df9d38c470434c88ab80fd64876b514c12bda74d9ba7499163f9491cd23ef0a3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260708-e4bsesay51
SHA256 df9d38c470434c88ab80fd64876b514c12bda74d9ba7499163f9491cd23ef0a3
MD5 7e065350d754c89ada27021d92aeef96
SHA1 0e99d808767244dfefee7089c6c33e8e86de8cfe
SHA512 7302238ecb71acc2feaf6594ef519916b3d8308e6e948d0bfcae5fca865e10ca0c12b49b533e553efd288b6e1790270a86076b717183e49b2f15c2db68b913fc
SSDEEP 24576:YhfDc6X3lQMnxr4cQFTj0OZeVJ9NYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:Tul1nqcQFTIOZeNNYAJmQhkD03NGw
TLSH
T18145E01EBAF1C032C02351308D6ED358A2B4E4B258264453BBED676D2FB15D39B35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 7 IoCs

pid	Process
1116	alg.exe
4368	GameInputSvc.exe
2152	GameInputSvc.exe
6060	elevation_service.exe
1500	elevation_service.exe
4496	maintenanceservice.exe
5776	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\431853eece3e03f1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{DEDB5ABC-8553-4F5A-8611-38101B29B20B}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{2C30D938-6D02-4B17-A348-90502DA41FDC}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2152	GameInputSvc.exe
2152	GameInputSvc.exe
2640	explorer.exe
2640	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4424	2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	4368	GameInputSvc.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeDebugPrivilege	1116	alg.exe
Token: SeDebugPrivilege	1116	alg.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2908	sihost.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4568	StartMenuExperienceHost.exe
4452	SearchHost.exe
2640	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2152	4368	GameInputSvc.exe	93
PID 2908 wrote to memory of 2640	2908	sihost.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_7e065350d754c89ada27021d92aeef96_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2640

