30jaNf1TWbdz:goquVjnmLU023W
TLSH
T1EFD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4a0a47dc327a5ff01919c91bdf61664eaeff73a36381b35f7ecbcf3cc78fa480
MD5 99e23ba52b8a1b3cf095ba759cd03197
SHA1 1fe67f05c262f05cfbd9e9a855a80bbdc1b27943
SHA512 36b90bf0a4fea2d36f312edb1c5d5d5801c8138f26b05e9b0a4e8e51bcfe2b0aed76e38c9d8e0ba08d6c9e2326de4f75004d9159ff23d4d25de3bc58c47d3d01
SSDEEP 24576:jAhGL3IFoiwtA5l7S53EgXe4i7ojhsP5Lgrk1TWb4AN5:jAMUFoiq57e30jaNf1TWbdz
TLSH
T15D359D81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5bf689bb7d8b56fe08271093fae18756d38df7586285b93475d842135e5a4525
MD5 7d6a77926f0acabcddfa96fd540379c9
SHA1 cbe924a5bdc17a20f9d15c8765354dccc87e7e54
SHA512 838375208d42ab3a2d148889d41ee5f24012890b173a10c1f76dd96e66f5599b835c41155b3d5df128085ced7eba7ed6ea89e9c4d3ee6ceedc0e3040d5758b6d
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+C4U0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1m:bwu4OWXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A65F14676A40CF9E5A78278C597C636F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 27123d68019cae6042255cabe82bafbf58d6f9e10f80639e208af09feb8cf5c4
MD5 ae1bbc88534fa14c36baa787abd53a9b
SHA1 27b166745cef66d70aae42f5d04de87a9c0a3d3d
SHA512 131c41af43fc8ac70a7b7a68db65e27e850c0555e3f07032d696084964e83002fe63b86e187f314bc843e24c7a55b6121bd16d78aae6ebf8b0dc8e42a3fb490c
SSDEEP 12288:JeZ1IyhU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sZuigXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18F55129637E421F9E2978278D4F28741E7B23882233147CF02A096A61F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 694953f7d80179d4f227929fe7b5db330c26e6a7dc06a0a2158669a7d123c894
MD5 b3ec97f3463f26dd13cf25afcdf4cdac
SHA1 4817da3d0c42cf33ce6dbc2753df8502cb2f1a73
SHA512 292384deb53b9a1ccf68ea732ce61d01ca00afca888c008a721ed4654c9ecec5bc1b527554cdef940ad2ab5a45586a613713fe493cfdb07a4c81b3f4f531ea58
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:3QRQyi36YOcPbLvw2gAf+PN3UU023W
TLSH
T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 be87d66e894ca1b9d6c593c1bbfd2d915bdc12c02cdfee3ae790bc7c58e8e1e0
MD5 5a3770db2e3962adb030bffe076072a8
SHA1 8c460f58fc10c669ddfe414573dfdc50f29498f6
SHA512 3c993fb3834097760635796eb7f2f3cc4df73d9cf3163d800b8ea2f1a3d07738bb1e682140b007158be48f7375db270a2eb554e12d0b81dc6c37ddb75d66bcf2
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:FQRQyi36YOcPbLvw2gAf+PN3UU023W
TLSH
T1B0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4495b4413cdea31322c03dd7a35af4bfcfd6b17418fa72d97d06032290a7d751
MD5 68762cfeba868cad45227e2285a34fd8
SHA1 e53de72ec475882e4b83c9e5d2da664abddd9782
SHA512 3ee0f72a9856cf1662549f457968a50b18f597831ead564aede9231999f14c6083c53f315e5444f8cedc05c8a50a582a1932db8368f54ad005ec7aa4f9e7c847
SSDEEP 49152:r68Qg55nhceWu7PNU3/ye30jaNf1TWbdz:1thLRc/yU023W
TLSH
T1BBB55933B2F600A9C04DE1769F4A872196D27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6343e6037636a645d87ff533256a9d4b6ae2f62deef33cd47170ef9aa72f4fca
MD5 9848fca121657cf71ca2dd8c41a30897
SHA1 59f966472eb0c4fde01e515afa11d38a9fd52e5e
SHA512 2f717ef9e4eca5a4aeb01333279adb728bbf23457cef8ac0a941a09d9e1acd6da337234cdbfdaf70ce990cdec54ea6f5e17dddcb8fcbb684ee7936400a7e995b
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:vy5112gYy5azzVvt69nLKnhZhU023W
TLSH
T11B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9ba27d8db95e273f1a9981c822b0c61eb98a75641af76d7cc278a7d95d8124f7
MD5 77e62276138ecbbb63b5f3a9fc4ea28d
