2ecae80182844c65ee218650d3ae11255a3a994a94ce2f6d2cf44f3fc417ae8c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Size 3.7MB
Sample260712-rdccgsdt21
SHA256 2ecae80182844c65ee218650d3ae11255a3a994a94ce2f6d2cf44f3fc417ae8c
MD5 1fd33c277db89f5135f95f416e97e19c
SHA1 3aa1971219f8e2b8847e884e0f42452b4416240f
SHA512 58eaecc25b76e28623259fa514f54d3041296538369206fd857a9924b4d58b70655fb526c802c49527a451950425d5cc6fe9378d722ae1300d39b5cd9d23eb20
SSDEEP 49152:b91NzDBABblEUEP8h6+cu/NntP/o+UEsdeyBRS3mmG+8K4u:b91VeEP8vcuFto+7GXK4u
TLSH
T1EF06BF11B79584B1F99202B495799B7A493BBC314B3CC8C3D3D02EAD98316C17B3A76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1028	elevation_service.exe
5272	elevation_service.exe
5460	maintenanceservice.exe
3756	OSE.EXE
1108	PerceptionSimulationService.exe
1988	perfhost.exe
4400	ReFsDedupSvc.exe
368	SensorDataService.exe
4812	ssh-agent.exe
5984	AgentService.exe
2512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7c7aab9e8f8562d1.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b1cfe610712dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027c48a9f0712dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dad2d89f0712dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c45f8610712dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a5c25650712dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1240	2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5984	AgentService.exe
Token: 33	2512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2512	SearchIndexer.exe
Token: SeDebugPrivilege	1028	elevation_service.exe
Token: SeDebugPrivilege	5272	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 5716	2512	SearchIndexer.exe	98
PID 2512 wrote to memory of 4156	2512	SearchIndexer.exe	99
PID 2512 wrote to memory of 3412	2512	SearchIndexer.exe	100
PID 2512 wrote to memory of 4084	2512	SearchIndexer.exe	101
PID 2512 wrote to memory of 2000	2512	SearchIndexer.exe	105
PID 2512 wrote to memory of 4360	2512	SearchIndexer.exe	106
PID 2512 wrote to memory of 4668	2512	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_1fd33c277db89f5135f95f416e97e19c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5460

