2a3f73e5f4cc74c31e99d3a54e89bf2dde441408fd3dec4a27f75407dcb58477

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Size 4.0MB
Sample260715-peatyaft5x
SHA256 2a3f73e5f4cc74c31e99d3a54e89bf2dde441408fd3dec4a27f75407dcb58477
MD5 3f7d9ab4f79558382a0b867f927c80ce
SHA1 8a61b3c83835d1de5acb64c8aa4fc1aa94fa194b
SHA512 2a64a1e052f05d756aae1d7554ae1d0218d1832cb8350bf473c1b4cc371eb2a72a2cd79da6d68d068b9dfe558d115f79853b40ae4be9d1d356cc6c947bb87aba
SSDEEP 49152:Sc7e0CGHIVnk3lAXW2N5n/koYVGia9SCIJ6ZNtHlr/KCo9w3xQ0uAWA0niplHXcP:Hy0lHokVAXW2N5MhUB538niDXA/6CIG
TLSH
T1A7166A46EA8710F9ED071574321EF33F9B365809832C9EE3CB945D25A96B7D2183BA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4236	elevation_service.exe
6060	elevation_service.exe
3096	maintenanceservice.exe
5744	OSE.EXE
2596	PerceptionSimulationService.exe
4560	perfhost.exe
3148	ReFsDedupSvc.exe
3620	SensorDataService.exe
5044	ssh-agent.exe
3960	AgentService.exe
2100	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e9d9fe7183806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000efaa0ba5314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030bac8785314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e03d24bb5314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078118cba5314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045374d795314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041e6d47a5314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
4236	elevation_service.exe
4236	elevation_service.exe
4236	elevation_service.exe
4236	elevation_service.exe
4236	elevation_service.exe
4236	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeAssignPrimaryTokenPrivilege	3960	AgentService.exe
Token: 33	2100	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2100	SearchIndexer.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3860	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	4236	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 5452	2100	SearchIndexer.exe	99
PID 2100 wrote to memory of 2896	2100	SearchIndexer.exe	100
PID 2100 wrote to memory of 1544	2100	SearchIndexer.exe	101
PID 2100 wrote to memory of 4848	2100	SearchIndexer.exe	102
PID 2100 wrote to memory of 1720	2100	SearchIndexer.exe	106
PID 2100 wrote to memory of 1612	2100	SearchIndexer.exe	107
PID 2100 wrote to memory of 5672	2100	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3096

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2980 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2980 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f7888000a5938daf22f144922bb95f71432e4a63f751397996102c521b3d65f4
MD5 4ac3569a5f9d06e6260a3c3ca76c5ae5
SHA1 c9eda2d6ecb8bf32b97625c07b40ff04702ab57d
SHA512 3e62ec0440744eee9e7c19543f4ed186c771e7743da0b15be59dbbb10cbc77d7eef18901203159e4e7ad1f2b7c77462cfa165c83b418ef485bc70ff6b82c56dc
SSDEEP 49152:Ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxnSXch/3qHiXeLG:q3q6mjBvXA/6CIG
TLSH
T155D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 93e839b0ba3d8ceb67171e888142bba27176e6ead2fcf27654f360caa6b500fc
MD5 4328e212e8fe547da5105e0c64b5c3b0
SHA1 5bd6bf5e9440056495fc973d5c3afee7cb1c3164
SHA512 948959cc43d2f5935fa98e19dbbe715ff45e55d3128fc43feddc7a3a9dab661bc9c3a087e757d824fda2c643d8a72bf3f0a89f2ec2a293b87882487a364c9725
SSDEEP 24576:jXYfDtczAB5T+v8zVW76r0KA3qHwg4xteLG:mtcEXch/3qHiXeLG
TLSH
T13265012877E908F9ED67823CCDA28511D633B8514360EB9B03E4D9261F736D46E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 995e07610c30874573a1eaf1324d2e6e20952385f593a8cc336d9a4c4180c345