SHA1 c35c424a821dd72c54d23d957e4da8707c23ce1e
SHA512 a6756cbcb0cffff8e4cc13f182dd68329d8bce3101fc55e5f6632cf46c8f83880486ae51b158e02aba657edee5c096ebdf353e5b389bc0007929374bcd889d11
SSDEEP 49152:wB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8e30jaNf1TWbdz:qu6Jmdxd2d8U023W
TLSH
T1CAD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 da2ef2ba3ac3c67f9de6957a76c8f3a92957ee6128f20eb25421225d66ef915f
MD5 9bb5ec01da209a7de726869441c400e6
SHA1 7c1ac0bbd771b5413909dcadd08563a4e57862ab
SHA512 f38ff5e1dc71c6fce3db6402e37973bd8e233f996efdf89d5765fc72ec07fedb44fc1420ed900ed610a8b6f7afa2eb102a68585080ac710d07aa2d4011f6e1e0
SSDEEP 49152:Y1hpsNoJpF1A63U44CwH7R4xYe30jaNf1TWbdz:YmifPWRLU023W
TLSH
T1D8B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4704715f2b4ed6e2254586f4c7530e4afbfc7383c81298bda214af480dd62b00
MD5 1f2d209d01e268a03ef176045e6bb05f
SHA1 cdb5d98d9e2217b060d3f749307ff3413f4c98bc
SHA512 c115078a8415616c7761c7e9f0ff54b36dd4cbe7b7c87e774af3794d43104af9c02737c38c5d445b10ae6ba97817a87f5067b2682bbbd9729ee7aa0bf86d3482
SSDEEP 49152:0SuZQIY0Be2KcRVtOnks6NMHq1e30jaNf1TWbdz:m5dKii611U023W
TLSH
T1E1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 54c8991bb153cf668f833a2577353c99c45de7c47af389acf7e635af6036d09c
MD5 6079faedce0878e79c73fbef8798d00f
SHA1 bdf7e6980aba93921446ffb205c4176cacc09803
SHA512 af6e2d10e70191606826e0480bcbdc1280fd6205dbde354964f0bb1c54dcf50a4ab4c989d8c7784cae87c3b35e1e4535fa75b6ac97e41bde491485ba0788e378
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5wse30jaNf1TWbdz:OX2imph3U023W
TLSH
T15295BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bc260e5fcae97bdca846159e8fe9d54a2ca96f7e9615e284b44a032cf7dd785f
MD5 69f71d49a8e12a47241a40dd5f2db286
SHA1 050b0a480b5785573ed86de8ab5c45eac51855c7
SHA512 6985c7ffc1a7c6065c5f8e360e49ac0e1290714212df50923074df5c89a8c46c7b5060354f824f926f36fa6356a8a1c1678ce430fa18bb371a9586aab45c0e67
SSDEEP 12288:/yU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/mgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T109452392AE554AC6E34BC3F0D0F787D1E5A11FC272404D6B17E0F9531DBCCAA6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dcd69147e69aa275d3d4f4c22f00171d5789fe954951ebba1b00b4f377135718
MD5 63dff94f5edfc1fff774bf2e6ae02bbd
SHA1 14d4a4c9ce7a538c6571869886723cef0962343a
SHA512 7aaae53821f8040ad4d85aa359893d6e6a182a89e8f0054039671f6d2d6f76ef5ebbcf2963cbb80275a8e55826bb100fe26ad5989874ac88755e168896159f6e
SSDEEP 12288:KlU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B54523A2AE554AC6E34BC3F0D0F7C7D1E5A11FC272404D6B17E0F9531DBCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 17a05350ff1108e4e81ceaf746e4b466b2f407871f4c92884b30ab909e0e2992
MD5 50bab9b7b11aeb16d3beff6589ca11ce
SHA1 fc92d7e26b7731a41a1f7d282ee12a33f7c994e0
SHA512 e301ba47f62755704f0fbc994aa93c56ca76a7e2690be57f01f7e87f9b4a4d5b293a2408e45888b323df598069ef41c2607f536f784f139bda1230c94e8be52b
SSDEEP 12288:aHU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T143452392AE5549C6E34BC3F0D0E787D1E9A11FC272404D6B57E0F9531DBCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d1e1dfc7c3a28db18086545c81f461ce55c50a0e4ab7ce5e6d182fd9c481ce85
MD5 659a66d03157826496ea5332e2db3c62
SHA1 d957d050f6a3f562c319640a65ee1206eb1b6dfa
SHA512 49705ad01b56ccfc168f5085179b37206ac2a2afd3d01ec91044b3ff7d77c2db710d142d668dcebf60455536ba26cbded2ecd2b2c5055e7b7d9c965b4e2e0a34
