b048fcaad193b3cba68f1f47e035b47f1598da50dea466a8767a40fefc3509e7

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Size 3.7MB
Sample260708-ka2pmset2l
SHA256 b048fcaad193b3cba68f1f47e035b47f1598da50dea466a8767a40fefc3509e7
MD5 bc5cbf92121351cc5710cea201b2d60f
SHA1 8f8377d2c22d49809de089ce2aa332c56ef130b6
SHA512 aed0508783f40de3bdc208c01e87277ec42f4677809e2df75e22b1c05f905a0993b10211063b427b43db54e0209d6c9622a43d2ac1d2e569eb5c762dcb8cce21
SSDEEP 49152:FKABc3HsllZqMFTbT296BT5bVMvdTsP5NEobui2GBE2pIzTGHniK3H9NOaDa7b44:ZBc3Hs0+bWsPsobuYB+zqTh+44
TLSH
T12A06B003EF81C071E592163E42BAABBA8E7DAD106325D6C3D6943C144D775D2E63A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5532	elevation_service.exe
4296	elevation_service.exe
1776	maintenanceservice.exe
2188	OSE.EXE
4172	PerceptionSimulationService.exe
628	perfhost.exe
1952	ReFsDedupSvc.exe
1960	SensorDataService.exe
5608	ssh-agent.exe
5488	AgentService.exe
2548	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4217ce2584defa61.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026b99c4fb30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001548318cb30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024d5c74fb30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a03aff4eb30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d943744fb30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800006b00000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c701610f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5532	elevation_service.exe
5532	elevation_service.exe
5532	elevation_service.exe
5532	elevation_service.exe
5532	elevation_service.exe
5532	elevation_service.exe
5532	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1600	2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5488	AgentService.exe
Token: 33	2548	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2548	SearchIndexer.exe
Token: SeDebugPrivilege	5532	elevation_service.exe
Token: SeDebugPrivilege	4296	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4412	2548	SearchIndexer.exe	99
PID 2548 wrote to memory of 3448	2548	SearchIndexer.exe	100
PID 2548 wrote to memory of 1360	2548	SearchIndexer.exe	102
PID 2548 wrote to memory of 5492	2548	SearchIndexer.exe	103
PID 2548 wrote to memory of 4476	2548	SearchIndexer.exe	104
PID 2548 wrote to memory of 1964	2548	SearchIndexer.exe	105
PID 2548 wrote to memory of 2276	2548	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_bc5cbf92121351cc5710cea201b2d60f_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2188

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a1e8b20516ea83647c569aa3984793c07283ff0266c97778ac7091d87e79d266
MD5 f26304833efcbebe64efee4482612691
SHA1 5faddc6a3bf31b17033efb932b9ce4669cdc8447
SHA512 8408f0112e99a2927c295c33b179fc2fd68a1f72d0af597f869ef73d12e790de7987c5e85ea90aa6ffe552e392ad8ca76741f84ef4f5ae80cb25e518d8548293
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6NOaDa7b4FK:33q6HjBdh+44
TLSH
T17AD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 38cd59d6b7f763979cf5c4cae79e7f1b326a571cd2a8f956382970189565b4e9
MD5 a0520463e4282973549fad5019d7a382
SHA1 34dddff22840579d5cda89c333a75b4edd36183e
SHA512 769f70bc5f107f9c0d53c0c6d7b5b1df8aefe09238dbdc2d0e966e326ea6a0b39def0ea8bd44700980824d6add99687702564a574cbe96fe7b500327f3fbdc54
SSDEEP 12288:M1XLsswWkxy2lRq2czAi4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:6XYfDtczAi4RZXBYa081a7qM4FfUrd
TLSH
T17775F128B7E509F9EC678179CCB28502E6337C454760E79F03A49A260F336D86D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1e17951dc2863f3596703bb5d1603932bf8b88452543757de65872379caf2fc6
MD5 71a1b7697b05faef180406de8b7365dc
SHA1 87cfc932f83d5703b64bfa0a2c9596d78e60ac6a
SHA512 bae23c6ac872284b6ed65aca735281df839add16db33ddc55f8678b337cf009ebbc62eae4fffb8bbabd89e9528d5f3f9a7ba587804007bf1b499461df2691125
SSDEEP 24576:00Le5ji0hmx1rMz4RZXBYa081a7qM4FfUrd:0Pji0A7VNOaDa7b4FK
TLSH
T19B95AE15F6748775D073C0B9C5D2A68EED7230825B308ACB4286D77C2E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ac56a22dbb5dfa271a4a5816c1c8315bd8d157614cb65dea11c7df6b824ddc0c
MD5 f7a61ee3b8affed6dafd07e5bc8dba24
SHA1 b73297ca1ba5db423bf0b3b96a9abcce29c489ae
SHA512 2390c027f94dcb63d63c2200d1b260e4db2c98f15147aa6b2f79fdb88d95863f89357598ff4d8af230dc5831dffb894348de6ee66d47491f58d3f7396eaeb596