MD5 1c0a3fe27641570cef2873dcf1ea2cfb
SHA1 087f07366f98d4d21755143ea6368effd8b6cc43
SHA512 2707579c21209098aa400feee031b6402da43e898993d8e67a4aa65082020393b8fb4b9445992dd0cd93608387123dd958200e6d97bb7bbe54dd114a1276634d
SSDEEP 24576:o0Le5ji0hmxhrMy5T+v8zVW76r0KA3qHwg4xteLG:oPji0AzxXch/3qHiXeLG
TLSH
T13C859E15F6788731D073C0B9C5D2A69EE972308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 05b8f6441276585c98be0b477eb15ff60547cda5d26a20a98f9fc6997bd8c806
MD5 a82247c0a46697dc9aa7ed52bae06b02
SHA1 46d4fff34a2016235c402110bc39944b84050b9d
SHA512 90b02bbe8035599ac96b858a0ee82343aea4165881fe4d6cdcc25038e2479541755fcb7aa93241aacba4ab0d683ba631e8a6877560200a807ea229ca36c991af
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWj6q8wyu45T+v8zVW76r0KA3qHwg4xteLG:Q/ezSC6vUzPv+HjydXch/3qHiXeLG
TLSH
T1E4755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a9d5440c77f12e535fc8066e844c7cbcf208649b8bdbf61df1c082d741b4640a
MD5 87110ea514ca20f624d66684a2ac264f
SHA1 3a54118e6a325f5336a0721c97951526a424fa61
SHA512 e22c84e3233405a060983069cc07020b29c9e7b4722370dd442c550bff3dd1d905e8ba61f6798073d958d8c5cea332895717837693718b0e940f6bd76756faf7
SSDEEP 24576:zVbqPb88hv/l+BV5T+v8zVW76r0KA3qHwg4xteLG:zVO88hXl+RXch/3qHiXeLG
TLSH
T1A7559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 79b9c52f71b6fe6fd84f05e07d5c6db269e53f82dff2430fa7fa96f488335df4
MD5 358242381ecd65007f072ba0a5bc5a5e
SHA1 2c48a1b18e04a94e56cbc94235e356de74844b60
SHA512 f5424f7a3cf880f0e7be3e66cb4eadb0595aff9d9b4ce5d2348a395ac94508291d28d0c13c0fe1e9a3670b171156ad8b63c7d69ffd74d03d89d01cd057fc32cd
SSDEEP 12288:dGG5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:dGG5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1004523485E6E2850D39B8A303FD79560C642AC7263859C1B5B8BF6237DF4CB0FC056E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 20cc18aada2424e356c54317a02e8abc85d4a1f0a83cb1c09d03b066a22117a8
MD5 abdba7bab35f05aace6c40b37acee822
SHA1 90ecd4e06c5c645c1ba77dd5db0c239c73eba8a3
SHA512 467a95bcc05d0ae32913c2cab3b7bfa8c06ad9ca656498923df5418e69f463390d32ffbe79c5622059770a47093ff4247817c200839487ed35b3f1fb59d6d23d
SSDEEP 12288:1eBNUbTVO86Ut5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:1JIUt5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1F565CF3BAE28FCD2C27E8D795B918600D77278714B52A3CBD165C20EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bff9113b7b627d10ffa4eff1fade8742f179e0ebb6f689dc42e0e53a566a2bbc
MD5 62c789d8e25ff0f6a7473dbb6513255f
SHA1 fb4989ec1a2f19ca803be0bb9c336e3a3919046f
SHA512 cced54cb42f9ac3b815dad50715559aafbfbe48affa55d043666ac16b0025a7899a88e2b8bd5c5a14fe2119df06eb613043bdae159890098a8d576d91cf0549b
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THg:MQvGAdlCEL8c/WRNw5CkXA/6CIG
TLSH
T114267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1f92d06bc97133f85cfe6500c677e9a921611a54df7f425fe8f53cf0cff4ebde
MD5 a70fd562cfc5ae985a4c827075f02b92
SHA1 f55ed2389aa51425747991087c9df4938a8f314e
SHA512 3298b759a5f0a02c939ca321af5d4198754a28c66d39137fdbb932ddddef0b077f532114f9697898272638cc77e14843c44ffcd6ab8d3145148853581309627b
SSDEEP 24576:/fewsAjL5T+v8zVW76r0KA3qHwg4xteLG:HljBXch/3qHiXeLG
TLSH
T14575E030FE79E432C3BF0DB21B66C716542DB9204B5119C3E3E88E9E59702D22776A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e00c725732a4144586f9b288b124a0c5fee6e46fc3861d371e1c43e15e9ef9d6