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3756

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:368

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7098bb8539b39f9a93eb29c08ec84bc864aed76a70820efa0cfc3ad8700386a2
MD5 20326a735e6b4181d5d611370fc5877d
SHA1 03f1c8a0072e86e5a40b97b7bc6294604b2b235b
SHA512 7aad7d22b350ba35cf1d7c603c59c630fd08f23a4e26a5fcc9d295f59571241b2541356296b835f00c56f90dc19885427dcfcc6676887befdf8533a4533047cd
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnw3mmG+8K4u:t3q6mjBxGXK4u
TLSH
T113D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a0b1c56c84072dade784d0a52b637926df305c32c03bb0b4ea23e298a7efdc55
MD5 dc0cd36a1d9c6327b126e98e8aa23d7e
SHA1 486d2a01def0e9d4822093711b88d2dda05c7862
SHA512 2ef1fc0f0699899ef1f23138c73982a5a2ed0911ed007468157a1b1527c2e834eb7bbb668aeec7b38cfaab0fee8e38a4525cd5d9992271786180540fc81be853
SSDEEP 24576:sXYfDtczABd1mm6C+Ln0Ja6I5YT4FawgI4M:Ltc23mmG+8K4u
TLSH
T10985012867E409F9ED67827DC8A18512EA73B8918760E7DB03F495260F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 3d2051a5fa73efe234c81652e8d010a89e0d79c63668ffeef838a65fbe3e3ebe
MD5 2fce1558debb187b5779a90602076b58
SHA1 54039d37b432e6d2fcb110309bda6da8e9a6bc18
SHA512 0a8cafea8d421d6d74b01f611a91bc41018ad32dc7cc3dad97d36b11459defa41181ced0ab2f1add6b7af745a9f5cb8a8019dfbbf1cb6e184222261915222c56
SSDEEP 24576:c0Le5ji0hmxUrMYd1mm6C+Ln0Ja6I5YT4FawgI4M:cPji0A2j3mmG+8K4u
TLSH
T192A59E25F6748335D073C0B9C5D2A69EE97130825B308ACB4296D77C2F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8ee351aa799227a0a1ab79bfab8f61b95193a7137d41a318064465c5491870ce
MD5 f26395c16ff3bd13574a26906272924d
SHA1 4173dd76c2bb84b70bbf3479ad98223a43683724
SHA512 d151ec613625f74c11cfff135af04f6879a5a12b853f77c4d04139af292765475bf321e8be4a544b4cc84b9260ac422b66ee62bf904d73f13b7de2073d23d06c
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWj6q8wyumd1mm6C+Ln0Ja6I5YT4FawgI4M:e/ezSC6vUzPv+Hjy33mmG+8K4u
TLSH
T14A756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6e31f683a1bae97993e4759a8edd616f27cc6d5c555b17dd9ff9abe7663c912d
MD5 61efce458345afe51954c2df630fb2ba
SHA1 4583cabd998fa1838e8e4a2f5c60e20eb848444a
SHA512 fdc833b4e2e1af918f95b2ddfcb3e110bf3e47451829527982846b9656672e4b3b3d6ec1c37de68e34b4c09e6428e5ea6d291de243c19ef2afe63fd2cf6c9d76
SSDEEP 24576:cVbqPb88hv/l+BNd1mm6C+Ln0Ja6I5YT4FawgI4M:cVO88hXl+D3mmG+8K4u
TLSH
T1D6559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 1442de82e1403cf79fa00b9afad63b1617cc1ecd1a2bfabfca554875fd02c5db
MD5 f870b60e1c613c1f06a12554eed083e5
SHA1 f2bd261c76698447a88b6696f0223a241ef5c3db
SHA512 86b0a0d0cd25471dc80b4d9befa23682e532f161a4d7d17026df72aace24befc60228afcf750e19f33e195a625965eeafbebcece0b7bf10c5a419e961ac8d0cc
SSDEEP 12288:EkB2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:Ekkd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1676523E40B2906A9F77F16B205B8739BF9D4CC90E582A77393B0321B0674717EEA5136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 3993de3d14594703154cb9144e4699ad9dd24779057098eb00edd49eaab1122a
MD5 17148b61fc0191728f49a05887ba7488
SHA1 82e54e125cb88e18c8c5530a046ee5b79bbd44ef
SHA512 beced449a2817bb6e25f4081571a7c41c95a6d90497e0436740b0e469821308e152c40d6ec3c4ba3de5408b6b0167f5ffa65ae0d58efb77f2bba76a2f5123a71
SSDEEP 12288:ieBNUbTVO86UQ2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:iJIU1d1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T15985CF7BAE28FCE2C27E4DB956918300E77278708B52A3CBD175830E9E235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bd5527444144b73b210fcec398dcc69c6855c428cbb7abcc4fe4b82f753c6b42
MD5 24720c20a95b3ddc80d03b0f720c672c
SHA1 835371543468fe0cf1069e22599b7069a669d7f4
SHA512 452b273c87c53f3c8fc4bd95934125eddcf27413728ef7321497ae180e483b53b2d30d0cdda8fedd891d24e1d48804caebb47c9457ba3096a4a072a7c422105d
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:1QvGAdlCEL8c/WRNw5CGGXK4u
TLSH
T12B267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 922417fca678d3f9537caf2e66fb72dbe7ab6265a970d5cec9a9edf8ad1e233a
MD5 2f90c5fc0527b71bbef82a8f86911e81
SHA1 d25071129522317c6f9099a210cab39bd1f50d17
SHA512 27dc0d6fe43c7a3290dcbb01e470499d6199c4858483e478fdd77883f53013baaf5661f0128cabc055c8fcd279faeadd95a69f75edaf96069cd5d97403727d0b
SSDEEP 24576:NAewsAjTd1mm6C+Ln0Ja6I5YT4FawgI4M:GljT3mmG+8K4u
TLSH
T12095E030FE74D036C37F0DB21B35D716686CA9608B521AC3E3F85A9E59702D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 211b3b12745911d692ca8b5d5bdc4244be0b96d171969b45fe998eb2d6df92de