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuF4RZXBYa081a7qM4FfUrd:P/ezSC6vUzPvxHjyRNOaDa7b4FK
TLSH
T170756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6752b879763c6ab6514112402b44ab740a9e2405ae5ff3684e3dced83aa16493
MD5 12013bb31697ee6992397af99faecad6
SHA1 11d7c210a2ea0d6e90353c92dfbe8e2e71b00d04
SHA512 82c92759014a0437517e76a07685085138c35ef947fc7def4bfa2c96f748bdaa5244f74dcec9e24ea797fcfffd1e9bc446dc397ff6ed3de84ea4c4a7ab80b332
SSDEEP 24576:pVbqPb88hv/l+6e4RZXBYa081a7qM4FfUrd:pVO88hXl+ONOaDa7b4FK
TLSH
T189559E65F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c59388d4d050b2fac8249efe7d57a14b0e386acf888c8e493c013f2f4aacf31f
MD5 bbb08c97136004293b885178be12f860
SHA1 8f4914fc8d1117e7cdba25ea61c28b5ab696f2d1
SHA512 c15117bb3c16c44a2fcff46db21b9cb18fd38758c32cff5ab0763bdb3f55730b3f0242ca6c6dcc492bc661e07878dac8db62fe4b75a526e31479223a2d462d5f
SSDEEP 12288:WNv4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:WNv4RZXBYa081a7qM4FfUrd
TLSH
T100652304DB5E6DF5E626697209BC4C46C4630C046919D62E4727BB2B0CBECD0FCEA93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 bdfb1a83b0b8dee08ed433aa721d7fdfc5c0fea9d1affc247ab2ce4b65203302
MD5 d4c2e7e2e5ed7879530ac57ec97464b9
SHA1 d9ccf5d00e17e182d8744a924a47d15f649eeba1
SHA512 3f0b238b20a0fc2a33d66a389faf1b99d3db70b9c14f925e50ca67d582e9a5df4e895e20db41c29272892651e870730c80a0ed36e221dc86aad850f61e981a87
SSDEEP 12288:beBNUbTVO86Us4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:bJIUs4RZXBYa081a7qM4FfUrd
TLSH
T1B075CF3BEE28FCE2C27A5DB95A918640D77278304F62A3CBD175830E9E235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 238550f83bfa897e00b0edbcf5b7df460fe8ae68422d07b3571fc4577840a697
MD5 9a9f3ca40412628482c01551114c4607
SHA1 13ed0f39115fc19983ac164350b48bfcb6ecdc40
SHA512 36c01968ca04571653cf277f7fcbda6e621ebb3a88b9b8281d0df8185d6d14649eed6dd25f5d9e849f51b8acebe9cb42e823e54cc6664881458470f68a2ce3eb
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:tQvGAdlCEL8c/yRNw5CYh+44
TLSH
T1E3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 132fb11f6130a8c10447242e5c181c10da2e9e31d516b27cefd233f56cb8f010
MD5 014442a8ea137ae84eb164f339859f9d
SHA1 14c72557bde16d22789bc28e95038f6c01726bb3
SHA512 029f2ae3b693ebe794f13dbc9ba098d226e63ae84c89346b8e80c9b101f7b9cd370687f59b7c6e1377365bd77759f78e7ecab846aef574a19c445071bee30a90
SSDEEP 12288:NAwSfxL/2Dc3LDLLmt0LDQewsAjO4LNcYDYABenVKV08hol81iUw/70rM4vtbew4:+6ewsAjO4RZXBYa081a7qM4FfUrd
TLSH
T12885E031FF75E436C27B0DB21B36CB06543D69204B611AC3E3A88E9E49742D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c38b83f174ce2228e93e9bf87c646b15c5ebffdf177ec7e07d977c1595f6e956
MD5 1346e66bee7c84b3eb826611a47d1796
SHA1 da6191f90dd08be15be9beb04ceb81e6b824447a
SHA512 edd666317053e2f5c4f527ade68b739110f00abafba6e286cef2e2bd37d516ea067f9368314e80a9abfd842b586a507effacf9e3f27bfe395977437661a18510
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFY:eUEtQevvqc2W1cpV2EI32FY
TLSH
T1D0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 141ca707d988e6ed860c8505b8199505ac6aba3c7636077e7e4f1d8120adafcf
MD5 ef70419a3b412f43e48ffeaea7b1762a
SHA1 3f35565cbcec16f227c66086b68fe026881f640c
SHA512 db35849999f8e918b0144265c68d8bb11a7a3ffbc17a12a358298eaceeae3baa6ece79238a3c092fc561337991348275e3f2508680a6bb1029cb06a9b3eb8e57
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zlNOaDa7b4FK:9oqtVjnmih+44
TLSH
T188D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 72f7bb165b19a55c1156da0219cece881f6a84c7563fd83b886398455133dd22
MD5 9b331cf94fc0db944846b79077ba51c1
SHA1 56123831aac68d17dd586ffdf15ae89e1196d060
SHA512 1a23d5c0f3459bdfacf56815f6256d6098fdebe72aa8e8ddbec589a07c246f7d33d22c4d375b86764fd1730ecabf85ff2fba8a39d922844cc305bcad3a4660b9
SSDEEP 24576:1AhGLJIFoiwtA5l7S53z4RZXBYa081a7qM4FfUrdP:1AMyFoiq5iNOaDa7b4FK
TLSH
T16C359D80EBF955D4F5B3AA7859B68571EA76BCA55E31C20F1260D21F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 832c1735805e810396f5937ae5e04612ca9afcd11130f378989f1d0c98f0b4cc
MD5 5449166bb519735bb9ff545546ba5b5b
SHA1 c96ba9923745a712d93026dd04f990b14bffad03
SHA512 ce658954fb5fc26808162ff3d7802fa9dfca68475e374e495fcff26a539556a445309861da29866abf9348eb416d4bdf179dc5338436fe02d1aec112b359eb63
SSDEEP 12288:Fmw5HEjsChN4BFgl0WDm+Cl4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:gwuVOWs4RZXBYa081a7qM4FfUrd
TLSH