SSDEEP 12288:GV0U0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1434523526F6505C6E187C3F4C0F38791E6F13EC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c00f197781c73143f8f3b0fb6bab04426a4df14c63573089a3387a9b1fae8e32
MD5 95eb7320220588bfcc7d8fb60b04aa9b
SHA1 f2df6e47721b7f4677ee4b300c1d0a402a2637d2
SHA512 3946555573c16328dd0c5a85467209723d1be466ab2a17cc39672193ddaa62dffdfec3c327c891cb6c8d99721170462470f1b2b07eb94df118ca86b59f61b683
SSDEEP 12288:1MU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1MgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18E452392AE5549C6E34BC3F0D0F787D1E9A11FC272404D6B57E0F9531DBCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 db3f86cc4f0577fb324038d097017e71be8c21bcba99f1d9a7e6619e08dcf45c
MD5 2a09b09a0bb8b9c17f6eef1fe68e5e10
SHA1 0bfe96870aab5b9a39a3e5135e5a660ecc65b93a
SHA512 29b0ab51f080e1d49067a43f5ef09cbbd4959710934e0382956019be201d9be2577835c6b0b3f0d5c507c457c7e7a24fa0ecebf9c47723f0cf861b00617a97bd
SSDEEP 12288:wZU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A94523A2AE554AC6E34BC3F0D0F787D1E5A11FC272404E6B17E0F9531DBCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 064c0cd9fa6dbc33f783e0efd06c852d648935452349206fdd293cb6114f0f3b
MD5 3ac0c12bf430a484d84214af364be13c
SHA1 a053325ba17dfb6bba229de684e0fb2f3efda869
SHA512 0d74bbf3ac2d6fdb313f0c6877df4e0d0d8ecca5d8aa2b9828aa8e8fa9a0f5addf55560414deb2835a2cd17ab2c8f4ea6847456b826e38cdf399927dd60f3834
SSDEEP 12288:idU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:iHgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16D4523A2AE5549C6E34BC3F0D0E7C7D1E5A11FC272404E6B57E0F9531DBCCAA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a19e154351ac8c02fbce9dfc506ba3488709c556d0680aa38ff6ee92aa4944d3
MD5 c05f0a1d3e1460de6f0a31ca41f6e2c4
SHA1 7aa61cc3f7f916dc38af5481123515c5b3e342cf
SHA512 6ffec2f09faf4b2bf54ec56e07408ffdc41a5cfed2669c9dc767d237317ceb6d54a34aada52300622e38809a4754c47e3b352ba57b6f82c9f2f99255d133050e
SSDEEP 24576:PZMRzFVSO/gXe4i7ojhsP5Lgrk1TWb4AN5:PZMRzf6e30jaNf1TWbdz
TLSH
T18F650195B3500CF8ED67827EC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 79ae9e995cb9fea5468ce75f466f70f2d14811f6944214459709ec1565ee0da5
MD5 dc133c2fde8273d8d5325c7d6d496964
SHA1 c1d68b4e51df0f47fd797a1a6add814409e4c632
SHA512 b7e4c18adaaa3d467eb2caff8b11da2113c294f7a1663e6035c24abf6f239c244f0653be8307f1fd061132f533c64e4c11985808189c929e882f58b4160c5c38
SSDEEP 12288:3uU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3ygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T141452392AE5549C6E34BC3F0D0E7C7D1E9E11FC272404E6B57E0F9531DBCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2deabb1470a7cf47ab1547ac1c22fd09a7662d7cbd97929d04172cb00dac669d
MD5 0cb306bce7d3920902b52ea918cfa674
SHA1 8f6233d0e9fc4f9f32a0ec1eb47a3705c269296a
SHA512 09c2e6529e0005a3a1c790faca4d9a354d31299d036b7e4a3bb796aa817cb33e335b472dfb3fd67ee9399915e7b74918d0f4e29e2797dc7ed0cd87172231fa63
SSDEEP 12288:7aU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1814523A2AE5549C6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0F9531DBCCAA5AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8a3eb5134dffd17a8659beaee10dbba473c1845f0552fbf7b9f94eab1592eeff
MD5 9046405b0817973ae0e027c06cee202e
SHA1 41a46a0c9ac110733430b8c3d88d528428d04aa0
SHA512 e6d23da610db36b24f5b09b67706a0061b2d43f61953a16b333f4b4fd8ea5d459ded6f4ac6fc2cbfcaf3b090cd759e4be492790e42c88d1696ad1bc2c4eb23e7