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1500

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5776

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4568

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b1661d8b638b604bfd9fd3190b7eec51b2511990d8110c503e6b32e58c8a711c
MD5 890f722f8b82dc0d370a13d4720fe3eb
SHA1 66ca3db0298e741a9b9095f7ed101a9069798c00
SHA512 485bedd1ddfd0d8c68fe09e08b0e48181fd5d9ecd1df2714c771109802c1d93e07964a0396f02cafa53fcd8760d75d4727ebf378564e7390c57f77108d7749f3
SSDEEP 49152:ab+6b2BuPkFKRrdE6oh7stBhuXjfS4LWxnwNYAJmQhkD03NGw:Mbq6gjBPJm0kDkNr
TLSH
T1D7D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 808ecba1206110dfea2b923d56a5dd26ecef053713b3561d6b21d2c48b4eba02
MD5 b52821922cd3709c1b1c0aaffa168967
SHA1 9b9bafcdbb9ec076c6ae0ab307ac9b1c9dacd860
SHA512 4ca54eb08b91300a16cfa0247c34a69971a3acff9763ef3dad7390b699ba930b9fd3b7faf9f04b1ef7d9f84137f636debdc3d4deeb608e04e46046a93accd0e2
SSDEEP 24576:sXY8xOczA3NYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:4OcYNYAJmQhkD03NGw
TLSH
T1CF05011977E008F9ED6B927CCCA18612EB32BC5507A4E75B03B489755F232D85E3EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 cb6fa7dd8d84e5e6ff8d3236779b434755e1739582479293a98ee29b07347643
MD5 31e5bc1cff8115e52e28a6a34aed0399
SHA1 fcc389dbd16f4f072443bd1ca6c8278281c92a80
SHA512 4aa870ebd506e78c2db94b457c65a5bfec23fdad71714245d47eeb99247627befb153f0e730c2ab6c0031826bba8ba5624f55d827bde7134382a302631dea437
SSDEEP 24576:F03eHlL0h6xYrM+NYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:FFlL0kyFNYAJmQhkD03NGw
TLSH
T14B45AE16F6748331D073C0B9C5D2A69AEE7130861B308ACB4296D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0a7f26708627c25767c04f4ecb684a535fa702c149e319e849f244612ccf73d9
MD5 e898aa752e6535d5dce759411f90b0f9
SHA1 88617eebd8c994459b607d7a1d52f811e4376ce9
SHA512 37f5221b31c44c94c5b37b94278d36db1272ce83b978357ebbd1aad538ac63ed960ddf25e560e50424487c18cb4d811993034d39277e9b74b57b06d65f60ef2d
SSDEEP 24576:1a2/ezSC6vUyD/aqgrvW/6q8wyuJNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:l/ezSC6vUzPvuHjyANYAJmQhkD03NGw
TLSH
T13A756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 8fdc07be912ac1bb24ccb4b3a56fe757d2862217c1d481447aa1162d9f71827f
MD5 924280d1c6b5901a6c5f8687d0f5f1ef
SHA1 647ef0249e36f1be18cb25ac9900f72cd9b9c253
SHA512 c76a5ab1823eaaa3ee832930dd7c604ea341c998299945f878a13a2418fcd2424af003a61051b1fa2b270c04855909ceeae4711beed021fbe92304526b5046aa
SSDEEP 24576:YAb8PrGZPv/l+pGNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:YA0GZPXl+oNYAJmQhkD03NGw
TLSH
T17355AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3F676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 fc461a57eddc253c3dbddf01df1e2435ffede4a0abe6add4133453fdda0ee6ad
MD5 c6d0a202628fd5de638f417d1919f6fe
SHA1 38606ac36683ff2f2b308386f20e3667cbcefc1f
SHA512 ee78965125dc6f6bb6fb92b32b63e56354ef78d54b58ba43ae150d19913fb1e1402dd5dcc7cd16abc1ec6548e883087edefff55fb0de43bc5210bed8803eec67
SSDEEP 12288:AEg2abNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:AltNYAWqrGSmQJU3s3TvQlDPkB4O3NNN
TLSH
T1F8D4230E7A910081E7EEF57088DC0796EF74BD8536DC633318369AF9A2794D3D5B1286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 581fa886bd4cc43cf1be3469ca3e23caef9da968912c7ac68f04b04ab7e1b197
MD5 062b390ec759afd701503e0daf34ab02
SHA1 d33b698f68c2829e01d671a55dbf231fb1e29f7f
SHA512 dd75761f1f53c7b52052df72b0ebe4f9706fe60f1b2325235d1699bc617fc09b04e25092bd2d84c28f74a5af0b3b2bb436317cc49e31616974cc3e89f4697fef
SSDEEP 24576:gCIUqNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:gCIUqNYAJmQhkD03NGw
TLSH
T1AB15DF2BEE28FCD2C27E9DB85A918740E77278304B61A3CBD135824EDE235E15E76C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 f702c0a295a825a713887dd6b9b04f51c8a6d8d60367545ecc46d3cec559bba3
MD5 08ff40f85a22ee00906b76d7c3b89538
SHA1 94dac5412f75853a2fc7b11eb39fbac3fab99ffa
SHA512 ae6a93b9572149ec7521eeaedd3a4466485a80bf753745b9f6cebb930db38a437906f6bdf059e2f739391dd015272f43289fd26bea94fe6ca0a5dbcf724da485
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THZ:jQvGAdlCEL8c/9RNw5C4Jm0kDkNr
TLSH
T16F367D656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 f3a36c61ce0588f693df10173e83949ae5dd5983f72c70aa921277771c04673f
MD5 cc0bc7bd59d815ea510d9662de3b30f4
SHA1 7d675801ff7ace0513078d3b3dc6291f3120f078
SHA512 24075450ef427573108ad0784dfc072fdcd2d7ce2c72aa7645505a7b460143c8afa26246f479f95d0883051845412bfef198b58257e1fb0086bcff9807e757aa
SSDEEP 24576:QmewsAjuNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:zljuNYAJmQhkD03NGw
TLSH
T12515E031FE74D032C7BF1DB21B65C716587CB9600BA12AC3E3A88E9D5A741D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ab3f3d442d50ddd4a6d1604929a3cd0611460315ab572ad8461833e4f5966a3
MD5 b01e1ecf09cd36b21a55bcb9a6f81a7f
SHA1 00fd59ca3f34d77f10bb75bf6751c5ebcb2bfad4
SHA512 0e3ce89131a9e6cd7169c8d685ae2badb6624ecb28b0c1aab31ca13019e838ca65d9aebaeac3bb31dda35708dd9d0579d47b73277f67d6564f335517fee2e2ee
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHLyN:lUEtQevvqc2W1cpV2XF32LyN
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6b925fad878ef3af7d3ed08524aed9725f5731ba798abcdc33629bd72c24e95e
MD5 22f31249467a99c670153846362bb21d
SHA1 40cb709663d2adcab55ef0ea6c081e4d16eb1562
SHA512 4ddf2fcd04b30b01db70084d8ab8fc3abb7696ebf838c9daf87b36df00c1898e44a141780bd12863711701c16c5123918bc07b544a46455767a6856a227a5d54