MD5 387cfd95bdf62c0141a9d8fd42f93888
SHA1 fb5b3c9da985b7f8953980fd7e13b952c6706571
SHA512 8a7d5e7a2d612543094b5a013504a1d6caec1fbdbef7250e1ba11ab0c07bd849325a1e777d6fb13dc7a808a1a0930bd7b76fcc8f3a6338823006da88a0c9cfaa
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGKB:mUEtQevvqc2W1cpV20I32jB
TLSH
T15F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4d9d5c2655d85f4aea7d35f0a133befc23a91e5681711a1738ec9ba73cb1a576
MD5 706ed62559a348679e75386d1bfeceea
SHA1 ad61b828e7bd019010f9472f3fc9da0cce347c8a
SHA512 a6b7c39232f34b27269464957bfb78b2db7859f771c0d979dbe42403e3acf25b3ac7a2404c0bb3ecaef4730e8ee94e370e3e8c296898a5eeac06cb9bb28dacd6
SSDEEP 49152:TCbRquA/m2yL5zifFiV+XenmE3/zz3mmG+8K4u:soqHVjnmqGXK4u
TLSH
T105D58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d9263c1bd268f3c9163a96f312089db2e4d4835e42608834d7ac8831c23bdb81
MD5 3f4d573f648cf3a99ef5806f3491badc
SHA1 9994ef47231380682286be64030f6e9120664381
SHA512 4a8e1a5d4fb6cd9a5a77f276fbab4e5682cf4d7cd6ffab7ec97b86263b9de79c2513b23e1405291d88d73ede2410da669cf1a298c95c4b6e0fc1c15277bb1164
SSDEEP 24576:aAhGL6IFoiwtA5l7S53Kd1mm6C+Ln0Ja6I5YT4FawgI4M:aAM5Foiq5a3mmG+8K4u
TLSH
T1C135AE80EBF945D4F5B3AAB899B69171EA76BCA55E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 dfd7706fbf2f4dbd5ee68825b82a429dc6f10286563c5e0d68871fc119ef7216
MD5 60f58cb604a5d4bea5e034d369e6966b
SHA1 dbac1fd33fd0266735001023883fb74e61e51b5f
SHA512 5e2b5be52882cdbf901651af4db98e8cea53d31295dad063b3367097da8b24be168e582c6fb39b838561ad6c287db3cc041e35f17232aba338fa3a68aff83f6c
SSDEEP 24576:Iwu/OWXd1mm6C+Ln0Ja6I5YT4FawgI4M:Iw0OO3mmG+8K4u
TLSH
T1E085F14937A90CF9E967523985979236F7F2BC112A21DB2F1770C21B5F37321AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 30bf9f8b1e967497157254f8141fa2eef8c20dddcf75446c917c22101793dff7
MD5 7491390c743551dea43cfa3144b61800
SHA1 bc9c95c34d4cc7d93df232e975afa786683ddaaf
SHA512 bf8282521f651ca51fed2aa785d2186ef65b42ebdb22804609a3e512b120e073ae5f757eb59ffefd4493adeefee83050c4f63975ccdbd6d9de85e038234d694d
SSDEEP 12288:HYZ1Iyi2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:4Zugd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T12675139923F421F9E2A7527989F45746E7B1B8A1A77253CF1370121A1F31BC26E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 87bcdced742ec37e2f1f60a9f2f7ca7df681b5a3bd4ce06d0da266dbac8ff830
MD5 d5966c636f9fc649c7d087a66e94ac9f
SHA1 3aed4ae3cda308e9b16696a90413d32eb22e8016
SHA512 5d8723e40737fcf85ce0042b7f52de0e42ca561cfe078a6a07e83af6c9dab52af8c207dea6cc74129f5e3f8576d682cccfa2f575b6179d2f8893884fe58e4d0f
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:gQRQyi36YOcPDLvw2gAf+PN3tGXK4u
TLSH
T11F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d5dd6d6ab21f3b8b7f3fcbf25c74a324379acde913465f2d585fb3bc35d58a01
MD5 b19c8bde18d5cffb82d0d755a9f7484e
SHA1 9a716f2f3d60ec328741d4bc82e8b4cb1bfc42ba
SHA512 4692e0daacb820157e9b53758c10126215136cf97b8223bfa0b8404ef5515af79659937375db5d2d27e4aa60354684b80ffe2c7bd0671838dfa61480b2f76f92
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:6QRQyi36YOcPDLvw2gAf+PN3tGXK4u
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4d6fd3fb3155bc8d9f20207d47d2cbf2e92993a4b62217b1b9d097bd108776cf
MD5 81c48154594d9adad52a6a4006d1e9f0
SHA1 b6401ce12042563a7b594e8c3c9f926d0aaeb01e
SHA512 559e7f919850ed6a6995580411eb0d7b1d2e435d8aede02aae449a9cf1dd55a1f2004b8f74f59132743c2a202582c8c4ae3531ce114a3febe32e58fc56baa192
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0wd1mm6C+Ln0Ja6U:E68Qg55nhkeWu7PNU3/j3mmG+8K4u
TLSH
T119B54933B2F600A9C44DE1769F4A972196D17C71CFE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f3e5d128e0d53b3f27fa9a32d5f6e222cbccb32c597bbc62e57a0b8ba95add62
MD5 5683dcf94d58004931324e3b3d3f3bdf
SHA1 dcae30ee30c99dffab8ca7833b8428b9368609af
SHA512 8e8ac4fa4b1346ec0006eab8e3306ea168e5b6746de3dbc5752b8e3f0d835b4681cd557c867337f438da6bedeb19e53a7e28dfe598142b1f2d82317c5e58e0f1
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99F:gy5112gYy5azzVvU69nLKnhZoGXK4u
TLSH
T190167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 364a986bb2017acfd1b947ec44e806271c8490a26b9fa2abbc295b39e463ef0a
MD5 a94526a7637a22613e961ca8ce309eaa
SHA1 152150966edba739817d404e57c5e717cf64981b
SHA512 5920558add031d9f056ac64f9055dc2af0d041fbea18272c10ff8fd26c05e9de66c9cf2b641c5bbe9cfc064e8461385a5e847bae09815793fd6a745487c1a32b