SSDEEP 12288:OyPz5L8hU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TzyLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16055025777A120E9D1678274C4E24B42F7B27C7217208EAF03A057772E376E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6e706e1f14b987ed3a58d535f4e02fcd84dfa42acba66867cbbba060d0a3c7cf
MD5 c39ad09bfed4b5f297fe9217e98ef1ea
SHA1 54b3f5223751ffed8778f4cfaa94c85a45188d54
SHA512 b8c15d30cad648d58d93fa0003f7bef0ad2379ee6c7c6cc8ee8ffeb1cb8dde8f3477cfb0cc7f1585a9b9632742f5902e80ab8549090438def98c40b8032ac368
SSDEEP 12288:1uU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1ygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B04523A2AE5549C6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0F9531DBCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2d8a80c80d0d613a0ae3bf197e40472abb05ac236041b4d91f1d3d4c10e69d9e
MD5 1367c385b08601488bdb856728eae184
SHA1 c7038c820a2fafb8562e3c53bbd64ff2e22bdd71
SHA512 635ae469de0436253fd8e9262aedd71076438d230f3db0e1272f9964f34d6d967cecf1d477afb6260d286e9dc85724a548ec48c78a1adf3cb641c93702ea0a10
SSDEEP 12288:luU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17C4523A2AE5509C6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0F9531DBCCAA5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d75a626f85818b3f271572cf87048c138756eb66e93909c19ff74142354a0097
MD5 99fdbf9007bfddc3c2f7a416901ee594
SHA1 e1ff1e4a07a45a3602d79bbfb92b667e03c49cc1
SHA512 c32d29d1ad11e60f719d56dc6c33967f961e4ead085ded12c70d8ecbc40fa1b9959ac6c1ffec162b86c50806bb71af0aba460b3271e231f05e9304465e4e63c8
SSDEEP 12288:/yPz5L8hU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yzyLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13A55025777A120E9D1678274C4E24B42F7B27C7217208EAF03A057772E376E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 06211ef25fc4e40c66eae8862c489b5991b9785277913e470e609906f7f905aa
MD5 3acbbc787b75121cab9c61a4d74f476d
SHA1 c6497c7992b73b1bd5a3f523c76f946516a9a678
SHA512 3d7682279b037db06e12a9c15cdd6a62d5ffbc7d7d01f0010322f2a84a7d873f0ef042c86e0d8f2104361b2531c9064f080228eec4a476d85d42fe3d6d4362d0
SSDEEP 24576:PTDaLl3z0zDFgXe4i7ojhsP5Lgrk1TWb4AN5:PTuLljve30jaNf1TWbdz
TLSH
T1046502A5B3500CF8ED67827EC8A68A06D6B27C560760CA1F03F436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f50f2bb4a3d78f29d2cf539435a20cd9f99b00a43c091a046513e4db71271b33
MD5 6098c2e3a5ca30dde2a6486ac2f523c9
SHA1 9f7e58b4487bed58b5826b8d9b78fa396c5934e9
SHA512 3ef6aeb3ed2384f03d48836e007f1de24bb3bfdb549678a42d344bdd44355862376ddeac8b98d0c786b02c6be51f9126e00425d3885d4235aedea7c0f880e49f
SSDEEP 24576:03vd9CHKy7GZJgXe4i7ojhsP5Lgrk1TWb4AN5:+vd9CHKya6e30jaNf1TWbdz
TLSH
T14F75CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6a2b1113b554d6ca1e3fd09b8e35a29835147f87d5692501b2be3dea256689b7
MD5 6ede065349350cbe2728ccb8d61d0f55
SHA1 b107cc9b7abd015f1ccfb6a5a368a2749f93538e
SHA512 aedfe56264ba19b97f7788289c2e0dea6074ebb9bd009baf435eb589f6d05934527cf1c648ab7851a279f77ce862244ded3b2d024e58b86570fd5fa939e7607b
SSDEEP 12288:InU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:I1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C2452392AE5549C6E34BC3F0D0F787D1E9A11FC272404D6B57E0F9531DBCCAA6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 df7d3760c97c7e0e9cc03ad3cc9f4b96cfd7b7c936591b472a2bf6a5ca577ea0
MD5 959f4d226c214e5a734c6a2f506aba6d
SHA1 2065e4522c79f0409f41ec5c43cd868e2ff68882
SHA512 7decbaf6242690e4fabbe637305e0497741853a05d2b56b93be2c207a1048685c00ee267047362a8598bee19512306f485834f82fa2a35e7035d7633186d8613