T11275F04977A91CF9E967813989A7C536E7B3BC012A21D71F0760C71B5F37260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 7b12fc7ee1f622760a12e5663e552cdf8dec8d18bf036156e7fae0e04dcc6de1
MD5 2e78c97b31babd2d1796f0f26e6cd78e
SHA1 3e235d1e08578b55e5f1f4325b55bef4ed981ffc
SHA512 2e5a9503bb44cba7d1769869617c7b98313db5c5fd076b4c7da38bc8f96016464624cf83ab621ebc97b8c684e68547f1adab5ec2cca787c3780b5e612967c17b
SSDEEP 12288:ZFZ1Iye4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:DZuF4RZXBYa081a7qM4FfUrd
TLSH
T1BD65124967A824F9E16356398CF94A46D7733C12273683CF0725876A0E77EC1AD39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d4aa341f44f16d9b854e32d3b9a60c897f9e245e5a1c3fda3e6f0e26673fa5ff
MD5 a7c805376b2b1d5c4798818947b1e79c
SHA1 ef55e2a089e58e2557cac85c011529bf23d55771
SHA512 a8790d043541ff50a057aab76d90882047843d282f6e8a9e976097557884d431913139e220fa5e8d8c787e40a0aabc98a7f3e71ce0dc7f053a72cad0f912dab8
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:kQRQyi36YOcPQLvw2gAf+PN3/h+44
TLSH
T1E7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4c14e841f6213c23bba1ebcbc4db0b675d3583a08ee12acecaf9f8b3bf10e2b0
MD5 eb2ca599f921776ed911fdf170267eb8
SHA1 a17b8071aefc9224ef99d4c70838bcf811fed340
SHA512 6c1a11f42bde918966d14a15027b395f1fd5f2f1edf3bd4afef4a9fbdc7ebad92b48b490329aa80ee6022a6e2fbcca0b4c7c45b3c72972f53b4ffcef6c38159c
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:+QRQyi36YOcPQLvw2gAf+PN3/h+44
TLSH
T11E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6ecfe8be43e339626069aecd5566cb143ab5b56bcaf3584b6a6cd27ac2354b13
MD5 cbed289d511080d860aab5faaedc154f
SHA1 163c3acb7d13508c1a217aade17ee3764e192b14
SHA512 905a623513462777c964ff4811d97cf4f4cde37d0fa529d32bcc662410dc61539b5e94642f23d3f6647decbb14d0849f88e7b2280350fc0f9f4189e1d125cf25
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL014RZXBYa081a7qw:c68Qg55nhheWu7PNU3/nNOaDa7b4FK
TLSH
T177B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0e976abeffb188d1aef6f9d02cfa6bcaa2445239d399d27aa27b8e612eb5b2a9
MD5 444c05a8a6229a799cc8c564499470eb
SHA1 9bd9939e2081b049fa005a39fe7789766a908c5d
SHA512 07fa54e51e71fa84b0e3b2ad3effba79839cc27eb289a4f7ec3d63f455a3bfd3c82488d7412b1fc768d6240eda68ec111947e198be747b7407ef350daa03fb66
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:ay5112gYy5azzVvL69nLKnhZSh+44
TLSH
T16E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a7aa2dc6f9cc70794fdf40dc666a294792f4e59d4c5f7d5d7dbc4fd209789e1c
MD5 8f3870cfae4f0a10891baefd19ad1f29
SHA1 c8e164c1f1f60ed04f7b794455214b8f5f2f7fcd
SHA512 9fe611903e6f0e96da3e21adf1f085cc81a9fcb99c0bc0833ef2f0c6880cd323cd8f7b5e3a2073cc7319650c9a5338b0deeea536fa1a6f185e8203cd59d4b9f0
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gljNOaDa7b4FK:Fu6JmVxd2dBh+44
TLSH
T1BDD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 72fd8e7fa95de49c148582b0d4ca4589476bac9c88621aed279a6a89ce61be11
MD5 4b042e685d3f6b210b3826439dadf670
SHA1 532f3dfb69a7ebfb50b8a4b3c3ab9861966b6c71
SHA512 574f0e2a71e7f7d32e446c21d2a03657f403262768d164e66cc375d3f3652167c7f9aae009d62df9f2e0271d704e5585abb0b2f666e64888796472743830473c
SSDEEP 49152:s1hpsNoJpF1A6UU44CwH7R4xRNOaDa7b4FK:smifPbRch+44
TLSH
T13DB5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2a10b9234e7d02f642be12f9205494d63c2728ec39802d8ce38f5359c3e45603
MD5 73cd5ae0e8cc363b14f06f5feceb7988
SHA1 e0714ebc47f82d8dab53fff1a88a37da7e56b6c3
SHA512 dc4afbbd34a9f034dcc85ee64711fad330c078d1345c0a1bb802c234f04ca951232373d8d721b776173d01f2656c15e10fcd1540f8d7883a39d9953fa008afa3
SSDEEP 49152:aSuZQIY0Be2KRRVtOnks6NMHqwNOaDa7b4FK:E5dKTi61uh+44
TLSH
T176C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a1be0bb1335243aa7e5d6a13cffa0620c6ea0e2ce4d0aa2eff8019cedb678c58
MD5 d135800f074e1dd18cd904da45917051
SHA1 9905cc771f765d4205376d16fb3815f6a2706cb5
SHA512 f0c5ab3c172ad9f80d5400697b8caaa50c5dc7dbc67d417a1aba6a8c3d08d1fb7ab9c96f732d8206f08f6acb6e9d084665dc183afe37c35097d9f49b4e9d0160
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wVNOaDa7b4FK:SX2iyphgh+44
TLSH
T12F95BE13F2D900E8D05ED178C7568632E962BC060B39B6EF0A50B7561E7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d86318afb4616f8add6398989a907527f1029332d11dd82e76652cf30edc6d6a
MD5 c4c75df6c088e4c50a7f6e0eda8dfbcc
SHA1 12f00dc25dd86507c233b2ecfdc2f7423339dcc0
SHA512 f3ba24df67a9dd551779c985bf8b82e7f9bcf542f73286bed911b584551fb4d7190550c12699c8974b7bb34dd8d1d293cbc8a40bcd0a88f4b610c9a1f80f1914