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glR3mmG+8K4u:Vu6JmIxd2dVGXK4u
TLSH
T1E0D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7292468af37fe179519110fc3ac9bcf942b29b29c9c8a3ecd3f36d9f8c793af6
MD5 e7fdec0b0909a88300a54469a0e12f56
SHA1 f9413540b51d67d289359fb325f20ed51b38e2d4
SHA512 c098e6d8bb2d7a22007c4ed48008aefa8b8bafa505907d4119ac006616715c7c242c60f946f7cb5ccd1bb984db793c777dacd9f0281790e1b23a8de86a739584
SSDEEP 49152:c1hpsNoJpF1A67U44CwH7R4xV3mmG+8K4u:cmifPqRqGXK4u
TLSH
T107B5BE13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0f39b55f7e91acf8977c1ff8055da7b0a5d7365698759dfb79eccdcecba86bb7
MD5 fa5025c2a09958262ccf00efd98fa6a1
SHA1 a396e24c207eedbc3993d610afb1293767a7027b
SHA512 ae6c7940c2ce0d02a9145911e7c9382644ef7410107c5b85b2d5d8cbb60e821027fe7424cfd46d635b9714d9fd8f982fd1ca7fb5fcf4792c85a34d9137ae7c7f
SSDEEP 49152:ZSuZQIY0Be2KkRVtOnks6NMHqg3mmG+8K4u:35dKqi61kGXK4u
TLSH
T11BC5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1610a1e93732bd216d98baed1e28ec69f02ff2bb7a0581f869ff569fae89acca
MD5 7ae7c57663cdf097768769afa4a6824d
SHA1 dc68b6bf114853ad24b401628db9c5062e88ad75
SHA512 7b472a33e9aad9333386cc523d3f79e2bf21a05b3655e4f9c930d4c48472f0663b72cb5723921e4d95ac76a54156266514e6782aeb90715c749ff7512e497a61
SSDEEP 49152:WhtSn8EApI0figjgiDn0AP5wB3mmG+8K4u:3X2iWph+GXK4u
TLSH
T1F895BE13F2D901E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 50420355dffcbf3e8a25b240fa311854a63ab582cba4c7a862c6bb6ded9eee6f
MD5 2d8a3f5dcb4f036cc01695c650af8453
SHA1 1a3d018266c2a14d08c1374d525a1a18805a3c93
SHA512 35da447a1554dd253d80bf3ec379eb24b978bf6afdffe8e8411fb4ad81899536f380a85a706521d12f120f4ebbcc040a6618e65d671d3300478a624ae8d33fe0
SSDEEP 12288:cJ2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:csd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T19B6523E41A7A07AAE22B12F205A4339BF9D88CD0F68363B3A3B5310717747576EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 110cbead83452171f01741caa9669a14a52199c6a05df0080742c73c16ffa8c4
MD5 09477a1b05cdbb380fc2fabb63fe26d5
SHA1 220c716ae6a717628364c7eb7727b1b9153a0da4
SHA512 660047c87a7a564c1c3e5845134c08ff7a9adb62202d5d8c41a63a76455fa68e73aab253c58ac910ddbbcc96e81bf9c4b1e35438783e5f9e83107d790d3a90ea
SSDEEP 12288:c22kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:cvd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T16C6523E41A7A07BAE22B12F20564339AF9D48DD0FA8363B3A3B431071774B577EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 8e26e2c13b8976758d3371bc9fa1da6c79e72114bf0b5da1fb94e07a3a6d79bb
MD5 a7cf8c23451f55b413c8a747f6bcc245
SHA1 3693e8c554ad2d85ca1eed129755bf1a4778bfb3
SHA512 5e85a2f197b1c1eb9124f3ac2af8aa4260780792d8f6885ca2895fc7ce808105fc3f5495950fb2593cb836ca77695d592f1315938bb920229e538b2b2b69be51
SSDEEP 12288:042kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:0dd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T15D6523E41A7A07AAE22B12F20564339BF9D48CD0FA8363B3A7B531071774B176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 aad22ca79c33192309d4095f0596d27d32ca9005cb28c21734de5e1c3d66ebcb
MD5 36e54ffe3f58be72b1301e0b51cd6135
SHA1 f3ea8e0953a9d469866027dfc272e20351f97182
SHA512 f1f02ffac812813d919291d6cd5064da7264e3e1ae505dc8adaaf4d9f48418c6454d93ba469911e246e14b36840c9249ef1d919f11f0efc74b8791000c66f71d
SSDEEP 12288:uVj2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:Td1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T12B7523A41B7A02EAE57B92B54574635AF6F4BCD0F712A3EB9770210B0B707526E70A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 2719f216b04785ddb442db82d9fa42ceb6f4deb6ba1753bc4eaf5d58798efd34
MD5 9eb0f920cdb5905ce4b2dc1dc03c5de9
SHA1 2bafe1d5db4ec1bb3bb617c490cca167a38dc1d5
SHA512 70c45fd254762321fe4ac650610de61adc4271f54be54e36c7a45102a214e3a394239f7333838f0b424307ab297b74d14f9ebe012e6290ca25e795a917576452
SSDEEP 12288:Ub2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:Uid1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T10F6523E41A7A07AAE22B12F20564339AF9D48CD1FA8363B3A3B5310717747176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 af65789d23f07b9964aa4ab309a86e6e3e0f70ba6c3c82d89e4b18099d4efe11
MD5 c4bebf35ac792aa03467533c0f7574e5
SHA1 e8c8650cb9adc6dcab9d43a26be7a605db8bb780
SHA512 bdb6010e36703cb1b2de8b0cd24cced2e297d21d9c533ac280b26ede57fa060695909ba1c553ff48537106c35aeedbe3ca06c5342c0ae7a5868ff12d9d44cdb2