SSDEEP 12288:CBU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1694523A2AE5549C6E34BC3F0D0F7C7D1E9A11FC172404E6B57E0F9531DBCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f788621e0548f44ccde05a26b55c6e30d8363ddc23a88f5ea43e06c408da37a8
MD5 167da7412375bfabde663281b49d2bbe
SHA1 403aef494370b1898c1b75fadee19160a4eba305
SHA512 15ba4293cb601cb780a3aa8be1ccdb8c81363a0d36028a31416e9235624debfef6dd3adeb035318bdb65861681300216f68ac37a9f3af80800a79393a9a8176c
SSDEEP 12288:wQU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B54523A2AE5549C6E34BC3F0D0E7C7D1E9A11FC272404D6B57E0F9531DBCCAA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 549e01fd88cd04760de6d7de8d372dcdf0dfac30a6659b98f691af120c4e139b
MD5 4099a539a058c3e76abea6a37ebd70a0
SHA1 7421968ced06462a1aed2a45f0458ab283810d23
SHA512 0fb65e51e1c3b5ff6ab09b16d21e1924292ee7e4d54acb545487abd1a45ec47e83b8da8c57ecbc4ca80c308c185699eb1201ad94a235280a2a4290f92d04d848
SSDEEP 12288:nuU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16D4523A2AE5549C6E34BC3F0D0E7C7D1E9E11FC272404E6B57E0F9531DBCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6c9b1fe625c9d5b375812dc0780a2a61e59e0a301b02e022d5fd4148956632f8
MD5 57145b6f6e40d31d374daaf560165a33
SHA1 f3e03accd03623e3ffc7602f3fe36ee03557d871
SHA512 ba1f04fc945afc362ce0e7fccc983f5c134f9d3b43d4affd5f2b272e5d5ebb585abe16944cd474b89e5adeb917be49adf9750eaf4557df0a3e798479f90f2e75
SSDEEP 12288:ZnU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Z1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1824523A2AE5549C6E34BC3F0D0E787D1E9E11FC272404D6B57E0F9531DBCCAA5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3413e7cc56a434a9b786875a50d3daeeb2022c712274af9e2fb8b9304f013dd4
MD5 8fd511017313cdccc8fb361eeeb96516
SHA1 60827682e4fd63f354e0f45673d370a185cfe7e0
SHA512 6231b7ba7c8c878b2e10afd9c8b4b207071ed0a3fc57b9b03c598f36b6cc81bcaca9fa9e54a0ff080b825902ca1d7e5c52d15204acdf560d823c11333fbc42a0
SSDEEP 12288:zGU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:z6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F5452392AE5509C6E34BC3F0D0E787D1E9E11FC272414E6B57E0FA531DBCCAA5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f27ca98cef8785ae250fb3d99be962d2246261b5049bdf001065020fa103f8fe
MD5 732b36a3d29daeabb3229d23eb8f98f8
SHA1 6eb1b112dac5a9ce697777e77c6c7ff0c15dff45
SHA512 38c826796880619e41fe50f81c2a8e6789c2eae819b13d93dce913ae616c44ade8b4f0f9d70032887420ea7e25c3ef796f9999f8fa168bc0f78bb1448b2935b1
SSDEEP 12288:0MU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0MgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T144452392AE5549C6E34BC3F0D0E787D1E9A11FC272404D6B07E0F9531DBCCAA6A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 9fb22495ff593754e7660d8796d9e2a84618ed4f44d9b207e9eb8da6d08a86d8
MD5 c9b90b1f1db824a0ac08891f79857ed1
SHA1 a7e1578db817c4cda88d1090ca18bdf2743f7be5
SHA512 b0c0e5ae3f110c73a0d2c10f6495f9ba63a27adf30dd57a650424c0475eb92082b1fc2a70cad24efece721fc95b6b564266086bda6b11636825790bec6ccc49c
SSDEEP 12288:9PU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9tgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AE4523A2AE5509C6E34BC3F0D0E7C7D1E9A11FC172414E6B57E0FA531DBC8AA5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 576a9f6d696bedca9cd73e0270faec85bf3bf4c015006c8c9a31e5bdc93962b8
MD5 bdfe5cbefabcb174df2f0c730c6f1d6c
SHA1 952901af62f905df0fbcd70c5a8cbd0a9a10c90e