SSDEEP 49152:NzbRquA/m2yL5zMRFiV+XenmE3/zuNYAJmQhkD03NGw:FoqnVjnmxJm0kDkNr
TLSH
T1B8D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eacc17c6d70c0f74a83e93508c1ac305ae0bddffc6d9df1ca0bf601f9fa86223
MD5 f0446527d570a6c36f9cfe2adb0bbc7f
SHA1 51eb87fbba03bd46273628932e6aea5606c965a7
SHA512 e6f2acc89b9678c42254ba1ba2c2cb02639e9e30f439d9ebe702b5898fcf5a47f2ee09d66eafc6062c525d2043cdb9ffb896b70f79b5e2e0ef48a31cbe9caa1a
SSDEEP 24576:RAhGLvlFoiwtA5l7S53FNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:RAMRFoiq51NYAJmQhkD03NGw
TLSH
T107459D81E7F955D4F5B3AAB899B68171EA76BCA61E31D20F2160C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 3a056952f96a23840c014312b95b00d8a75007bbfb66a6b6267bc95b57adba41
MD5 6df0dcaa02541c6c396f9b54bb937f13
SHA1 e0763e35c0b12aa6bdfc50b333a610eebb7161d0
SHA512 642e66d543e527f9e034c68a3cfb1f365b227c570550f46c76e0487a0b3cbe6093a16bd30b88ea5afeb9fc6ccfd13dec42903f869e441330b5d9edc5afa5edbc
SSDEEP 24576:uwuuOWLxNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:uwVOixNYAJmQhkD03NGw
TLSH
T14D05F14A36E40CF9E9A79138C5978236F7F2BC013A65D71F0760C66B6F37261AD29B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 3de3189c7cf26f30972dc0f700e24ac91862a7d639107a6c7d924ca33f6e3b52
MD5 d31c80ac5387585cd7cb8636c276bd0d
SHA1 b3d101fb2f363cd58c9b1dff9217a79395709846
SHA512 02194de614c588325e4be95ba20047e896b5b7af867ad9895c7cb77660b47e4781778eb0ff4edcc99773ec418cbfe060cd947e7998a40409d0d8500bfb21177b
SSDEEP 12288:9Y/1IFTabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:a/usNYAWqrGSmQJU3s3TvQlDPkB4O3Nr
TLSH
T15CE4124E33E420F5E2A7A278C8E80746EB71785237B953DF153546B96F238C25E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 85ace169478392db2ce78bbf3305cf14aed7565ff639516eb79192b8675351b2
MD5 6b247b30c27f884501b0ee334e112e70
SHA1 c895f0ae8799d859413349b49e5125afec8c9ebd
SHA512 5de849c2b2986aa33339cf0d53788b50910bb14fd7bd8c2a4fbf28b2a8a09e8e33021f1cb608a4b346c03e0fbe996258abccf4e46ea42b5cf854e89a76a49b0d
SSDEEP 98304:DQRQyi36YOcP8Lvw2gAf+PN38Jm0kDkNr:SQyiKa+X+PN9yN
TLSH
T1D7666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 73a27770d42077ee47f8047c45af25a9e3414260fe2d006b55a17ac412687833
MD5 d5e19f4f3221de880b99b4db28e13d05
SHA1 1dc18e7bf97f30ea759a9e941d8243a99fef8ba9
SHA512 956d12aeab58bcdb6f71ec6738ad7212708eb6c9bb49678ac34e853d9c8ef9902c7fb6b2eb122d7ff654d423485f12418609f71621f84aad9af0b7c9ce7990fd
SSDEEP 98304:DQRQyi36YOcP8Lvw2gAf+PN3zJm0kDkNr:SQyiKa+X+PNIyN
TLSH
T15D666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e5cc698ea90e3b7e337884dcff2f093c70e20c7b9f4a4bf4632f1a4083caea1d
MD5 3586cb7dbb0975fc1c80d4b6a1101d41
SHA1 8585451ab9aacf352dccb4a36c0218b1d1c8ad35
SHA512 6924bffa7b3fb767322944a6a5f23aef985e7c16e1dd3ce344598e1efdc060523f49b4a2f7d04a5dc35375f8b8e91cb5df74387f5a75f75e7e80e447784ccc25
SSDEEP 49152:P68Qg55nhMeWu7PNU3/B7NYAJmQhkD03NGw:JthbRc/XJm0kDkNr
TLSH
T15DB55A33B2F20099C44DE1769F4A873196E17C758FE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9083dd1c4b8f6e0ed4b6e4703cbe8ea329aa70601dd1817456b29d5a48a30eaa
MD5 abbb47bee2d115168515d7f15efc7fb0
SHA1 640cb6e6db28340a2eec2abbbdee09355a7e61ce
SHA512 904bb04b2bd76c11f8ad7cd90c382015f8cbd817306bb2242f571724328b8402e3be7fcd50e3cc35e79c11d535f3e3ef78a1e2e1f3ec3e404ee27f939327b525
SSDEEP 98304:qy5112gYy5azzVv569nLKnhZhJm0kDkNr:TLIHAWhkyN
TLSH
T1E6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ca281c5257138e8d384254eaaca7eda1ceac9d0e44317e94b160ef5e47dab8d4
MD5 cc2cdb78abca28a199c551cd6b71fad6
SHA1 880aaa9cee3303b5233dae2cf016ba0bbc70e826
SHA512 65fe52151511972ef12744499fbfd01e8b7d64e376beb02437223062a4c1202fdb9c30279fdb2cba87f377fb524c0ce18dbd8630cde088e82068b28e0e3b502a
SSDEEP 49152:wq+taZ3usBWOBr4tEGp0bqx0z+n217aau1glxNYAJmQhkD03NGw:1u6JmTxd2dPJm0kDkNr
TLSH
T192D59E13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cc7330536ab816771f370deae9cb95f20c17cc39e1296b696126d0f6637e896d
MD5 b0a4a5ee484aaf1c3bbad5ef83b22ec9
SHA1 a2b0513710b915cb23cc32c07d48212f5ccf42d0
SHA512 771ab2d2492f7fa1f689876bffa6cb61e097b7ed9ae20eebb7aacfaa14eb0055dfe5082e6220911f74f090f6d8d675293c41dd48668ce3e5ed36efb17f18f7de
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xdNYAJmQhkD03NGw:AmifPbRAJm0kDkNr
TLSH
T15AB5BE13F2D900E8D06ED178875A9632EA71BC460B34B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e01746cfcbe968b1977254ae669f01e62fd7b1adbf3aba9260651824f261ddc2
MD5 c2496d3145187a899e6a8bf2c7f69a1f
SHA1 69be84e7d2726c47f172315683b8c7c5024d9d97
SHA512 9f0001601d1df27e6c169409de75a6b8cc646c9f7ce9c042cf4433855d565561b90ed7f3b1372ca8b7a11357afd7aff8263ef621af152011856ec3922e0227e8
SSDEEP 49152:tSuZQIY0Be2K6RVtOnks6NMHqgNYAJmQhkD03NGw:j5dKoi612Jm0kDkNr
TLSH
T159C5BF03F2E940E8E0BEE67487659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 82de77ee5c47cd8427fb480785d905773e53ecafbe713d856501747c89e4ccf5
MD5 81501537b42328c34dad385f11e8662c
SHA1 472a1d868b7bcd94bbf711ee6d9a4c71756aec5d
SHA512 5e1ba402f4ed45ffb1946c369da66106f4807a4822021681bf6591f94bca93eef34248e7a9d1f7d1289561dceafa2931115db3ecc0dfa3b412647b19103fd1c3
SSDEEP 49152:nhtSn8EApI0figTgiDn0AP5wfje8pbZILcrOxss:2X2iyph8jekbU4
TLSH
T14EA5BE13F2D900E8D05ED1B8C7568632E962BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 ce2984998dee3ecf91824e4b45b369e9b1f5948fd17d8a2e33dcce0b835fbbb0
MD5 2ac398ee9bf66d5b219b59a74e88acbd