MD5 8c1a7a066f9cb181d4d0af0b40193e5c
SHA1 b246c55f836f4b45995113973ea667ccbea67176
SHA512 96a37e1c49c3cfa6ca5893809c8a7bf28758d641bd99b1390533cc3fd44b5950bcd442c3f29b976cb3a4b31b0c4c21c9790ab84b7114214ccfc2c630d58772b0
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHtCIG:5UEtQevvqc2W1cpV20I32tCIG
TLSH
T133474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 081cde14cf386811c39b4d81671391246ce2e898205c5bb7b863e73f70d067f5
MD5 de57a43bbd64fd79168d82064c21e03d
SHA1 15f2409e6736276f00771f1297f88f591e29e530
SHA512 115dcfa2445eec76f62c2b6cb94bee862764160fe1b875f6d84378c65aac00f16a277a8dbf8df1a05900a62577f63b65b98f0a3d408a15a9cfb3f0aff312035d
SSDEEP 49152:ECbRquA/m2yL5zTfFiV+XenmE3/zhXch/3qHiXeLG:NoquVjnmQXA/6CIG
TLSH
T1E7D58E0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 595af98fe9a7f64199194d457a9940cd83c0711b89cb7f0aeb33ad0c076dd572
MD5 733732a06f12f91562dac9176716731e
SHA1 b876b193f640454baa95e10b8d7038defacaa3a7
SHA512 5083fcfc95374e1f031979f9470582352870ddf3486340dc646cf01a5590a6d151b577c3ced8ae0fdda4895b45d4ea5de1b1b330514b64f51cd179df483905d1
SSDEEP 24576:aAhGL6IFoiwtA5l7S53E5T+v8zVW76r0KA3qHwg4xteLG:aAM5Foiq5gXch/3qHiXeLG
TLSH
T17B35AD80EBF955D4F5B39A7899B68170EA76BCA65E31C20F2250D21F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e75bc9ca86f7e23d20b73256c295631344f38f49794ffc61bb03483e69eb9805
MD5 d75c7d3826fda10b642c5c29841fa543
SHA1 1d75f952926e455de8474e4cbc75cec8c4b598f3
SHA512 b9c5edc513148f0e8d0617faa67e6477fea0c44a10b8acd5340c877e604a718f54cd1b01524ab30837e233363f50840debe5eb880e5020d34f448614f634f8d0
SSDEEP 24576:VwuROWX5T+v8zVW76r0KA3qHwg4xteLG:VwSO8Xch/3qHiXeLG
TLSH
T13D65F14936A91CF9E66786388A97C135E7F2BC122721DB1F0760C6176F37260BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1db6f2b570b0a118d0ab2e086eaa7ba58fa4640893c934a98efbe86087012267
MD5 e6252fa020f1dbccd27573a3bfd5e981
SHA1 735b9ad8cd6354952267db27a4c2d205bfa7311c
SHA512 574ff75592c393a5a734cf6c88be123b7660201ea1e77a4ddb49def9302cc34f98649125486ee97377f86a192c551000eead877616735a502fd281c84e4b34fa
SSDEEP 12288:uyZ1Iyb5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:XZuK5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T15E5512493AAC30F4D2A786389EE29604C7727863237247CF165582672F73EE16D39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0d8237a68ce32f2216c5e9b2466d11ce40bce5a0b45600def6029765d82dddb
MD5 4ce62152d45be2b6fa1f022297d4a5a4
SHA1 8795853c8344aa25ebb6cd16786569093120e5aa
SHA512 13b917358237affd5577ff8a2fad98d0a8fa579b52330b2ea231d0920219fc1ca1439ccd8c9876156cb23c2b8bf3fb07896d7d2fec978e9340d150b2b84c13cb
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3TXA/6CIG:JQyiKanX+PNXCIG
TLSH
T142667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1cfff86586e95dca1c9e2579093226443519b66553f87439b87675237044c191
MD5 e469660723ae5754aeb51c9583e4e10f
SHA1 94675a308399f1960ec23595fbba314e8e9005db
SHA512 f63cce562694a18265c049f4489d95f2629c3e6ace606d9f535c56799c897a0cf79421cb89abda7036e986aa6218cfc22f20c30cb017fa2a31485829caef35cf
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN3TXA/6CIG:SQyiKanX+PNXCIG
TLSH
T110667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e6ca6af0a53c4ad0190273ececb2f46eb610787252f091d4522fdc530178c78f
MD5 5024507e06843cdd8ff9c3266e879b51
SHA1 0be9a3fb1a2fd83745dea91411fa3e590adae912
SHA512 98d619d7a50f3b00965d38de4de5dca7b69c07fda88f2fe0007601b25993780af9882907859cac1ef059860020e339f71c2bd4d4394b0c7491b9084454830f36