SSDEEP 12288:q62kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:q7d1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1226523E81A7A07AAE22F12F20564339AF9D48DD0FA8363B3A3B5310713747176EA5535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 b1e36eb42ecdda4dada52a2f2bdeff6110e1fd18c2dd177d46b18b97cdf1efb3
MD5 77f33c681b9d00caeabca019d89e8ad5
SHA1 a341421c5c1d4d772a989b04df5402a1cb971e30
SHA512 a978257558e2461c9baaf2bd6657d51c1555d11289d326e5ee03b3c40cd2fd0c9876ffbea6143dd9218d5cb50349812655a5488130af775bcb0e49a8e4b40923
SSDEEP 12288:/u2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:/nd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T18B6523E81A7A07AAE22F12F20564339AF9D48DD0F98363B3A7B4310713B47177EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ca8406115d3a3df808e1df25b585213882026c033b63700081e2dc9967aec8c2
MD5 78613295bdcde3879e37a2b14137ca00
SHA1 31e8cadf465ce04a5e92599b4d2951d9293b9c9d
SHA512 57f9733604383022bd33cbe5ef3f66dbc76a72a48b7eec9c44e9511de4e5c02ba63b088d78d060e0c3e0ae59ec523a9b4a8cf9e04a623e232cbdfc0aa8e71f10
SSDEEP 24576:7ZM0zFVSOPd1mm6C+Ln0Ja6I5YT4FawgI4M:7ZM0zfr3mmG+8K4u
TLSH
T1878501A4736008F8EC67827EC9659A06E6B2BC555B60C65F13F4322B1F333A11D3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 e2f646ec5f994a034e1a4c15a589e31f4cb34414906ba4efe1757577b4a990b1
MD5 4b077a33547a43ad79168ab5bbcdc3fa
SHA1 546232baa3e9651add1f22d4724738cb2153b5aa
SHA512 6738668526d834f42a6c61d50bd5b88d22ec5e1e02e59ae15e25f254aff00c74661e4b6013575aedc47bc5d5a8fd0eac344c798fc144e21bf8319782f40247d0
SSDEEP 12288:i12kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:iQd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1436523E81B7A07AAE22B12F20564339AF9D88CD0F68363B3A7B5310717747176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 a3793903ed57f8cdcf916fc27a5f0f8aac91d6c400a3e7061fd80924f34a5804
MD5 cc97303502906494ac279060fcaf564d
SHA1 7580c5dc2e626a9861fd0761535efc12408b47d3
SHA512 1433cf0b944522df31c144ff9ab3319cc9a0375e3addc939fcfe7288b75917f790c064b41c93f7101513014be33c2972800eac4a7a9f40e29003627f2e2f7323
SSDEEP 12288:3x2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:3Ud1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1446523E81A7A07AAE22B12F20564339AF9D8CDD0F68363B3A7B5310713747173EA5535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 05275928e2d4d5259475ae796f4db10c29706e87a7208945f65b9244714e7232
MD5 dca6456214de2e801b7e45fe6311b319
SHA1 4233a96403780579b311d68a7fc687d4d9a33f22
SHA512 37b8cc06f95e9cee40357ae48027804b065e02c339516e6ae8938b0d76f34014dfe0bf81e355b46d91481313b4052c8dae73ef2b12f62d21e77a3322383b63ab
SSDEEP 12288:wyPz5L8i2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:BzyDd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T17575025737A521F9D13B927988A11A06F7B1B87197119BAF53B003371F32791AE3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 9d6fea65e739abdb08a32d153f5fbf04e9147ff580c25d4f736994a581670317
MD5 984218e63026c939cbd358f4cdc439d3
SHA1 9a8b791a130602c8958b5c61b737a72725a04f61
SHA512 b2f431ad4b9918ab34dca03e46b88bc28febf631a234cc5aff03b010151f771f0971c75e0e8420d9ad89f449e84421df61a202780f4e0053d77273d60554cd38
SSDEEP 12288:k12kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:kQd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1FE6523E81A7A07AEE22B12F20564339AF9D8CCD0F68363B3A7B5310717747176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 457c6b083fcfe19e6f4ac3d0de5abd333429d1a48cb516592e9327180ef7795b
MD5 4e99870c6fd3c3c367b9dfd7a6637168
SHA1 dd536352071ce664651ca27366bd0561c1cd24c3
SHA512 80b4660a6fa050b8fafc9a9e73c177f38c73832e6d70b38c4e640cc5d858ebf5c5e25b6da0599673ce05747942cffcb84a33a1f61545b4fddf383ba433c3f516
SSDEEP 12288:T12kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:TQd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1A96523E81A7A07BAE22B12F20564339AF9D88CD0F68363B3A7B5310717747176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 773497923cfaf8b0cfa723d007f83a87ac985b102e34d024985ac561dd3138ea
MD5 41f2ebeef39b2e528835914fb36c3a75
SHA1 a9a7df17867cd7515cbfe717f68f94a4a6054e42
SHA512 50a41e3f197b63f64f301cef5e030f70f38b8429fcce2bac372c3347dd30b39d3faf805c8cd59f9015aedee01e84e02ac0598cd3d7bd3460e7938b854065899b
SSDEEP 12288:nyPz5L8i2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:KzyDd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1DD75025737A521F9D13B927988A11A06F7B1B87197119BAF53B003371F32791AE3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 a1895fa370aa1b616a0b6f875408d1747e2d2c9d9aa1d3640bb15bd41d3db37a