SHA1 3e503252168d0873bb443063272f850c4758290c
SHA512 c4a3e9bbc13e5571a81548f78dcb73e1c002f930878552618ad539a81def0afdc13980ffa71a92828971a02494fb906a300f28da2dcf24865c59f604114f57a2
SSDEEP 12288:BlpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:Ble48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T148D423A037431D3BDD899BF3DC335E16DCE76D6816744A43ADCFA2D18A06291818AFC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 e5bb8d1dac904735bf9627e745f76cf4f7b829eb485d3fcff69c2c056f1ba75f
MD5 450852d3886fcf1d4068d30827f1c622
SHA1 259f245719b141e6e098ca4bd206b01997a30b99
SHA512 391d7f9445f20b4f4313ebe2982a6361b7d7711a38ce015af00c5d59f360d1c0ff509f3bd2eeb2dda3c45a400315a92460e709d74caba946b6a7184ecfedd26d
SSDEEP 12288:PppoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:Ppe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1ECD423A037431D3BD989D7F2DC336E16DCE75D6826644A43AECFA2D18A09390818AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 2c778946269806f473a814402bf9f0d88552bbe7f3d83ef63fb95e10d3fe0ac8
MD5 9a12b8529f47a84d081a4010fa17c5da
SHA1 71ccef33862f6436ee872832cfee89e277df88ef
SHA512 edbf0c956aafcd27de6d4a279a21449c75b4f276e3e4a82645b89670e64b47420d7c5f13e805f2889f56134f8254ea29b542e52b37983772b894103ec5838e44
SSDEEP 12288:FcpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:Fce48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T19DD423A037831D3BD989D7F3DC336E269CE35D6826744A43ADCFA2D18A05391818AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 4eb66dd1e335d3169065ebe409424f9396f00f591d1188de1a5188e3ee569551
MD5 0eaa678d53be06f6aba03c8c39b7fa07
SHA1 7b89583f9ae47ccd3d5ae6ddfd2447fbce314acc
SHA512 a8832678bd0ba9fd5280673d7e58b9d7c7819c2202ace0026b9803bfb611b28953c526c513a1455d70092d9bdc22de7b06378b8392bba0af223fbb7bbbcaaac2
SSDEEP 12288:3lMpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:6e48e2lfjpiRDM3bZILgPVvaK0FeriCF
TLSH
T1EAD423A037831DB7DC96D7F6CC339E22E8F3BCA816314B4B9E8A52D54E123508599F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 763637a18cd73814b5c4452a2053950087e581ffb8c4fc5c0efe208429a99e65
MD5 05a1b3374ddfc0318dfc30d9dc482417
SHA1 f0cd453dd43c39fe4dfcf025ca093200e669c310
SHA512 7f0c49361ab16127b81d529ccd03ae4c8fd19d69ea71dda8c0823477847a4e8fb2029772696684716c5e61b1dd586afb45b05ff6116d0d4454991a61c8af6638
SSDEEP 12288:0CpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:0Ce48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T191D423A037431D3BDD89DBF3DC236E15DCE35D6816654A43AECFA2D14A09390858AFC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 91da840d412a3b6d08e205fa41f736e836491ab430b1a85e5ee78d9a952520b5
MD5 de58c679137f413864aed158808f4ff4
SHA1 633065b8ee33194c6dbdf5dcecd40753d39ef869
SHA512 e3ddbd940bf9f6466ab71494e15e604e871ab1d3db762aa60a75b49865eb6a981122359f496767299c8773b7298dec18165de599ef1dda18c195aa91ab7b9904
SSDEEP 12288:nO+RpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:nO+Re48e2lfjpiRDM3bZILgPVvaK0Fe9
TLSH
T1E4D423A037431D3BD989DBF2DC336E16DCE35D6916744A436DCFA1D18A09390818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 221cd23371df6dda560f5f8592c0b7172d642f540fb018fe7d81ff204f85aab0
MD5 cfdb600687052b4f2fecc5ec4ec9ab08
SHA1 1039082cb1fca3bca0655788338bf7760efc5ca9
SHA512 2a9a82bdd43d8089b6b86476a230862dba14b276637018192f7d97a54ed8de94ad02116c7f68b8ceffc6ccc20482ddd8dd66658cc8690f7204d70e3614a8827f
SSDEEP 12288:YA8RpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:YA8Re48e2lfjpiRDM3bZILgPVvaK0Fe9
TLSH
T12FD423A437431D3BD9899BF2DC336E25DCE35D6816744A43ADCFE1D18A0A390818AFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 787fb34289f8bff3d44f1256c192bc64fa73748f0fb4a181ac08aa61725e0b0d
MD5 c4b9b6d0f1aec08cc08f5291b44833d1
SHA1 46027ac6e4010567b361ff2705938112c0428247
SHA512 ab9e967c9011a0a03a23125b7699215450552c84bde2c213c52cc16942c442917468df7d5768c0cf017c7dd05627f7369e3b2d07571aa7b5fd818d5775bd27c7
SSDEEP 24576:RZMJzFoS55e48e2lfjpiRDM3bZILgPVvaK0FeriC9jbk30:RZMJzmHje8pbZILcrOxss
TLSH
T1B815F1A473811CF9ECA7827ACC228D16D5B27C590670C61F17E932A64F333A15D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 52e5dab940599f894d8adc6e565b90ef66c7d2d599ac2c5d49613fd7695795a5
MD5 0aff56b40f685ff93dcd212b28b48eed
SHA1 a2bbbaec6f78d442df48cae189d2cd5994d79999
SHA512 8e70d9e9bcfacad6660472f285f390ce754a0779cd43e551eed5005da4d0702f14bd490b30818bea1c892bead1003a842e6af72ef824307b848a293b8f1beb0a
SSDEEP 12288:V/poPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:V/e48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T14DD423A037431D3BDD899BF3DC335E16DCE75D6826744A43AECFA2D18A06290818AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 258c9482944f2fdec72757a92b3902cba2daf23d63dac0baee419a671cbd696b
MD5 e1e3c7dfe9cc52723d25efabe13c7454
SHA1 fdf6df36e22206639ae0e07151e338eb0860060d
SHA512 3dc1560a981e9dcba5a9873f9eb1f0fb1adf119855b30fc65c5642752b126f0b3bcae2bde77061da13bf43630b10c4ebecc7ec38707560703a3b52af086b8097
SSDEEP 12288:3+poPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:3+e48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T18CD423A037831D3BD985DBF2DC236E25CCE75D6816744A43AECF92D18A0639181CAFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 120bf82e91c83c120a6aaba68de895e502c294f4adc2c357098b06e6ae7a177e
MD5 00bf0401b63f7a2991ce9185de7e3cab
SHA1 27271244993bd371b1df4cbe21761b92af396545