SSDEEP 49152:l68Qg55nhkeWu7PNU3/xXch/3qHiXeLG:zthTRc/xXA/6CIG
TLSH
T18EB54933B2F600A9C44DD1769F4A872196D27C758FE0E3DB860572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d556986aec9cefecfa938a1d9093167da2894b6aef3668560900edf40c20a211
MD5 93f2a778f36fe21f1ffa0f427f19ced4
SHA1 da05d7897d733989b0a6b36d1b0d7ba97a5ddde5
SHA512 0a1243c584c265e43eeac96c057f57ea6335a24ec9cee21493ade728ee6b109c61b598e334573f5558d9a72f0cde17d15c95f44d71eabbed30bb6367d4377d94
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZ+XA/6CIG:BLIHRWheCIG
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 eb742e91c3c71bcd8feedfdae3c72034609bc9ee0835162baa58d7001938835c
MD5 811899da57ab05e27ec667288e49c124
SHA1 c6c238069207e3d68c71b3398006311f62129a50
SHA512 1d803e0b2da1288730f96a16bca918dc9d8d0f0ddedfbe7248c39718ea3a495f5caf1f1629c73d05881d8c12e703feaff6b1a66f6e98c3d0faccf7f9306690c0
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glbXch/3qHiXeLG:Vu6JmIxd2dbXA/6CIG
TLSH
T1CDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2ce5867571ee80f5fc9a69fb6a149c272027c285e768ffd40ead6ae0525b0d71
MD5 a5311053e06f1147186a4f3db802b455
SHA1 fc48592b26a5b2bed4204b743d28a7179ca0dc5f
SHA512 6cf6bbc2e806617261875552f0eb013da8e712fb11723fe4c330285b78b1daff5f270b78d35362921bd8cf64a06f248d8d1c50601ae8393ed4953ba5b09ec086
SSDEEP 49152:J1hpsNoJpF1A67U44CwH7R4xnXch/3qHiXeLG:JmifPqRQXA/6CIG
TLSH
T109B5AE13F2D900E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9be64d32922d8c7271728c6473f15b0c0e9a95c690abae8de6705aaa1b43a52b
MD5 ee3bc00b3be718e428aaa0f8e546b5b5
SHA1 e99f84dda5f0c5bed78e4e7fabfdb9f74fea5cd7
SHA512 bcd348c161b17e2b75653f43cbf664b4f9615a6925626d324059883c560fd9cefe67e4c90076a155144478f6c4b5f35b249eed8ca611f744eb5b1cd36e054309
SSDEEP 49152:wSuZQIY0Be2KkRVtOnks6NMHqiXch/3qHiXeLG:q5dKqi61iXA/6CIG
TLSH
T16AC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 16eef5386b07ca6ab34b98e77010690599dfa5f012c114926d22bba9a00d2d06
MD5 a03a2ac94760d92c10c9088e70f1a991
SHA1 9a833c049c95340d51e59d7e27034452bf3d25bd
SHA512 947e4b21a5e7d3ef35cee6ce01079804857c261e80925dc2d0e05bf6c41c19c625a07890ee3666db62f5d40c1789300b58bf35dd86bcae29e256c15aeff51d9b
SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wrXch/3qHiXeLG:iX2iWphcXA/6CIG
TLSH
T16595BE13F2D900E8D05EC178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ccce996d120acabba61b674e63435d071f8dd53fbe006c989e8d1be589d8216a
MD5 92c68e8ea78aab16f038fe644ab96bf1
SHA1 472074d5a7a4fbe939e35b58e391fb0de974eae3
SHA512 a5a48e8980db5b51746210ffad3fc22271758de527eccb4b7ff1b3b24945023964b3b46fc2ea8d11a65e4fd51841ef38fd5486d5336013dfc3ab73dea17d5bc4
SSDEEP 12288:m+5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:m+5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1284523486D6F2850D34BCA712FD39164C6466877B386581B2B8FE123BEF5CB03C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 360e6afba13a7cb9c97c0b72c2f6d70ca4b048b271a50101ac69f7335f538587
MD5 bb280a05608cafb6c2255a5a25351e8f
SHA1 708b475d44e072a155dc0d3bd6edbf6762579164
SHA512 90fe72b9ab427186fbb9889b5e808b8487e453170a5306284e8415c2189e487908a4186bae3b00c38cb1e3254d4e2cc0c3a2192106edcdc320f5fa25859ef899
SSDEEP 12288:5f5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:5f5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T12A4523486D6F1850D34BCA312FD39564C646A8777386581B2B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 25dc9f51f1df80b44badaa4c9c38e5d4c2ccbaec642eff77d293c79644644691
MD5 d6636a7f9dd6dd1bf4912bf5673e48e4