MD5 dd845682c5f5c5d331266d3084f83932
SHA1 c69e964fc42085573e29de72899eefc1debaeb2c
SHA512 ecdedd2e4146f4a48c2faf6b6b930a15d97564ddb78d884042ea6bc93e44990e8ae9f55c2af26ceacb6d3507cd01a723bce2bc12aa971b913f7ad76427ed2465
SSDEEP 24576:cTBaLl3z0zDtd1mm6C+Ln0Ja6I5YT4FawgI4M:cTcLljm3mmG+8K4u
TLSH
T15885F1A4B36008F8EC67827EC9655A16D6B2BC564760C65F13F4322B1F333A11D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 6800f03bc953e1275f596adb367b4f2726ed2bab516c8bb5d81d10b85ed4da3e
MD5 89b10fa1e220c8d403b9efc4f20dca7d
SHA1 d119a506473dfa378c03c791fe99786b6cb89df9
SHA512 44f43e6d60963d7c1cafdf546d5a8410e3db92d7f1a438581becfabf2e628927da7b741574c6e0ee96255eeb4d9423d76eff3f390bb709f07c5dfcbc3b174332
SSDEEP 24576:e3Bd9CHKy7GZJd1mm6C+Ln0Ja6I5YT4FawgI4M:gBd9CHKyar3mmG+8K4u
TLSH
T16695CF90F3E410E8F0B79A3589765512DAB67C995B21DE8F03A4261A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 22e967c69918d4035e42d87b06d3ff748ce5dd19b1accfb8474b95fcf34daa13
MD5 98dbd630acad49499c1831dc9d47594a
SHA1 7b2fd323c359aa475ea3a6046d48d387669c3e91
SHA512 496fed77338624f3d273075c9e342626594459dad81d5348752bbe14bf9a99f39272b5dd59a8213417ac9786f6d790b4fb69ab72194b6442ba158098974338e5
SSDEEP 12288:/Y2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:/9d1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1EA6523E41A7A07AAE22B12F20564339BF9D48CD1FA8363B3A3B5310717747177EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 16304d416e5a51f133421d1ebfd707961edbe2f88daa9a13d5e52e4984e0932c
MD5 db5b306d5b72fde8576d64e524deaa9e
SHA1 147ae3aa12c41d026dac37dd9ec9716b6011aa01
SHA512 36466c1a9207b965b80ffa983f97955379d6906c9f49bf6c32994975a3487498582838081ecb89ccec7dee41a3d9898fd0fe82b32be8193c8447f0d6bcd73383
SSDEEP 12288:5C2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:5jd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T18F6523E41B7A07BEE22F12F205A8239AF9D49D90F58363B3A3B5310707747176EA5135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 c19dd3f075faed37c6e1fbde2441a9699b26a32620826a40d14d3a212d4195c4
MD5 f58f087264fded9b890a1aef26feb1d6
SHA1 e06ce0631eeffa2b2f10f0f9c94f7a18219dda5d
SHA512 3d42228c0d483a468a171464a9bfa22abe14a318ace7613d2b7fbef578ec612e189f95b1e998309562212be8a80ec8f87a8b1dd38062ce904858a67f2d0dec5e
SSDEEP 12288:/v2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:/ed1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1636523E81A7A07BAE22B12F20164339AF9D49CD0F68363B3A7B531071774B177EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 77316ea81af5a85eb37fcd3d068d4b8c8fb3006c48f361794eb7e06109c56388
MD5 0ea793e3a830994d89e90e209018d858
SHA1 93e0ea9c18d0ed572d9866702f2c87940efc3ef1
SHA512 9ee77535f73ba9892323870150a7e1252d30c8e466ef32260e3c76d253a238c3eeb0a8e459ee51997991d4c92a03d678db9736aadd35d5995d1e1602cb6262e7
SSDEEP 12288:t12kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:tQd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1D16523E81A7A07BEE22B12F20164339AF9D88CD0F68363B3A7B5310717747176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 3738643b8ccac79f86ea5ffe222e5eb4de1338439fc2285cb19c5c73bf34cf10
MD5 47f76156695a5bd1a39b430331fdde54
SHA1 535d645155b83b9e8ce00301bed358ba671b5da5
SHA512 8c8350919913b2a80ad5494fd43abc513464b45376724483f37d866716bc1bd18202afc31b3ad103f108ceed003c77e45bfc3ee82efcc2aa3e649a05fd0adf48
SSDEEP 12288:SY2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:S9d1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T15A6523E41A3A07AAE22B12F20568339BF9D48CD1FA8363B3A7B5310717747177EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 33b462631d106f29ccc420a49d89c4152b882ac2ec52d628dc21d7ee2d5bc1eb
MD5 bd96c2a6fd11c9cc50bda56a9e153610
SHA1 ed8856e9ed98c56fa59d5b9e0f93524ad7eff961
SHA512 bc9847dee4c5b14582a0e0ddb0cbf89812dd423714d5af434590b229405ecdf79e978d5a5eab6cf8e148361a9341dbc7241382d2c1c49e85807770625ea7d783
SSDEEP 12288:ZN2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:Zod1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1466523E81A3A07AEE22B12F205A4339BF9D88DD0F58363B3A7B5310707747176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 87d681e768557743ec09f0c99405d8956d8f3c2f32d04831c632f0796a87434d
MD5 05dd235d76f675655e18f153cbdbb0d0
SHA1 d485e8b0d76cfbc6815b40000482e2dfde41a018