SHA512 16e5f999bb0f6274f868a52b06a20d1f0f370ab65fdded2c5521b95d956a1a29757d8f344c9035f2e142204a08d91887985be37ec50c33a6ee0117874a34f2c7
SSDEEP 12288:1MPWZLlRpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7DjbkJ:CW3Re48e2lfjpiRDM3bZILgPVvaK0Fe9
TLSH
T1E2F40257338234FAD5669379CC621E02FBB2BC3507308A5F579943F61F272909E6AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 8d8c6b9ed767609df86ebf3633a3f2924fdafa4b504ae595b8d8a93bbcb6b681
MD5 d57234fb884a8d8fdb3095adc3d12ecf
SHA1 259c1c6dd64a1be83eb8e915f854a66388307664
SHA512 5086fe641e37e8551cc47a3d427899556c4b227f68327f42b2e1e72799fd9abd238b1dca9e4991356f37629d8ee15b29abb358acbf880a87e5faaf07ab599355
SSDEEP 12288:xypoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:xye48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1BCD423A037431D3BDD8997F7DC236E16DCE76DA812744A43AECFE1E18A06251818AFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 61dfd1caf65680aa8b158714630e6b4b60645bc3ac48d8c59d169149d0b5ce14
MD5 ebfd42988ff70d2ef8ec71c733f26e15
SHA1 78dc2a61704915323bd3ed5d0fffc7541bf3fe59
SHA512 ffa226f4b46b616e0ce0552963b8f6b9e1269ab679da4645f0b7c8c764dfe2bda70213e853ab6549f354029a86547a29ca5c8b986921f878117c6049ade9f8c2
SSDEEP 12288:FXpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:FXe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1E6D423A037431D3BDD899BF3DC336E159CE35D6922744A43ADCFE2E18A06291818AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 9e9a0628175c59dea100a4913b1a749dceac7caa7e23254cf9b0be754fc51a42
MD5 cc57f92282a3b633eab5167557a8d3b4
SHA1 d78436fb4fc35a02db719ab38538ac8b11a371c6
SHA512 a47553889b4e36f3fc413bdac9c82ed37f4ebfdd36d2e26cd35c1dc2450d1e1c922e3d59413065801e1ff428b1648460e46ba43c63f4a53f4575e6e0053c7193
SSDEEP 12288:wMPWZLlSpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7DjbkJ:3W3Se48e2lfjpiRDM3bZILgPVvaK0Fe9
TLSH
T114F40257338234FAD5669375CC621E02FBB2BC3507308A5F5B9943F61F272909E6AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 8521dccbc458f327c721bd6ca05c3012f7a446e4b3f6aebef9ca8592364d70bf
MD5 115263094ae81501c16d8d2a986f36da
SHA1 2799c683a8c072adb9a4ae262d06fa15017db775
SHA512 cae1d183e3928e12e18ea7db3eaae837ad1d86031afa5da7914d5c029c893cbdc131df07b2f11eab78f899a3d4b249e4fa828c3abc45821c048546409d61e8c8
SSDEEP 24576:sT/aLQ3z0zhde48e2lfjpiRDM3bZILgPVvaK0FeriC9jbk30:sTiLQjhje8pbZILcrOxss
TLSH
T1A915F1A473811CF9EC67827ACC228916D5F27C690670CA1F17E932A64F333615D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 6bbf1904e9298251aa2732e1e4e308d6a1861b68aa279059bb6512fd0783f4ea
MD5 4b35b9e51e4151d1a98e56641a531a0f
SHA1 77b01b35f7803fa524ab4d0c96250fe2ebfae46a
SHA512 51aa7af68085798b51395c0b7512575697561f7bd64ac559e86244eb09394d768c1221ca262c5cedbfecdc04fca8f244d822cbfe5d17ac30afe0f8c2b8f0dcaf
SSDEEP 24576:b3PdOCHHy75ZOe48e2lfjpiRDM3bZILgPVvaK0FeriC9jbk30:7PdOCHHy9Xje8pbZILcrOxss
TLSH
T13535CE90B3D414E9F0B79A758C725912D9B67C991B30CE8F03A8669A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 fc03e13f4debfb1021bfb0ed55c3714bd782b420c8db11dbba6216c5c02d1c32
MD5 6dfbce8e3bbdc7cc6aeed4106b0535b6
SHA1 0d2bda8e54719d9247d014811374891ddbe7f2a6
SHA512 a3e3e5880361bd04b046cb9d2117d2b0aae8c5d3c3ee0bead8128f689d71462d81e37bdc5cbeb5796497b8c71a76086f61a1b2902915a2c34802775d905c9486
SSDEEP 12288:japoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:jae48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T14ED423A037431D3BDD89DBF7DC236E16DCE35D6826744A43ADCFA1E18A06291818AFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 f2fa4a1daae965f9f7c360140c1f14f0c4a120fe0699f70a9e932ec28513e2bd
MD5 92d6e277fe3755ad01d7f38540c8dd04
SHA1 c9239d8285b5ff8306dbff66353ecef5791158e7
SHA512 5864f43dae73b7efdc4df94f3c7fd554d1ebc1f426c6d358ed386aeaf7749758a0d88496f33b942d6d214d1125c119329835e0ca4ea4538bd636d15b04de1ceb
SSDEEP 12288:rnpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:rne48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T186D423A037431D7BDD89DBF3DC336E129CE35D6812744A43ADCFA1E18A0A251818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 d6bf8672b446720f3a0dd236c4707395dc5645f4ffcead8c5170ca606a733f30
MD5 06446ad9893d77b45bfb50ed9f5d7e0f
SHA1 eba25e50cf02ccda11a221926fa8a22a49fbd5aa
SHA512 45f067d1903ae2c2e4d5174911e6f74e6db51e1fa16997454b16ddde46454c3339c628e5f09de09b207aacb8f79c65626ff9ad64773efc25af4eafb7f272ce7e
SSDEEP 12288:AApoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:AAe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1C1D423A037431D37DD89D7F2DC336E15DCE75D6922704A43AECFA2E18A06291818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 54475bba8000c468d27b704c095349e4dc2034586489643edcb3e2a97c9b1f11
MD5 1187601fe945025a44d332105d2a56b4
SHA1 0e9618cd489e55dd322fec8c0f0d1720a8174f20
SHA512 a00d1da01c4f279ea7fdff5fc6650d8bde583985c555909bb6e6a421f165da4b3c51fdd567f125f1b2587d3e0c938407710c0675c736adeba326413317dceca6
SSDEEP 12288:/bpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:/be48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1B7D423A437431D37DD899BF3DC336E15CCE75D6922704A43ADCFA2E18A06291818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 0d882f9891de057f0a5c7f64204cff9f8c27d0ff7b5320fd9c1dc7f89a65ec8b
MD5 5fb5faf9c935f2b1565a53383a47070f
SHA1 35d59c70e50c59ce61c5c1e08279ca6dc05a92f8