SHA512 8b0c03014f5546d532375cae38bf07879052cf2795e844c9ace524e529207f14a2697862822e05d7a237d923e5673fa2d8e395c469e7c6de4896bada2d85e11f
SSDEEP 12288:wMU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T180452392AE5549C6E34BC3F0D0E787D1E9E11FC272404D6B57E0F9531DBCCAA5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 a70555fb46fb3fdea5990539fb165cf1596ed928db7abe13f4fa5d673afb260c
MD5 de24f68fd05d4cab28e9e5d4eea52710
SHA1 f3ea10b141b550f7e1e2e461295089e672af201c
SHA512 a211b99602c7f7c289643912bc35797a3ba8d122ce651e6add0801fce31ea86b835d570c7552330cc3407ad646e2cfa7cf6a3624279de0e85791ce1f0a7adc3b
SSDEEP 24576:/fwvUk9RX6wkyAIOgXe4i7ojhsP5Lgrk1TWb4AN5:tMnYIBe30jaNf1TWbdz
TLSH
T1AE85D029EBD804E5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0586c113912a72dbcc5a4c9ec7a749e6b8057755096b72269a77315c33e56cfc
MD5 d1a4b0b4ac82fffdedcffdc80887b799
SHA1 ccba39754a0dfc5856b945e8d4b66590dc8be1b9
SHA512 8ce3d7985e4d00dc8ea0a0217500c404f78416dff178e8592b98ec0df2fa2e15f1b2f23cca27ddca9236d79c83b96a8f1ac4eab23080e7dc171d3664736129a8
SSDEEP 49152:YYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Me30jaNf1TWbp:PySzP0U023W
TLSH
T1C9067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d5e5a96a9d112c6666a98ff37f55b11002548c7a5d1c38972e8f32b91189d10c
MD5 4c451cc83e18a8b3460146a40259c5d8
SHA1 afd93d929b6811ce7f624283af4ab979956bde86
SHA512 d9815997a8b8588ac91f89d3824199228ef3b1bb9f42c8ee3fd9c4a573c83ba20e849fc187d4fe90c288564a70f5f2408d44a590dacf8b517251505c0d6456db
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYPgXe4i7ojhsP5Lgrk1TWb4AN5:F47JUQjTirIhCnDHUPfF/8e30jaNf1Te
TLSH
T17C65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5975011912f24b6cd161855a3b346aa7cb137f6c8df3ed5c436b326f4cd5e4ae
MD5 70735155d3316cd43a31f62126038dda
SHA1 f6dd4054acc2b7d01fd53b10abcd22922d54ce47
SHA512 49e881fd7ab06fafddec028856d44107f1f78cb6160eea6bed9411d5d862d6f096f1aa0b27d2c03af63ecca28bdfedbf201d6ff3e2aeb3b60072bde6eee52663
SSDEEP 12288:7bsfeU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uigXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18855F05AD29802D8D05E92B5C3968A41F3733C9193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 fc019c02981be3a5fe4080ffab1a89615575ada4f5251a3e31db36668ea5bc9c
MD5 059f7a3487f503a194787f7b16293ef4
SHA1 a597f22fa195852e34c237d09c511366f8b52946
SHA512 fb62f3483cbd2906d1a56ec3b24c3b2188996aa070abda98e1bd4d860a225f18bed12d3fe07686efda9093459fd01390b6a1a15da40465e01818537329e85d05
SSDEEP 12288:lphapU3fV31jb/3bgByBbl+Rljl87KlnAHEXWZv2wlQp:lp+UPPbzGIbEljlrlAkXWh2wCp
TLSH
T116353940766ACB8FC96940335E36D1CCAB707C51EE446F0773C88B3F8576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 742de5b437b5122a160070c909e9e762acc0fd7443a7f65888f1bb505a433d28
MD5 656f0328a3f55d53711af4c0311c47f1
SHA1 2086cf56aa6cfdbb145d23f31c05970a374737d2
SHA512 ae1b55a35a7076af9eb2c025349e94c71c643710faf97b38cc96c8ee4e9cf1d26ea79665dc797e280e7d3972d9692342572a081f977658fac67d6775866961f6
SSDEEP 6144:RwlKuGUF0FxaP6EBpsnFlGT4E1I6IczInta8XnwFYyipSADh+H9BfUvu7LE6ONLP:xM2mapYNzIl93IjOJei4du12brfL3h/c
TLSH
T1FC55E9449437A3CFC1BA6032072A5B4C77A8EC1677496F2677CC453AD82AB16A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 52ceda535954f5876a7a0d85b162fdef5da5019bab82cc79245fae497663442c
MD5 89493015af1923b0457ccc3b5e4fed95
SHA1 1ae80acf7601e669e2b44e9af72ef0b1498da52c
SHA512 ce4eeee4db7ded50ac0f1dd85d5bb9a0b45f9330e4de645aee9235921073f513c779272757ce7601f1dd88996f8dc74d4f8bda1d2e094e0eb4f2827e835e2900