SHA1 9cb27199b32a853b08ad5a798ed81914cebd689e
SHA512 39f78930cf0908bf93e701ce917a819463f5871307cb072cc5f2807ec33c698aa97c2b2a7abb2ba09a2c8169b6346a8d5064d1116855054c0aebab688a2234f4
SSDEEP 12288:nF5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:nF5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1844523486D6F2850D34BCA302FC39164C5466877B386581B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 70d47a382d0314a328f0d5893b2bc53c88b89196197157c68f76391e0d46345e
MD5 46ba0aa5ac298090f62489913278c974
SHA1 3f2b5645d2021078282f9be1e929f9fa7c9efb38
SHA512 7963d101de51f4abfcf5f1c7aa4e2b8acb89ebf937649b4c65954fb418acb9a7d50ec23deb9506e4b052ba5441c0ccb9432c80a9b7e6e2051d7f9280919ff38a
SSDEEP 12288:+Vk5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:b5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1B74523482E6E14D0D257C6349FE39120C3A2BCB7B322A95F5B4695132EF1AF07C25BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 54aeffaafb7b04825b8184ef81db26aedb4451a3f790dddfa6d9ceeeb485adbe
MD5 d9bc04703f4e907766e85bd5b82a61e4
SHA1 7d77a6705f30c419698a7e59accac251c4dfe012
SHA512 5eec6f51f4a6e47c176466f6178b8282334e57c2013e09585dc510b2a77694bfe1c9901d36f60f2d54ede2a34496cb64c91beabca6c93c60cdf25f14d59a94de
SSDEEP 12288:Rs5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Rs5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1934523486D6F2850D34BCA312FD39164C54668777386581B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 18f7e3933514e5c7c0f931fcb90234d2b959e1e113176d26474bd5a64b983148
MD5 36e1ea49e50673ecfc8ceff778368508
SHA1 815556c029ddec5fc6eb8d7fd2ac3ad688df14cf
SHA512 b5e1b8fec76a1777a2d85c189d8904336647162acf8e4bf82b3d88c706c6a688126ef49ee024c1247c4914e0f5c7fa6c428d64216f430abf0cb154341d655e04
SSDEEP 12288:wD5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:wD5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A94523486D6F2850D34BCA312FD39564C6466877B386581B2B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1c353287e3518894b3b8271c109a61c48290adac7e0128c99556ba304e8d9f69
MD5 089c029f21a1abf1f691c243876881cc
SHA1 90271f8afed1d161e90fad67bf2208865475498f
SHA512 faa71889600f741fcc837ae2b3610b592fb8ca865cc7ff094e076c505af188c1b8bfda713b1fef38e5508cc54f01417d4899c54cc9fbd57f0ef6163ddb163b1e
SSDEEP 12288:MH5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:MH5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1B54523486D6F1850D34BCA702FC39564C64668B7B386581B6B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7e9b6c32645130973aa9b6e71763b113e3f2d56e85ddf4e76586a32886c5ea53
MD5 ed267f0ef94ba868f119fbe083ce2755
SHA1 9b78e2825022dc5eb14323130c1618cf54551cdd
SHA512 7f1e84477d8ed04b3fd4d5bcdc2902af7c635592334997a4bd3002123d88a8818c6d563b26504ae6cc17791b20e07f802d76459bda8f447c6ad2573f1f827a64
SSDEEP 24576:HZM3zFVSO/5T+v8zVW76r0KA3qHwg4xteLG:HZM3zfZXch/3qHiXeLG
TLSH
T1F165019473941CF4ED67823ECD568915C6B27C6A0760CA1F13E836275F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6e0df086946222b580d2cbbad141b84e70505d8383bdf499b5824f9f293a81ad
MD5 0e359d2f1a48341d4c8eb100e3bb2846
SHA1 7c4f0e634da0416116b1689e6b75bf654a12ccbe
SHA512 cbccd55a34e96e9a5852f4bd4593d466ef02fb92230d47739708a29eed2ad41aa6d3f613210679b640ebf7710073d0f4191b858b9aa4249f96c89d752fe8806f
SSDEEP 12288:Ma5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ma5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A54523486D6F2850D34B8A342FC39564C64668B773866C1B6B8FE1237EF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8b3f88a887a7add46810142b1a292607d3dcb9315707281c958b358735b55beb