SHA512 2d8d6d9c189c7d2b02b6d9f3a44066b4455674b765037d1cb9340b2e61026b3fa499730fda3c4ea85661bb0a6aaea4cde8b25be37c0e5b519b6e4dab7614b9a7
SSDEEP 12288:5mDppoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:5Ee48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1C2D423A037431D3BD989DBF3DC335E169CE35C6916644A43AECFE2D18A0929185CAFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 4402ff03a23576085360e13bd0431c5e01832e390bf504fd1bcbdcc5f0007e14
MD5 d5be60bef4a1c05670d0ed9a89c68a14
SHA1 b02d9fcb840f3f7f97f1944280abd8c3b741b0d2
SHA512 87b4c8e84afdc5597b6694a6fafffce7328f4c7b8ad87238bf0f30e15cfa33da4914d5690b30a46ecb5aead5a7576f49db6f23ae4d8f385514367102a6521a88
SSDEEP 12288:21nppoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:2Pe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T194D423A037831D3BDD89D7F3DC235E229CE76D6812654A43AECFE2D18A0925181CAFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 e63ccd28097a58a13957ed173cbb53cae1f480bdbc834d9ba4bc592fb72e5a07
MD5 3c5b834a807018250932ed23eeb57c38
SHA1 d032cae506a1b47ba1965410547b5998bce01858
SHA512 ffa0f16b4d685e3437a522caf1e8f2615b25661fb14679541e148d807022cde579063f6870c65ad4fda25cc51c504159094fd2ba103bb64289b8b8aee7a13a49
SSDEEP 12288:NwpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:Nwe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1D3D423A037431D3BD989DBF2DC335E16DCE75D6412744A43AECFE2E18A06291828AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 a16736f05215a44cab173b626a8da88382b7ff2f0e196270a3e665904c1c28c9
MD5 bb828d4d2533ad4bfbbca05f84985af3
SHA1 c83faa02a2e92677674e56fb4528d85549412f8e
SHA512 856b5edd6f92a2ee04e1ac0f1149d9bd4c1ed7abae48d71e76f167ab7466d232184a2f3a87a47601ce18cede4f395cc781af6fac80327ebd3da4221997bc4eac
SSDEEP 12288:k0poPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:k0e48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T115D423A037431E3BD989D7F7DC335E22DCE75D6812754A43AECFA2D18A09251818AFC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 c4d01dd9b425f80245209a2a885d74e9714e612ccfc385f375155e31dc18b855
MD5 6fddc4640966a1e9dec8e4f3a2ed510f
SHA1 442e126fcab41989896167f045a7f0381e7a8bb0
SHA512 ccc03eb33f6904e233dbd66cf8e1450b2294e5d1583f33671a64293319d8c6827c607c8954cfaccac62d044f27de3607715e2a708f3be09f5d110c2b2be169e5
SSDEEP 12288:Y/poPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:Y/e48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T12FD423A037431D3BD989D7F7DC336E269CF75D6812744A43AECFA2D18A0A251818AFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 602KB
SHA256 65a8c2889fef26e71c56efffd0f0f4a99736ad5624d119591a5498d6ceb811c7
MD5 39b30f13f1c5add1638c1c0ca5edc06c
SHA1 b1e90d3048e3a3a875894e82c3ff33e8595ce83f
SHA512 9ecf545d6de0bc08f8f5a69fa5823165f0842d5dd9e39502960fb11629738786e3e0d0ac917d5368cefb4678328d071e05453171f70bb1d9b5e164a8d9d28199
SSDEEP 12288:efpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:efe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T13FD423A037431D7BDD89DBF3DC336E169CE35D6822744A43AECFA2D18A05291818AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 602KB
SHA256 682d0d0051e880505264ba59b861c0d925d0be2e33e58578b4be3fd9df687203
MD5 6851d2dd2c538ae3818235e4798cfe0a
SHA1 d34a11fb48601dca8eceefd2e15956f7271cc52a
SHA512 35ac4c5bc1776cc130f9e6945424380408a607741220cc7c92922283f7be14bea1bd8c7db76fa37cfd3c23bc36e8703977868c61c3bfe66ea1d31a3059ba102f
SSDEEP 12288:M6jHpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:Mie48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1F8D423A037431D3BD989CBF3DC336E159CE35D6922744A43AECFE2D18A05251818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 602KB
SHA256 f2e5634ef2324383306826744146a8b9a4d6c5d90d6f22396c7773da8c9cd0a6
MD5 73cc115664bcbdba38913c7bcf9b2921
SHA1 089aaa11e2ca1c559d380f6df5e3e110e9d9d436
SHA512 5733970faf136349e8091665804af88dd81ffe7496b7b03b321e3b512db5efb1326465af04d7ef717084d4c630f3a77f2e6f37decf4db147cd2f761773163a59
SSDEEP 12288:VbjHpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:VHe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T10ED423A037431D3BDD899BF3DC335E169CE35D6426744A43AECFE2E18A06251818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 602KB
SHA256 9ca4d038f8dcc2cafaeac4e7739c7bf116c6680d8b847a91fbf8e8e3889cc7b5
MD5 dbb46c1ccb3115056b99fa6a4a14adf7
SHA1 72dc137e9b8690ec23c71ca884b24903f659ff6f
SHA512 7d4211fea4b25f4a753e91e184d45ecf32d5aee9733a2c90290b9c7eb5db6672005f1f668007728665182b51a4746e93abbc9ad767467728de4e5fd18cce6365
SSDEEP 12288:qHOVpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:qce48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T188D423A037431D3BD9899BF3DC336E16DCE75C6916744A43ADCFA2E18A06391818AFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 602KB
SHA256 179695d2c8400c24209ebf08beb5da513435181bd39a71729d9a10cdc92b4bd5
MD5 62fd653066b801747fc8637e589dde33
SHA1 96ab3996d475b6d3b538d5340c2c2950d57d2c29
SHA512 3eff207ff162aaee52eb24d1bea47a844135bbf23d924871dbb576b0bce0c98fddb443bc838f2fc1978b403ec34df121fb04378d0c4439c12aea837ac10cca95
SSDEEP 12288:j/poPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:j/e48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1DBD423A037431D3BDD89DBF2DC336E169CE35D6816744A43AECFE2D18A09251818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 602KB
SHA256 3befd2823397ea9af6d4887aeb9e560938b70ddc75315568187b07b9bd01c0cd