SSDEEP 12288:JR4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:JR4RZXBYa081a7qM4FfUrd
TLSH
T1E6652308EF5F5DF6E421697209BC4D46D4670C05BA16D22F572BA7170CBACD0BCA983B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 9a01c5abe37fba1ea3dd99a61d9e871b950026e4cf9b4e79d078ba1928d8c3b9
MD5 944db01a7081d8f4ee322f0698a88002
SHA1 ddf3583ebd68e7deadad4cfdb49bc388ebdb1a9b
SHA512 a22d00c659ad44d939cb4791d9710f74935c77fb48d608a7d333ba95782027cf0a7efe532bc757f553ef9d355b9e45538dd0602f9ba6b23932e040936eb34840
SSDEEP 12288:lq4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:lq4RZXBYa081a7qM4FfUrd
TLSH
T127652308EF5F5DF6E426697209BC4D86C4670C057A16D22F572BA7170CBACD0BC9A83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5303a1d3a8cca496319e9b725f53797631f2754269bb0b224cba328c038a4330
MD5 355f610bbf2241b92b2812c09cb6220e
SHA1 1392e0dc95ac56aabd541bc9b3ae987e2f8de4dd
SHA512 da3937e09f43b2c88b0b8f4dacd657adf171dfd323455550035b12105d94b926f88851aaa47b29defb787f45968150e221e78d870e37b0afd035064ebe6ca566
SSDEEP 12288:s04LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:s04RZXBYa081a7qM4FfUrd
TLSH
T150652308EF5F5DF6E421697209BC4D86C4670C057A16D22F572BA7170CBACD0BCAA87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c2037d1424ff8729971c079fbda01a124a82f0637987df786602ab749ac52be8
MD5 fe325efc8c7cb44ca29b70bfdbfd2d79
SHA1 0df1b4dd79fb5b0a9e37c9e968619d46445215a0
SHA512 275342ee38366cd15cb9ca56fd12ce02c167553c6b58757602db3100a5f9d3a1d6074e2253cb96c74dcdba1e6bed56b3a7fc92dd928ec68f243ce9fc48a774b3
SSDEEP 12288:5VT4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:H4RZXBYa081a7qM4FfUrd
TLSH
T1F2652304AB6E59E6E432A5714CB94846D1B33C04BB36D36F47125B1B0CB6AD0FCB9E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2cb4780bf282b499b4c0701fdf4f56efd783462d17023b88adc22a455da85a54
MD5 f5fef25db0b5e0c31404ee763071d5ac
SHA1 970316383e68dd41f1dfbb612db5f4055efc5983
SHA512 1c876695b6f885e0cff386623ce485dbb71d57be0052966b6e748dffef65e4dfb690b79ce50662889816267da5b82335a590a6fd54b90ae5c1df7264c46cbc03
SSDEEP 12288:rr4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:rr4RZXBYa081a7qM4FfUrd
TLSH
T1C5652308EF5F5DF6E425697209BC4D86C4670C057A16D22F472BA7170CBACD0BCAA87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 2d10db8e9fcfb7bd2be8bb6fa1490d02832af2f76cb2abbf6e8a71a00e44aa1e
MD5 d244ec84ede4eeacb021ea04e5cee701
SHA1 06a11fe529a38b6faa03dd4d93f979371af09d67
SHA512 96b0381b66c7600f944d0cf4c8d9683a03e42c9ed8e31c824abd5b652462649518215b4b3e42f38088fb48fb7243c808b2287eb689fe1c343c34adab6a1ce8a1
SSDEEP 12288:2W4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:2W4RZXBYa081a7qM4FfUrd
TLSH
T105652308EF5F5DF6E426697209BC4D86C4670C057A16D22F572BA7170CBACD0BCA983B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 2b38eb017eb549f85a2997b6122328be917110d8ab84a0ae77c1d9c3507e7db8
MD5 749bf49dd634a7e001ef08a0555914f5
SHA1 ef275a32314bcb271a9bc92418e8558af2213541
SHA512 d4f3bd59110ae7081fa2ef297ec60763e21e8b294e32ffb70c0c3c2d12e4720c1d5d9f01e609941a0e0b051358c3eef602d5bba924df5de5b015e30e4362afec
SSDEEP 12288:Qi4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:Qi4RZXBYa081a7qM4FfUrd
TLSH
T16F652308EF5F5DF6E426697209BC4D86C4670C05BA16D22F572BA71708BACD0BC99C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 170ac7fe1f22a4c334d040e6be8133b0243f8efbff1abed1f900c5c599d6afb1
MD5 20e5857d6880e18bf38901f72c3f3ee0
SHA1 7391784df9ec5637f764169238d7affa7d5e83dd
SHA512 bb53af8ace8bf0520985994c1f9985c2844dc2acd9ef9d525591fac61ac21b94b1a8a177f8ec526ab7a3c38b104bbafa131913b0340557bb44fb4ab37be08e99
SSDEEP 12288:6iZwbZzzFEoS2cPvyK4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:dZMdzFVSOK4RZXBYa081a7qM4FfUrd
TLSH
T17E75F195B3941CF8EC67813E8D658906D6B27C191B60C61F03A8372B1F737A15C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b35b9d4526ebbc6c83236df5f3fab054f26a476cb7ac03b8f90c380a419208c1
MD5 c94c2c09a772646751f35aaffde7b841
SHA1 e9ab0d1da1aebff6d1cf0fab0616c02f7728a843
SHA512 f21aaee12c7bef41525dff1c9c9760c251f0595fc9861fb560e6f2083365390eb0a6949c84e9d38885462a5e1f33d78312e5a1ac1258178812434bebb3529f3b
SSDEEP 12288:TV4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:TV4RZXBYa081a7qM4FfUrd
TLSH