MD5 fce7ff8ca3bd05258a4459a6c183f51b
SHA1 d39f781e6a86481aa3a5ec8285af6e953f35adb9
SHA512 c547773d1b3f96ed08b8322a578a34b024b529255a4921879b212dcf9af0d9c9c54ebff95d2fbd36d27672354bf65f69ca5c5cd666c50773f3d26e494e194190
SSDEEP 12288:TW5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:TW5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D14523486D6F1850D34BCA342FC39564C646A8777386681B6B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3f66985f42baf1c83305b3f40d182242aed6c3bc3781fd843faf7fd18842df5f
MD5 902611c6e1a89e23b311b6b56049ac8d
SHA1 5cb43cdd79edcddc264dd0ddd4866f523a5881c4
SHA512 ebe4fb1b758cb281b83cef95e5198f7aae447326ab7e374950ef174f38db30269c63a6b82528206b0f5ffeb3e5cd930e69d6d1e36f56e1e3a1cb982ff0144bff
SSDEEP 12288:YyPz5L8b5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:5zyb5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1C055024777A930F8D16782388D921A11E772B83253209EAF179447372F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 95c526fbb1e13c92efc3ec0f5bc55a4a28ff4c0b25e8dc0911c2b3af8285bdfc
MD5 988bb5c132b8fbe147d1ed01d3b88fa2
SHA1 36445f1c0dcfebe093fc59c426cd016b0773d31c
SHA512 fa3d5d48df0bc0e1b8d782244dd996350b0e02ed6bdc4ce9b8c71d3d26de5e0481c060577ff4435e266ee5ccb599fff8a7f04280dc683a38a8f22ba45e9d7cce
SSDEEP 12288:Ja5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ja5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T12B4523486D6F2850D34B8A342FC39564C54668B773866C1B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c454b0d0d825de7c53445b1d31182365aadcb934fc4a463ae70ad56554bf4b96
MD5 163356823aeda8b531c46e567934d346
SHA1 eee966ceef65ebde43f9fbcf1857e125ec4cb903
SHA512 ff2f40a8bfc1a4faa63a236472544ab88a9b6733b1c3935103cf4b0e1f97486bf29c27ff78b82c2b267341388aa0f9c46b43502813d0233ec1f43bcf2a628e96
SSDEEP 12288:Ga5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ga5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E24523486D6F2850D34B8A342FC39564C54668B773866C1B6B8FE1237EF5CB07C056E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 18562d8debd12c1aa706b32c02d07f4e5144db23795c32aefed1443a876387f1
MD5 b3588c678abe8cd7ab13bf6b46b8b6d0
SHA1 f11ed4320ec98d3e59c0b9257b3426dea1dca854
SHA512 20581f655173a3a8dd585763a5cfc780b736820380b4fccbc0a443552a4284a149f308fd04de925666c6e8befde287676e9241b83e293144be21e6823fbd571c
SSDEEP 12288:xyPz5L8b5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:gzyb5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1AB55024777A930F8D16782388D921A11E772B83253209EAF179447772F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1c0426583b9e66ac8117daa804fbce77975ff4e81b181eb2db038f9b7b7a2e8c
MD5 245aef3f8721b5c7c4f2b3d27c05b63e
SHA1 c54452fa73c8501d098d342a196c9c968e75b166
SHA512 c517771387eeb5f363b33c95c7239ead9553a3341c3d85b0512d80040df102704f421ef8fc94d727b6364108854ebbedc933b2007f102ef1575ba7828c012707
SSDEEP 24576:ZT8aLl3z0zD15T+v8zVW76r0KA3qHwg4xteLG:ZT7LljUXch/3qHiXeLG
TLSH
T10E650294B3541CF8DD67813ECD568916C2B27C6A0760CA1F17E836275F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9ecf43db50b46db8ed09468fd22d8ea49c6ffc3acfe4f13b02aab122f72149f7
MD5 4f8dd43f49da216938dc45609b2f1d13
SHA1 3c988f2e972d29f20e814a21d83f0409f42102ba
SHA512 19775a14237a34b87dae2abfe28a51d400fb82e19e2df036b450ea4b0f439238e06559c74c57b10256121b9b0efc37d90bcb3753d9f371ff212a5f805bbc550f