MD5 b2dd7c228e63520c498eaec7bd679817
SHA1 91cc96bec802fbfbd83d2425fc177cd0d2aed626
SHA512 1b3e9ca0f035db05b24ff23bb110d5b5e4d5bdfeee85e2dce2d6106dd69b94a4f3f2da8b43cc075dc523b3b2324fa84efde54034112adc16392a3d6c7e30521b
SSDEEP 12288:abpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:abe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T187D423A037831D37DD89DBF2DC336E16DCE35D6816744A436ECFA2D18A052A1818AFD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 602KB
SHA256 bbf9b8eb8a527b75725090c95b7b60f10a2a1336808270151f9c26fa8430cb5f
MD5 b6bc9db20146d5a4e97fac8e76b7bfba
SHA1 e86566c8e809e03e56825bbf533cc43bbc763e49
SHA512 5476a1d796becad7b83690fe104c89d8ccc75bfb7304dda8c0e95133535b3baf43f2c65589c4a68086a0a8139f5e46f8c983438c60f59c85ec51d13dd47d955a
SSDEEP 12288:7BpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:7Be48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1ABD423A037831D3BDD899BF2DC336E16DCE35D6816744A43ADCFA1D18A0529181CAFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 602KB
SHA256 5765f46b4e71dfad54ab4a3e4ed720495ac03a32e70fa45090648b4f0b60a1a5
MD5 18307dca91b7ddd675be015fdf1655b3
SHA1 cc53eae28c1f6abb3ea19bbc7b15ec6bd04fa339
SHA512 95616d46dd48a385db7ffa474e03c8907f25cafcfa0a723de49b021719f976fb3535fe4c53b1385e4a692cd6c1a3fb11136f885f98ab3bc456c36480b406a21f
SSDEEP 12288:lfpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:lfe48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T16AD423A037431D3BD9859BF2DC336E26DCE75D6816744A43ADCFA1D18A0629181CAFC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 602KB
SHA256 4446f183530000b09f80025670937a49ced4300891d2f522f6dbf2c2a34b87e0
MD5 403e7589ee8ac5dbfeb5eb7e34c0faec
SHA1 e782762149912d2cd55762998d1afe7a691233b7
SHA512 9b3adf9b1a1f9e46b964a5b1f9171010e059b328ed8cefcc63c639af2e5c0d707a36a64c9f9a8a3970f422b4df15b3bfcd3008e53b4946a45bfea1ba5bfb91f8
SSDEEP 12288:xapoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:xae48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T199D423A037431D3BDD89DBF2DC236E26DCE35D6922744A43ADCFE1E18A06251818AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 602KB
SHA256 17077f152c9ca12e12aecdc72cd0f845c71f3e20d280804c42d67d25bd3870b5
MD5 0e1e76fced4a32cf3486bce81d594ce8
SHA1 aac0cbcab6e0c98b88f31d47bd1da9eda7cba20f
SHA512 8ae29af3b1de1c42db0dffb305a97f13eeb138c05a499297e833fe02646043a2334c5d50985b8c4cd27d336221d728e45d0363b6b30debe51d59f07aedbfb41a
SSDEEP 12288:7/poPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:7/e48e2lfjpiRDM3bZILgPVvaK0Feri2
TLSH
T1F0D423A037431D3BD989DBF2DC335E16DCE75D6826744A43ADCFA1E18A09291818AFC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 602KB
SHA256 d865c5a95f6abcb5bd404e6609e495c2e7f1e69917df41f6e4732934754289c0
MD5 1827a5d5a4608646acb075e0800863a4
SHA1 2950df07c84bde761d29f230c53db46d6a2eb845
SHA512 d5f049771d8c3119647ba53e99c271e7282a4a4653b202b7adc0258048448c14e2373b70b17baa4b904edbc0d0557b7e78b0b341cb768846a888adecff27079d
SSDEEP 12288:c9voWpoPLk8e2lfjpi09QDM3bZIBt5FfgwwzSwvaK/qbFQ3FgciZ4tl7Djbk305C:c9voWe48e2lfjpiRDM3bZILgPVvaK0Fc
TLSH
T1AED423A037431D3BDD85DBF2DC336E26DCE35D6822754A43AECFA2D18A05291818AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 d72d98bf6163ef224981b9f3aba832e78ef7e34e90b4405f0fc4a5971a98d646
MD5 283448bfb9cfbc6938a1a8445d775c29
SHA1 1843173597c93ae48ec12e7e614a6a71a5e2d46e
SHA512 b7913a8bb04ce1b36cd10e9cadd4d2cfca7b967f1700aa2cc8a74c156f662f89eb7ee10aed580b524bec5ae00ec46c2932757bbd08c76b282a0fd95c27012a87
SSDEEP 12288:OWyfqabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:QZNYAWqrGSmQJU3s3TvQlDPkB4O3NNYw
TLSH
T177F4010AE29401D8D0AEA175CB880B81F7337C6663E1E39B16D0F57E1F764915EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 fd41380e14cc9465539a94dda532078a65cb27678611580907f275db4cc8e53a
MD5 5f28ac4f64a2dafbf2f5607617c61b84
SHA1 9553b74a38d0bcbae06129e020b84feeb27658d0
SHA512 68a308d2425c38ce101c496cdf713d18f67623d656a7e6b7b42eb745c59b4415fb0972fa0802e17d2de556dde5f1801b3dd22142de4717e697c7d7de0548d446
SSDEEP 12288:bZGeabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:tGlNYAWqrGSmQJU3s3TvQlDPkB4O3NNN
TLSH
T162E4230E35F220C0C57EF67488A807A7FE707991379823FF08A1D5B5E7698E16675E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 c5492b64fb28dda8fe2991cb020c36f4a0018bee67fdbb634e2765810e3693f3
MD5 c1fe4d214fd11470dacff4f456edbe3e
SHA1 39c9f32c96390d91de7f8bf9bed4ea429eee43cd
SHA512 febc4b4a84a12eb35bc4c6d8bb40846473d757476a9a391fa87f5d6a03ee50d756d437abbac03851edabf9ed724a6324f26a08e00a5605ad5194378f0a288af4
SSDEEP 24576:AFDIGNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:AFDIGNYAJmQhkD03NGw
TLSH
T17205020D337610F5D0BBE03DC5820652E6B1B4B1976616EF0AA4C5BE9FA3DD8B938E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c87b9f5bf7368f4e3dde1d78118957c570a21f6131052b8552ad301488a25390
MD5 f79a429d550291093dee6bd8aa902945
SHA1 406770f5ace6749b019b2cb75be2b9bd02269939
SHA512 457e84bf76c2aff0a234242ecd823ab2dcb4625f85d3f3ca0fc7402dd20118589a02dec856eede9d67a4d01ae077da4c3d8c86acfe42420fbb46d6f29f59ac01
SSDEEP 24576:TTkNvNnaFeYhJNtmZBm9NYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:TTMwBtOm9NYAJmQhkD03NGw
TLSH
T13F55AF2EBAF805E4D1FEC6B4CD238512EA727461173293CB5290C13E1E679D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-15-0x00007FF74BE20000-0x00007FF74BF43000-memory.dmp