T1AF652308EB5F5DF6E426697209BC4D86C4670C057A16D22F572BA7170CBACD0BCAD83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 57a2fd427c6127ad6fc27e842eaeecb3b9b3222ade9049739c65e8866832cdd3
MD5 9adda30b28dcba5ccd1f66a311c1f6ac
SHA1 eeec00708eb1dd37c57935745a97b09ac1b6fbb8
SHA512 1a46587c8710433892ab81270949c47b8d488c4e4be94af1fc27e84fc884cbd2ce75c5d2e33a2182c4c1ac3fa1ca971095b18017c954c84725927e0af40c42cc
SSDEEP 12288:y54LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:y54RZXBYa081a7qM4FfUrd
TLSH
T16F652308EB5F5DF6E426697209BC4D86C4670C05BA16D22F572BA7170CBACD0BC9D83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 095e21eb51e8512310c2489a657891936c820b9235b0433ca70d95e6faed7af2
MD5 57532c476e87bb373cf4096e9f13d623
SHA1 64fc88103700f79b48fa2dd8104d01a6b65c42a0
SHA512 7913015fe9377af4f1cf20ea0253d7b39b6f5c1fa2d24ff716eed689e40510c5c46573c3de39dc4f49ba1594c8d1240bf7465b09a886fd2d401a7bc5e4ffce52
SSDEEP 12288:ryPz5L8e4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:Gzye4RZXBYa081a7qM4FfUrd
TLSH
T1C2750207B7A630F9D036923588A60A02F7727C361B248AAF176447771E776D0AD7EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c3cd1ad0c15944a944eacfd9e3edc8aed78eaf69214c5d3fb6671b86d2e02c6c
MD5 e337fc3f142fa421c8ca9e00f7700081
SHA1 76742248bd9374fc735d3b25a2e5ef075589e4e6
SHA512 f8b2e33de7fecef06169467a76d772188b5a480dc2fbce589b925542c149a7d5386bc9b260f9f1577fd3b10bb897ea1cbf6a2cd2467e435399b5673054d1a0d7
SSDEEP 12288:yV4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:yV4RZXBYa081a7qM4FfUrd
TLSH
T159652308EB5F5DF6E425697209BC4D86C4670C057A16D22F572BA7170CBACD0BCAD83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 fd187f929ba9712d629e23f86e4f643aa3c18decac97b30057da75349768d09d
MD5 4d0c7a553493c066685043e1320b6a83
SHA1 fe39946e846d3481da2b08e8b717988142cf3f06
SHA512 82aa1fecb1cbe9ae321c73418201eca50665d01652939ef528eb6f141ddbd2075c567199126c02d32f9131dad8546dc6d920da55c2b3c954d193ce807c5ca8d7
SSDEEP 12288:eV4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:eV4RZXBYa081a7qM4FfUrd
TLSH
T1E5652308EB5F5DF6E426697209BC4D86C4670C057A16D22F572BA7170CBACD0BCAD83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 c94a555dd860f77822f915250c2f8f7b860c892cbce797dd9be1163d1abd0926
MD5 861443ab76ffd194303a7d3993cc7516
SHA1 bab64bfee23b191ec9920125929b8b885a96dce9
SHA512 296dcde1250e637a7123e2f915b6e9ee05f4d8966f0d503f4d426532d324057003a0f42e10cca7934fda637655eec178bc481bb06ab74a4d0e4dd66b9a1901b4
SSDEEP 12288:7yPz5L8e4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:2zye4RZXBYa081a7qM4FfUrd
TLSH
T19C750207B7A630F9D036923588A60A02F7727C361B208AAF176447771E776D0AD7EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 5a52d019d1d1f2e9673467356fadf7811144e5fd9344888296b31078bbc486be
MD5 74296f9ba5d54d6c2c5babdc52eab467
SHA1 b1bbc26a1c73236eb64cf4c876ea650bed46b0dc
SHA512 5fc8cc4a5222b51d1d304113aaeb733509c23655a75875d5598c2395a76505d9918c2a6731d0ef13a5f8dab527016ae561134881b32e3398131747247d773229
SSDEEP 24576:ETGaLl3z0zDk4RZXBYa081a7qM4FfUrd:ETFLlj2NOaDa7b4FK
TLSH
T11475F194B3501CF8EC67853A8D658906D6B37C1A0B60C61F03A8376B4F777A15C2EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 6ab711119a4e5e356040ee1fce497e6481381d1f84c99e826a07d0bced6ccd87
MD5 ede889772628fc00d78e86ad67fe73b7
SHA1 4375d1b9fbd08852907c89155178978e0c87e137
SHA512 24d571b5c12eb520b63360b0e53ab102731e90d0f28de8f34728b34a062f68fd4985853e752d0e83d1755cd8b303794b66288497f273802137f384a67ee6604b
SSDEEP 24576:V3Xd9CHKy7GZQ4RZXBYa081a7qM4FfUrd:1Xd9CHKyafNOaDa7b4FK
TLSH
T1A695CF90F3E814E8F0B79A358D764502DAB67C591B31DA8F03A4661A1F33AD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 32d082bb24891801c371f3fd281b9a009c6528e5841052a60c6383ffe9b6d264
MD5 2d3533996a4f90e1caf6f5afcd003df5
SHA1 fab36da5e053d8c98251bc47782850152ca9af61
SHA512 91b40a80a00fe500e1c59c3efb7c7823f34ece162548af7b7b31ee9e876e9cd9cdb250dfd93e9b95b3939229e1031e34fbd8d827ff63fe426ad76454a7d636ce
SSDEEP 12288:SU4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:SU4RZXBYa081a7qM4FfUrd
TLSH
T188652308EF5F5DF6E425697208BC4D86C4670C057A16D22F472BA7170CBACD0BCAA87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 ed3bc04f031ad41c31ee698fa9b3523cbe36007928d8c45c156d21d6c736e920
MD5 f0f0fe24dec8cf8dff5acd4b4d628d0a
SHA1 3cf5ed0a932027d63d395433396062187bb224bb
SHA512 2641c9aef0fa828ad49630c0f9a46d5ca953ecf09bbe87bccdd259196d1e0ab2e2a7f046431fe7f358ce848e7ebe99e674abb510f44b5b70df58b8c4ef6c6567