SHA512 6ca750c3e55fecb70a3d699dca95b49e9349a997b98382619f92cf9639fe730397488740d71a77996c23f37387a0d90fa14214fc4b9108cad70d31fe77c6ea64
SSDEEP 12288:gb2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:gid1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1596523E41A7A07AAE22B12F20564339BF9D48CD1FA8363B3A3B5310717747177EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 ea3d7ed3e6ede308472848b3b845ca4f7b442f9a08e12a932cf43b1f3e928ad8
MD5 9af0b58fcac31355d7afb01d3ed95484
SHA1 30c8e64e320d5a0d5c2d74d82020005b86fda40b
SHA512 ee912b087f1a715d8655af1eee0aebab6b0eb7cab6e439df600167d8fe837e9ee849c36468e1b97e7f90c36250316bcb56caac91fa084b10f443a03ca22d0eab
SSDEEP 12288:tA2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:tld1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1246523E81A7A07AEE22B12F205A4239BF9D88DD0F58363B3A7B5310707747176EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 a144a52a8e6d68d6a3416b09d8083e64ea5dc1a6d3e478ef01c6ba0ed963f539
MD5 ca8911bc32aad453abb334d34caf902e
SHA1 9b36146b5ebaedfaee05b12a294999a4a3d0c540
SHA512 72e79ba14c2b33eefa4422fe27950c34a59461d9140d6fbf2c31eed83cded02452a7c7aaf8b27ddf577223004f0a1b5427fd95584f81925682bfb3d8d2c503d4
SSDEEP 12288:Jb2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:Jid1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1E96523E41A7A07AAE22B12F20564339BF9D88CD1FA8363B3A3B5310717747177EA5534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 5b1c71b050f4b8d1a4ef5ef0f6cbc91ae21eef83d1b706d1b34515663f8132eb
MD5 09eaaa944f2fc5743e681d21d0572b1a
SHA1 bd572a49b3759f5b97bf3d311cbdd1c156d3d99a
SHA512 07941ce1b3add0363d7681a90f2b939b13871c399229b10d0dfeed0acd0bcde285c9ae8fc9ed0c8fce574ebfe064029740f17c53d9786cd2b5efd0edeaa3c733
SSDEEP 24576:afwvak9RX6wkyAIEd1mm6C+Ln0Ja6I5YT4FawgI4M:kMnYIE3mmG+8K4u
TLSH
T19F95D029EBDC04E5E177923C89B7460AF6B178695B31C2CF02AA536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 91ca47f492367659faf6e4370d1fd248b34a027b5f9d2e6c6c261c98b0f50e3b
MD5 fb4e97801060b61786c52b6f25a14ce2
SHA1 ce07b6aaea4af81028969e78e01b7821be4e35c5
SHA512 7ddb1e90ba8872e56a7a84f11f555a7bfaa517d3c9201e9332a63924a0544b3ef875f5e8409ad6274b03939acf903889e8af503055f7c6bcf291eeb926c3f1dd
SSDEEP 49152:OYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0h3mmG+8K4u:xySzPNGXK4u
TLSH
T138066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2d037b2dd6052196e793aaf8acfca8958a989a83e883702d2c708af458298f29
MD5 c9b0be2072b39deca6cbedec765203ac
SHA1 9c89d38fa394fb4db41cbb932401573a8aac575b
SHA512 53c134ce5b8dd133c22458ff8e3f78f4b4273e37653f7fc1ec29d018a442aedda59c3731fee87786cff1b8ad2df5c8a232881d53c9bee8228421b28dfbee4c9f
SSDEEP 24576:547Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY/d1mm6C+Ln0Ja6I5YT4FawgI4M:547JUQjqirIhCnDHUPfF/R3mmG+8K4u
TLSH
T1D065BE1DA3EC02E5E1BA927885154A1AEA71782D5F32CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5c03d97f006b8ad3a5422c92d9af7c6126bc989febc583b1b3878c1c3ae1ce4e
MD5 ef285a17b0b92c806d9272054a322a75
SHA1 34ba78c5dabf0a8b99411aed9449ae16bff175f3
SHA512 8a942beb757dd187918a0f8eada1471c323e470e5d19738e3455866884659c6b8ba15dc178faa6970c6e738f0254fb6d5cacaaa3d3aaa10ebaa877c0d95d51cc
SSDEEP 12288:vTsfF2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:6gd1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1D975F059D2A802E8C06E6276C7555641F3637C6093E2E3CB53E0F13E0F75691AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1008KB
SHA256 9952e5b7637c503388346ec963497cfaf1ebcae8f1bacef297925971a70a7647
MD5 648a273e11e2a763404983777b20f85d
SHA1 2480db0248b75d41291499dd9c02f2802a0bac29
SHA512 14a94a51f6ad3c2bce1c3371092c6dc86d414ded3bb841a607e389c03d08fc0827f7b0e95bb3775b2a6f309b9c6892583bb6b93648fe9895fa2a7cef5a9c9a8d
SSDEEP 12288:l5ft0XU3f8zDw+TeFlJpGLcbM9Mbk9CHtVCQ:l5ftuUPkiFlJpGLc49MbmCHtD
TLSH
T1062528017666C74FC6A950325E33C2CCABB07D01EE456B0773C8972FD576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1a19cb955193e9bddcefc89ea009cab8c9db2b3aaa55ff2d7a82dca3abbf6272
MD5 2bd9daad1b4ea66619507e3f3c5c4c06
SHA1 9556e2f0448ae0ecf8e5f3e8e84320b544b54a10
SHA512 5fed99063297fcc0632bef96c64c8a841e973e8a54c322454a83fc4fb04cae3fb85c12d74143329609dfe4baee6f69ab24d5f02f641f95d697024becbe0a5f62
SSDEEP 6144:roY+RPTgXvZTon53s7AISsIOMki+WX5SqtMxt6iYxX5sKsA/QjqiWgb+RW3RJwSG:6RY8n5L9ki+XTsfPhz2Gn
TLSH
T1D855D7409537A38FD1FB6072472A9B4CBB64EC0377456F26B388453AD82AA15A0FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acc.dat