Download

memory/1116-18-0x0000018E35B70000-0x0000018E35BD6000-memory.dmp

Download

memory/1116-17-0x0000018E35B70000-0x0000018E35BD6000-memory.dmp

Download

memory/1116-16-0x0000018E35B70000-0x0000018E35BD6000-memory.dmp

Download

memory/1116-86-0x00007FF74BE20000-0x00007FF74BF43000-memory.dmp

Download

memory/1500-56-0x00000198B6530000-0x00000198B6623000-memory.dmp

Download

memory/1500-57-0x00000198B6750000-0x00000198B67B6000-memory.dmp

Download

memory/1500-58-0x00000198B6750000-0x00000198B67B6000-memory.dmp

Download

memory/2152-36-0x000002715AF30000-0x000002715AF96000-memory.dmp

Download

memory/2152-35-0x00007FF758A50000-0x00007FF758B19000-memory.dmp

Download

memory/2152-38-0x000002715AF30000-0x000002715AF96000-memory.dmp

Download

memory/2152-235-0x00007FF758A50000-0x00007FF758B19000-memory.dmp

Download

memory/2640-278-0x000000000A550000-0x000000000A7AF000-memory.dmp

Download

memory/4368-27-0x0000016AD2A00000-0x0000016AD2A66000-memory.dmp

Download

memory/4368-28-0x0000016AD2A00000-0x0000016AD2A66000-memory.dmp

Download

memory/4368-88-0x00007FF758A50000-0x00007FF758B19000-memory.dmp

Download

memory/4368-26-0x00007FF758A50000-0x00007FF758B19000-memory.dmp

Download

memory/4368-29-0x0000016AD2A00000-0x0000016AD2A66000-memory.dmp

Download

memory/4424-1-0x0000000002F60000-0x0000000002FC9000-memory.dmp

Download

memory/4424-7-0x0000000002F60000-0x0000000002FC9000-memory.dmp

Download

memory/4424-0-0x0000000002D10000-0x0000000002DF5000-memory.dmp

Download

memory/4452-89-0x000001AD801E0000-0x000001AD802E0000-memory.dmp

Download

memory/4452-135-0x000001AD94310000-0x000001AD94330000-memory.dmp

Download

memory/4452-101-0x000001AD93DE0000-0x000001AD93EE0000-memory.dmp

Download

memory/4452-121-0x000001AD83CF0000-0x000001AD83D10000-memory.dmp

Download

memory/4452-91-0x000001AD801E0000-0x000001AD802E0000-memory.dmp

Download

memory/4452-90-0x000001AD801E0000-0x000001AD802E0000-memory.dmp

Download

memory/4452-100-0x000001AD83930000-0x000001AD83950000-memory.dmp

Download

memory/4496-71-0x0000018CB2B60000-0x0000018CB2BC6000-memory.dmp

Download

memory/4496-73-0x00007FF72E0B0000-0x00007FF72E218000-memory.dmp

Download

memory/4496-66-0x0000018CB2B60000-0x0000018CB2BC6000-memory.dmp

Download

memory/4496-65-0x0000018CB2B60000-0x0000018CB2BC6000-memory.dmp

Download

memory/4496-64-0x00007FF72E0B0000-0x00007FF72E218000-memory.dmp

Download

memory/5776-76-0x000001E1D09A0000-0x000001E1D0A93000-memory.dmp

Download

memory/5776-78-0x000001E1D0910000-0x000001E1D0976000-memory.dmp

Download

memory/5776-77-0x000001E1D0910000-0x000001E1D0976000-memory.dmp

Download

memory/6060-50-0x0000019B40B00000-0x0000019B40B66000-memory.dmp

Download

memory/6060-49-0x0000019B40B00000-0x0000019B40B66000-memory.dmp

Download

memory/6060-48-0x0000019B408B0000-0x0000019B409A3000-memory.dmp

Download