SSDEEP 12288:z+4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:z+4RZXBYa081a7qM4FfUrd
TLSH
T19C652308EB5E5DF6E426697209BC4D46C4670C05BA16D22F572BA7170CBACD0FCA983B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 485080088e13b0442820949c0d1d81fa429af436a0abeadac4ed7c62ee11223b
MD5 d87ff44f9732ac55109558f07368b2de
SHA1 e44be5f39754ac0e7667caa4f47ee6fe232931f1
SHA512 d04ab41f2effcaf51aa2d39988cda77f795ec2636a8235956923e987a97125973669762b0f38bc57d953cef738ca90449c5e1f627c151d36b2f6e2fb84f7659d
SSDEEP 12288:9H4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:9H4RZXBYa081a7qM4FfUrd
TLSH
T120652308EB5F5DF6E425697209BC4D86C4670C057A16D22F572BA7170CBACD0BCAE83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 9839e19d17c22502a1df57af3605aa921f021c13e85e0b88a2db7f7366b9462d
MD5 5c0e37e79a41ac9add6c25a9b784b198
SHA1 e5e009c34bb59924a58fa4ba993ecaa85ce99237
SHA512 7f4e59267b46b2039011daa534c1e165798c48fcffd57eb2c52ae1576ae7e967d573722699bc78f44c79025dfe5368fd8a1b2bb908fc848f02dfb7e6f32ee795
SSDEEP 12288:SV4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:SV4RZXBYa081a7qM4FfUrd
TLSH
T136652308EB5F5DF6E425697209BC4D86C4670C057A16D22F572BA7170CBACD0BCAE83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a0778143d27da9178f5f3f351d1d83e65e1b279d39b6e4a70e54595908ec06c9
MD5 a8a3121dad6256eec629675950e2f0cf
SHA1 c53a37f9a5852cc62c1f6080b8bb4200500abb59
SHA512 ae3f4826f00b48fce61d95f7dc93b6e10a1d92c3db65a1122ae6ea84e2c497abb9322cce9a3489465e83773b8626821b3b7a66e674b58c21dba00a079ea98b7d
SSDEEP 12288:IU4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:IU4RZXBYa081a7qM4FfUrd
TLSH
T106652308EF5F5DF6E425697209BC4D86C4670C057A16D22F472BA7170CBACD0BCAA87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 f2bd2b3320655d8415506a66242a02a93d41d03eaae62fea2347651c7d647731
MD5 357bff08f6990d08654aaa01d7065d34
SHA1 e61f03af3ab4a9e03819ab01bf2827bd6e1dbdb7
SHA512 adefba128c336b028a2731250a2a5f115a79793b28f14fbfe2d847ce9e57bb209593cb4f6d01b27dd782e24f043c951b196693c9ebfa2a437857b517c9559d75
SSDEEP 12288:Ut4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:Ut4RZXBYa081a7qM4FfUrd
TLSH
T157652308EF5F5DF6E42569B209BC4D46C4670C05BA16D22F572BA7170CBACD0BC9A83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 a32a781318cee7df4c4ad3527bb784cc431e43f78904c459b54cb0a7691809f4
MD5 b24f06fd9e427ca52b06d0ce4cf6aeae
SHA1 3b7c9deddc1d5c960720775f1b6605137974636d
SHA512 1f585b96156d59f98ab593bfbc5cb3ef9a601fd841eeda5c81af9132a5e879c9b08939f6d895e2174d0ecf0280a099a5e34ed52fa52dfb32b785a03b1a8b7c33
SSDEEP 24576:OfwvJk9RX6wkyAIP4RZXBYa081a7qM4FfUrd:rMnYI2NOaDa7b4FK
TLSH
T1DF95D029EBDC48E5E077913C89B7460AF6B278591B31C2CF025A536E0E37ED4AD39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 881b166306c64ae5f0d5fb706955c988502bce4f282fff2eae475ea5a56c0962
MD5 1a99ca736b458d88d4688a00d6e5dcda
SHA1 1bb790d1ac083e1b997291a7078a57f992919314
SHA512 90fde8125328f3e1e12b0549759d691637c736f45c292f11f7d64613bfe160a73e4a4a1a931f821b227ec0787fb768bd443d34922091f6ead6598028635632c8
SSDEEP 49152:wYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zNOaDa7b4FK:eySzPph+44
TLSH
T1D9066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 43eb7280e3027359ec88fd243d734e49b6922a114286b74e57ab59f5a79a761e
MD5 57e05f9f055e997c5f482db34e9e6031
SHA1 958b2367d4f25f12d5da5fc5430ba389fc8dbb38
SHA512 a8fdd613d385025b4075ea1f6e3badf18345accacc9f8fe9a530ea5d9cb0f8bdd793d5ebcd3d9f3e470fbfe686f2bb8e8a3fea309cb39dc40070539a63a75d3a
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYU4RZXBYa081a7qM4FfUrd:o47JUQj1irIhCnDHUPfF/jNOaDa7b4FK
TLSH
T1AF65AE1DA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 432141b235d82f453e1db5b37ce8d70997e39edc68628b12e473fd4ca030ce68
MD5 977385a120d736429b4a0832b0e92e35
SHA1 b0342b6153b017010d1c98c3e1f46d8b84dd60e2
SHA512 6ba8900eff0e47265d34dd0299432a29d2114fef8a3979f34a907a211d011c6661f5a96fd604a3faa3ae8a6a6a81cdbdbead9bb38ba51fd466b89c3e95e028d3
SSDEEP 12288:U+sfF4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:cF4RZXBYa081a7qM4FfUrd
TLSH
T12675F009D29812E8D06E6175CB654A41F3233C2597E1D3CB53D1F63E0F7A9D0ADEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 490d31094ce4904d6dce9bfce616fda86496b4cebf3a7b6e1ada9a4c80e44a29
MD5 9c3724d7e7d1c49f7ce6667586f5e74b
SHA1 25d320da3fa4289c4f0c26979dfa7c9d6d0affd2