SSDEEP 12288:3072U0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1774523629F584DC6F29BC3F090FBC760F5662EC0270089EB56D0BA9319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 172b6d6fad93726bad54d15b8d4dda6e6e87b13115191ab07bf42dde8766023e
MD5 b855fc4ffb6299402adb675287e3ee25
SHA1 6a3ca77a76e6435d2d55b909487646fc0fb00a13
SHA512 ecc4366405e5a9770b73937626655c73d8b4c10981009a1391fa6a5280e94b1b05aac074e444b2c5d59751d5394e7f0908f432877f37e7881927ea327a5cbdf6
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYYgXe4i7ojhsP5Lgrk1TWb4AN5:mgb4mBIBhGFGe30jaNf1TWbdz
TLSH
T17B65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 50d2e233498a218b52296a82d01fb5cc62e38522e4fd14cc05177d740240facb
MD5 e915b886b621cb9700bd1e01ef652ab4
SHA1 0ec9c219494125bd00fa7e59326cbc0f4921ae1b
SHA512 b5503a33b6bfc9b9c615ab99ac4970d1fc3e77f7a19742a8294e4b682a6a0d8c58edfebd030a8d7a9cd047bc6a2c1ee68003772dea1d87a801590a78b28a576b
SSDEEP 24576:KG88u8FpJqH1bzria7/m/gXe4i7ojhsP5Lgrk1TWb4AN5:x7ZFPqVea7/He30jaNf1TWbdz
TLSH
T18685F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5c7291ad34d409cd0408eea0c91af4b3ae6b0543f878fa4ed59e5acbf85d1d5a
MD5 ef6415dc23abf42195d710224d92274b
SHA1 1b50f55c16b9ea2373e809843d51558d0a4921c1
SHA512 91bd9efe0a863c1d2f45882f615dfc2843bfe2447d65c72f902aeab9903794cc3b6d3172f63d5515339a2531f53ef2337418da0a560c815657d77d32b3b7488e
SSDEEP 24576:PPUr+NQDgXe4i7ojhsP5Lgrk1TWb4AN5:PJQ6e30jaNf1TWbdz
TLSH
T17765E12F66A81CE5E27AE17C85828719F7717852131196DF02E0817E4F67EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bd3ef32dc457e945a86d7f8bd231acc4dd1c0f73865677805dd257e9cdac1365
MD5 b1c89d25b97164d5b9f9522f314b45a1
SHA1 ff8d05b9addb9709b65f0f56e6f30997d57ce823
SHA512 2a68f0d175e99d510f212bf9f3fdd4d8dfbefe9f17a62fa0c865342961ff18642faa37d6877d4c1a9d80249733b888190a5848b148a47ee89f1e9055d686b20b
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKe30jaNf1TWbdz:UG05lO43bZU023W
TLSH
T1ABD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3c8ef5d5d519a74ac368723a204a597586565dbfbd32ea4c651146a5959dfb7a
MD5 01ca4470d26d7c489529aaf77d6b7fdc
SHA1 cbaf10e6a6746780fa77c6dfcce748982786b911
SHA512 d7f542718fbd8ca5211461847cc34bb0cacb4a3451e543112d8053aaa063b9562343f96b83df931dbeac65e7a98f75e4c3dcb251632c88126d60ea7f147e7bdb
SSDEEP 24576:Efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnxgXe4i7ojhsP5Lgrk1TWb4AN5:ca5POZ3BJt2pasx2+mye30jaNf1TWbdz
TLSH
T10965AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 da5d849d18544da6152c4028332dc7489cb4702951b056d97b1b75fe5089abee
MD5 e8e19cd30e70b6dc49bfb01a8d00a437
SHA1 75ad19f0b7ad676b2ac21499d9d4917d877db4a4
SHA512 de7c7e752b9be2d2a51872bffc9cdb555a2982d5d5ebbc8c3378324d102daddb2ac4e8cfb45293d1b0c69c9aaa5f77a8a91f32a82cc2a8730f826031c00c4be7
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fk3gXe4i7ojhsP5Lgrk1TWb4AN5:8Nc/zEOVHFne30jaNf1TWbdz
TLSH
T19B858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 53098b1a36fd73f2a043032062429860a9511e09b01fcdaff74e8c87006e3c3f
MD5 2517303a843e976187a040b3c5025a7c
SHA1 a9a110b2ad2b522045b04bb3fa67ceecc4dd6e0e
SHA512 4df5d67a24b88336f4dadb952df903ced8859fb6ea51dd7acf41278589c9da2fa052ced4d319020fad0904caea888d85bc0665c35eea1798cfe83a74a144d16f
SSDEEP 24576:KTkNvNnaFeYhJNtmZBmtgXe4i7ojhsP5Lgrk1TWb4AN5:KTMwBtOmoe30jaNf1TWbdz
TLSH
T17B55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0e6f861df72c45320df88d5b4f4a8e8a900fd1700b1a421199ef544cf8d2cfb7
MD5 f0b3d26fae906ae33672df8fd9a56bd5
SHA1 861a9d50b6f8d8f201db31a55eb76e4d2f2db5c0