Path C:\Users\Admin\AppData\LocalLow\SogouPY.users\acc.dat
Size 80B
SHA256 98cc43a0067df0de08d0025d5f013ead1272107edbc3a694acaeeadd0c398217
MD5 49dccee8ae2c5ee946facde637a6f415
SHA1 3e520a89923ebb4eb618d8d852ab55d952f2f4a3
SHA512 2018d27a4b690ef1df3903ccbaba0d9ce8d94b677723b3ab042652ee224ef8fc4cf2d93e0c03d70f4bfcc31012a76cba47a3f19fce64d4e8272f8f1696857830
TLSH
T1A7A0244C1157304C003C01C31D0FC1D031C101344C045133F37454710044103747417D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 ae9447dbadc2da7180c3c19064ac2c79d7a1611bb9a79b13058fec4172eff77d
MD5 35b5dca310fba2f87b3cd3740c9fc075
SHA1 29e7e2e501f651f5a83f91554304193ea736b3c7
SHA512 7565b1ddf5dbde9d0361c5653110cf758748ec2642e4e26a2dc38915f1a0903800e8462b3c4d40546a4d846477720fa0704fa7d2604c25d2554a43b29946d526
SSDEEP 12288:ed7d2kqKATim6Er+60Bsn8n0fxaXqVI+0AUJuT4FawgZi4M:q4d1mm6C+Ln0Ja6I5YT4FawgI4M
TLSH
T1F96523B4477D0B6AF57F12B101686326F659EDA0EB41A2E3F374320B1770BC26EB1625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 30c4ba05682dda3d1389ea6eaee1431523ec03fc8082a3fe676ab5a3af5b6035
MD5 05902a8c6cdb26cd0d2ee8e0b2ccc67a
SHA1 01b1f42206b653c41ed1ddbf0e46f2b6be691090
SHA512 789900123f890c964c2a4b7147eb50ea46596edba0410ee28a91633a19cd4ebf97f711ef8d09c47429e4ab4f689575431b315c7ff7f01b6b5e91280808779fa5
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYmd1mm6C+Ln0Ja6I5YT4FawgI4M:agb4mBIBhGF/3mmG+8K4u
TLSH
T16E65AF1E22EC02F5E0FAD2B88DAA4417D6B278165731D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 25838e6c005100eacd4a102f28c015c4d60d3079d05d8ad9a607f6ecd71d22f0
MD5 10b91fcc130e8c9fdf53ab2e34b97af8
SHA1 3f28cd69046f05d876239245f6e838bf95e139d1
SHA512 f287c39613ec00f2f8ef54faf80a8b3dbcb163f9499060fbf2cf29a9fc6963c03c650ae6503fc15dcc27602b7bda4b5fafbcdd486a893423c832de8e2a0e2fd9
SSDEEP 24576:fG88u8FpJqH16zria7/mPd1mm6C+Ln0Ja6I5YT4FawgI4M:u7ZFPqVFa7/+3mmG+8K4u
TLSH
T118A5F16577E102F1D47BD13889864663F6B2B8211360EBDF07A88B561F23BD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b678d8134a079f3028997fac1808b6cc897a3ce1463a2af82072268d8542f5ee
MD5 4a55bd95b11913aec7b66819c0da183f
SHA1 2e29e2f2c1e0c5c19afe404126393e3f0811469e
SHA512 bb9da54d369696f8ca214e0effbbc32d677a8b2065ebc3046eee9db20400c7894ca82df2d4ebe412e09f68e90e10990cb1732326f64f5b2350cd7b81d36c16b9
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj73mmG+8K4u:yG05lO43bAGXK4u
TLSH
T1B6D5CF6E62EC11F9D1BBD17CCAC6460BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 684c1ef68eb66ca041379f9e82a8cef89f217db6c28f65973a62f899a52c209c
MD5 f08f035e1bdfa06900382dad0f5b03c5
SHA1 b9d7c41fada9184312d4c5a1a9d2d64c5529a57e
SHA512 7c3dc9a7929d6e4a538c4b6dcfab857a4c0fdb36a92c28f169fa8d01704f7864a00294535bf5a0ac5c7f37336112392e3ac0eec7b8c25e5586070e3f65873190
SSDEEP 24576:Ofa5POZ3dpyWVM50JicR2hG0lasx2+47eidnhd1mm6C+Ln0Ja6I5YT4FawgI4M:Wa5POZ3lJt2pasx2+mj3mmG+8K4u
TLSH
T19365AF5EA6FC01D5E5B9D17DC583461AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 23914e59ca7ffa733a955e040594843fe34ea77e7e55c0ed9c62d87581bcc844
MD5 e7ea76eb2afefa850d556cfde5401305
SHA1 b67ad04692482f81a78568b1b393bc02e3d2ec1e
SHA512 d59c6752981ac5571a19304f40c68a93749bf6af920725102c0ccbb16aa8791bfea36182e1385cca7a471c5528d200920237ad034155f4e7f47b52ac4c872503
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk3d1mm6C+Ln0Ja6I5YT4FawgI4M:LNc/zEOVHFe3mmG+8K4u
TLSH
T117857C6623E901E4F1BBE1BE89779546FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b2b415b7300dc6580f99753e2d43be50595164f7ff13a8de8453916924037169
MD5 e119859c73cec40c7a48133c41604fe2
SHA1 13bb2c18628c10814de81616842f4daddfd7d759
SHA512 4e4b825c966fc7a3ed450d6302046156dac76105afdf1c19118994970653f8a1fa54dda1aaae2b259431d2cf3bc3db9913e1ae69441a922db88b30a9348f4c58
SSDEEP 24576:NzkNvNnaFeYhJNtmZBmld1mm6C+Ln0Ja6I5YT4FawgI4M:NzMwBtOml3mmG+8K4u
TLSH
T1E155AF6EBAB806E4D1FEC6B58D238512E6727461173293CB5390C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e493c5e24013149e00c8b582226371b15b87cfe99fa569edcb234f3cdae41718
MD5 d7a3d159ba32b661cf6813d20e0c6734
SHA1 cd204fb2cafea8e712bb9c224231bacee5346f58
SHA512 ea380b887d22a2a1b36b1784449bd25bf7eb4f612818dcfcfeda5ab6ed9a28167744850826e2b1e2747278df9d204b062474826f210257390c95d76a81819c84
SSDEEP 24576:XPUr+NQrd1mm6C+Ln0Ja6I5YT4FawgI4M:XJQr3mmG+8K4u
TLSH
T15F85F26E26AD18E5E67AA17D85824719F771B8625702D2DF02E0413E0F73ED8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 cb60237a8263d9bc5cda7b3e481707e95be3085fe013422bcf31075ae7c0294b
MD5 501f440a1758f4cb49c0b797600b0132
SHA1 e131a868ea0baaa04e38c88649459bea7305f29a
SHA512 603436be618266aedbf9391f7c5a9602b30856902047f70208f08066a013914d02743b41d75fd0ab0192ae9e0b8037ccf38851dfc51b89af0aa03c1265aefa69
SSDEEP 24576:tD3FHshBIYQgAMd1mm6C+Ln0Ja6I5YT4FawgI4M:tDVHeBIAAM3mmG+8K4u
TLSH
T13995E17DEA6C04E4E57BD1BC86638606E77138A9032266DB02D4817A1F6BFE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-110-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/368-368-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/368-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/368-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/368-116-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/368-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1028-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1028-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1028-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1028-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1028-31-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1108-81-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1108-75-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1108-73-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1108-252-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1240-95-0x0000000000400000-0x00000000007DC000-memory.dmp

Download

memory/1240-1-0x0000000002690000-0x00000000026F7000-memory.dmp

Download

memory/1240-7-0x0000000002690000-0x00000000026F7000-memory.dmp

Download

memory/1240-6-0x0000000002690000-0x00000000026F7000-memory.dmp

Download

memory/1240-0-0x0000000000400000-0x00000000007DC000-memory.dmp

Download

memory/1988-85-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/1988-91-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/1988-339-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/1988-86-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2512-374-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2512-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2512-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2512-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3756-69-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3756-62-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3756-219-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3756-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4084-385-0x000001EFBD6F0000-0x000001EFBD8BA000-memory.dmp

Download

memory/4084-404-0x000001EFBD6F0000-0x000001EFBD8BA000-memory.dmp

Download

memory/4400-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4400-103-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4400-97-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4400-386-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4400-388-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4400-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4812-130-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4812-373-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4812-124-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4812-122-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5272-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5272-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5272-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5272-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5460-60-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/5460-54-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5460-58-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5460-48-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5460-47-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/5984-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5984-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5984-147-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5984-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5984-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download