SHA512 05b66c51b6ec5d928389ff1ddde6521b305172530500af1a0ca33c41c9b4cee3346efd1bb9b7c3fe78fc76dfc04c4b2eb68a1fca08155ee5fe518cfd1101e242
SSDEEP 12288:7ht0Yi4Q3KyQl1U/pZvyzcj3SeAWfGNpzauoJ8GS:73p2r6uPyzOFfG7euoJZS
TLSH
T1BE451710B666C64FC6AD80725E32D1CCA7707D51EE04AF1773C8873FC576A58BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8d825fda2dcb6cfa7d68a8407da1e84e9730f022627a7ba422b2083a3fee8f51
MD5 1d063ce2b01a74e509d274eb186a4a96
SHA1 b916ad9ffdd8ae2070af60c5d86f7e39e3f8ba2a
SHA512 b301ad4de86721790798f45a6d15015bbefe0ed0ec9337e57f9aee480ce1b8e80b3cc74cc8f127230e491dc3f2b78d03ad2279cdcaa2f789449650adea1fbd2c
SSDEEP 6144:AfKDe1HYNavvCOgglFgFzXK0i10mehtI1fdlmeilmIelmvQBpq9aNydnGCRfKDeQ:5AVg8Fa781xKQbOaNyVHCOMdx5bytkH
TLSH
T14255C9416137E28FD2F750B207265F8DA7A4EC06B6056F66B3CC453AD82AB05B4F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cbd5d1d18161238974758f38af951afaecad57f5fac7591524d7f3cf6eb75459
MD5 19ecc5a00ae5d5a37ddfbe335e7f948c
SHA1 b492e1d1113b9e7e0de1d778761ffd51fc9c355e
SHA512 32802bd83d0d20ffdb04d009c6e8aea1470c5bbecc5496eb2c40062913d857d0f0bf06a41c333d1bb153e2e89afbc0a8bdd41a3643f4306b7869e163a1123eb7
SSDEEP 12288:p47T4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:2T4RZXBYa081a7qM4FfUrd
TLSH
T112652304EB5E6DE6F436697108BD8916D02B1C046F15D1AF971AA71B0CBACC0FCB9D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c639d27671c44abc618c70026bc5198c3dcabf54a13df50b0da43b8f778c7f43
MD5 fd01a36ee4f708b3ec4980fb9898d0bb
SHA1 c3e42cb0922543e4df8c1c0c9c4bbc0f800c0870
SHA512 7a3800b7497b0720ed86c1ce6662c8b4419f23db88f47ee01ea790870a4181dbb8b9997f6e8ea3e903a1a3ec253a2aa30c9c9579d3dbbe9ddee4a03538675e45
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYF4RZXBYa081a7qM4FfUrd:Kgb4mBIBhGFpNOaDa7b4FK
TLSH
T16D659E1E22EC02F5E0F6D2B89DAA4417D6B378161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 1f119d00e7c164a9e3bee78aae3bc3f34c35848b44dc008324a11ead14a10df6
MD5 782b8cf11cbfa1f532e2685353cb75bd
SHA1 e7b13045de2a1c586f8c57676d5c7caca0a070b6
SHA512 712bcf58c53c45c6116bfcce61c151bebb3e25656eb85bee1535b1a38706e71e58a740137f2ffb5ed5f36d6bb4df5aa18bfe05afcbf542569c81d4173c736e31
SSDEEP 24576:DG88u8FpJqH1azria7/mE4RZXBYa081a7qM4FfUrd:y7ZFPqVla7/YNOaDa7b4FK
TLSH
T15F95F165B7E501F0D47BD13889964663F6B2B8151324EBDF07A88B560F33AE04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 1a6d28e2445fcb686039cdead29c061c0b32a6a92f5e2b3c27e2ce75d96c4177
MD5 b6f43684f68d95cd0773bf1f12e44282
SHA1 2703acc8213cd32736771274156843cf90fb6383
SHA512 613cd41dd5189e9d263fd39661e8d8f5192a3b5bf1512a8247cb83bdc6f387c373aceeab6e6b25fd83708ca090ea5fb8356fbd9dce32d5817a3cf0c6e56bb646
SSDEEP 12288:yHvUrBFrEjwaQQ4LNcYDYABenVKV08hol81iUw/70rM4vtbewRAzr0c:yPUr+NQQ4RZXBYa081a7qM4FfUrd
TLSH
T12975F11E62AD1CE5E676E17D89968609E77278521712D2CF03A1813F0E77DD8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7264b72e24fb16a33590ffb316cd1b9b6ec3927d4d6fcd6d1313b364d4b97fad
MD5 c3a8dd2e124a59bf9ef39323dc3e835b
SHA1 0bd1c2a44feee69e7bae00e15c06f053aca8461c
SHA512 bbdec35ad7077fdc9ba50f49c65ba6f1a573ab02126a7ab4b8aab5962e6c0c544aab8258d13a03dae2a94b3ddfc6231d998a5901230be3c833c26bc7bd1efb47
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdNOaDa7b4FK:cG05lO43bwh+44
TLSH
T15ED5CF6A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c01a0d83aac1d876893711af0fa2978797eae1e7fb080950f6320c5c90e23fe
MD5 e933599d844d60cbabc85b23ae3f7fe4
SHA1 69cd1be31511d237cb3405c5d78903522a4c8582
SHA512 bb4168dd8d79b9e9cfb9b0067886ffacf6f8dea708cc95849618ff76bc0a93925df64f426ac0ee998b3e943f240af0ad75412ea0eec3e0e4f732022f0e781051
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnC4RZXBYa081a7qM4FfUrd:Ea5POZ3+Jt2pasx2+mVNOaDa7b4FK
TLSH
T14B65AF5EA6FC01D5D579D17DC5838A1AE5B2342153329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fc9970af74de7c060586f5aea5efc019f3fd531c6d8b11fb1bd171d57c34b073
MD5 f7ee2fac224b74a6aa07a2ee68058310
SHA1 de7ce5d26a5f090d000d0e52b02dd37774f942da
SHA512 f24389bc36a81a49a035bfc65b296a0c70d195f4b3c401588ddd609890ac6c60d1507b7dd194d31a7a0e39271137f01e61a6907b85b959f9f6984c6a32febfb6
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkM4RZXBYa081a7qM4FfUrd:INc/zEOVHF4NOaDa7b4FK
TLSH
T196857B1623E901E4F5BBE1BE89779946FA717865133086CF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5f5642217e3d596d17b0ccb6380848e6ba9cf85ffb4b80df7c4a0ca71f885b89