SHA512 1d80d72927fc8b36c04bebc041a4230c7b25be7df7511ccd710df3e4564f3cee243d289022a0c924692d5b43a9c6426eaabef69aef10d4ecf0569832ceb579cf
SSDEEP 24576:iD3FHshBIYQgAGgXe4i7ojhsP5Lgrk1TWb4AN5:iDVHeBIAAJe30jaNf1TWbdz
TLSH
T16E75E17EEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-372-0x000001ECFF670000-0x000001ECFF8B8000-memory.dmp

Download

memory/2384-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2384-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2384-119-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2384-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2384-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2832-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2832-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2856-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2856-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2856-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2856-256-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4216-320-0x0000000000400000-0x00000000008D4000-memory.dmp

Download

memory/4216-6-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/4216-0-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/4216-7-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/4216-76-0x0000000000400000-0x00000000008D4000-memory.dmp

Download

memory/4216-5-0x0000000000400000-0x00000000008D4000-memory.dmp

Download

memory/4380-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-94-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4380-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-100-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4380-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-356-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4616-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4616-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4816-360-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4816-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4816-113-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4816-106-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5044-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5044-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5044-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5044-373-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5044-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5044-80-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6020-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6020-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6020-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6020-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6232-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6232-66-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6232-72-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6232-281-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6316-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6316-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6316-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6316-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6636-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6636-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6636-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6636-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download