MD5 7e70ab205355f1c38509e94d9e899821
SHA1 fd0b7eed32723a5d033f933ac7af887fa1a39d94
SHA512 731062fe2ff77f0bee4e3cb2ccbf37958e51331355fbce40a89f1cf19fb4ab90d15b6c9e0aa415ba9bf95417c21af62669c8ac1015a88f5a19afc715d504ef1a
SSDEEP 24576:G8kNvNnaFeYhJNtmZBmW4RZXBYa081a7qM4FfUrd:G8MwBtOmvNOaDa7b4FK
TLSH
T12A55AF2EBAB806E4D1FAC6B58D238512E6727851173293CF5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 07ada982b1e1a7daf1ce84f94f53bd6a8f65849b74fb634e480f0a7dbd664ed0
MD5 2f2ba8e8c45714f0f0ff5ec387008d27
SHA1 78c1891157785da0de45ee126561b4a2dd6f759b
SHA512 6a31280d6a42eb15b82d3bb7fe7b58e57bbb89de45baf4c1f9db739b055429f99c67327e70c7f77d81735a62984e9a9a3d0f9f3b284cf2f4287c64c4968f9a68
SSDEEP 24576:TD3FHshBIYQgAX4RZXBYa081a7qM4FfUrd:TDVHeBIAAuNOaDa7b4FK
TLSH
T1D285E13DE75D04E4E47BD1BC8A638906E67238A9032256DB029581BA1F7BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-86-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/628-85-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/628-122-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/628-283-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1360-393-0x00000209D3390000-0x00000209D361B000-memory.dmp

Download

memory/1600-8-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/1600-6-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/1600-0-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/1600-84-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/1600-2-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/1600-217-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/1776-44-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1776-50-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1776-54-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1776-56-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1776-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1952-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1952-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-137-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-382-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1952-145-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1960-149-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1960-349-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1960-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1960-158-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1960-156-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2188-68-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2188-58-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2188-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2188-212-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2548-194-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2548-197-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2548-190-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2548-379-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4172-80-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4172-239-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4172-72-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4172-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4296-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4296-155-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4296-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4296-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5488-174-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5488-175-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5488-183-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5488-185-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5488-181-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5532-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5532-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5532-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5532-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5532-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5608-164-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5608-162-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5608-170-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5608-375-0x0000000140000000-0x000000014020B000-memory.dmp

Download