SSDEEP 24576:v3rd9CHKy7GZ55T+v8zVW76r0KA3qHwg4xteLG:/rd9CHKyaZXch/3qHiXeLG
TLSH
T16275CF90F7E814E4F1B7CA358D764511CA767C5A1B21DE8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b40637ca876969b7371b7c9c09ad600bdceb84c9bfe4c68a35be43d28ab2bd22
MD5 93a1c4db99cfa79dc6a6a4d2b89526ac
SHA1 d5286c8af3ce05e7253a2e379ba6f7129282e5db
SHA512 a39bc47b283b80fa92446054bc2f07e10f7213032e5f35429b47a957ed0bb555c180d87c4a8a05ea3252b05f5f3f8f13889a5e88e8b181c7ad79d7ef3aa399c3
SSDEEP 12288:ml5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:ml5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E24523486D6F2850D34BCA352FC39164C54668B77386581B6B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 32f1ca309d4ba475b3cbd1e329face9e0d07689939343de0f36933d2ac8e4f32
MD5 d54dc256b507e286c1c5a65d23b3e01a
SHA1 de4f538b7741666e0592f7530d877836fc078b71
SHA512 c134a5c1a2ac67393ccf7be538903767460b6f00e64865265e365ec2d1392f7b9188e056c08b2de1fe82ee59b965c187630b8268cabae60b5dbf2fd7a184b6e4
SSDEEP 12288:X75T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:X75T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1364523482D6E2860D34BCA752FD39560C6466877B3865C1B2B8FE1237EF5CB07C056EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 72a4e49d30e6ae46e1a42dab2b949158b68bfb85d35599404efecfefb39e99f3
MD5 2664f2b0621f711ee8223448546b28c1
SHA1 c84162087bfe8924df4b07b70e5f9c4901a835a2
SHA512 35c50236affbaf44a248992a0071a5d8d68c7a7e69abf9d3481e8ce9ef6fac2d362df4dda4ac4882ea3bd549f98b367a7bf8cf2e6da45618b8a17cd35532fc13
SSDEEP 12288:tg5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:tg5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1584523486D6F2850D34BCA342FC39564C54668B77386681B6B8FE123BEF5CB07C056E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 38fc4833b1aab6b086e29663b42a162c121ed632ce00739709245ca943736c6f
MD5 047acbcb1a558baf88d81d62fafa1069
SHA1 5e79d0759d096f9f803734a207803227c153165a
SHA512 fbc86efe62dc49e2310e4f228c014b7bc59fa703867457ffa78785a05fa6acc3692f2267de85cf33389aab5f56938cf08b3e3a977269d581cce4c9f9afdfe42f
SSDEEP 12288:5a5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:5a5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A64523486D6F2850D34B8A342FC39564C646687773866C1B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6ca5dfd558e69058c7b794533bf53473559357913f504516312a28b05e7e44f7
MD5 19699e9123ed2d78da8162381e9034c8
SHA1 dc729a5365b6fcae1f59f243b6ed09893c24ae57
SHA512 9a5fbd19aef82310728f60cc178e52bcdec7322e6abe1f1a9cab9189d212691b283f2b32c1e0cd2043a5d3f9505597b54918707c03e8d4f0bdeb965500dd1a95
SSDEEP 12288:Fl5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Fl5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A04523486D6F2850D34B8A302FC39164C54668B773865C1B6B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 23d36b5837f66e09d626709cc36458598d7fd513cdf68681268275c7dba3a829
MD5 9a4eb8e0539ae8caaa2f9caa9f84cf21
SHA1 df566a7b78bf3d4809363c2b46fd5c06eb237eb4
SHA512 3e6c10e8e82198cd8f455a69ba195f63d1741b186498eb826f2df6c4eab30f4e048f6242394d620341c58a3677f4a381e24a6e7f696da3763f875947a9bcdcb6
SSDEEP 12288:Yi5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Yi5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1FC4523482D6F1850D34BCA752FC39560C54668B7B386581B6B8FE123BEF5CB07C056E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 acb3aeea6c08867d9b8b1b316abf9d4cbba9ca46a3d67ab689e48096535ae9ad
MD5 cd3dbdf780cec4dd570b5b4b53c20350
SHA1 128f033341cb53713d3fc5b655dd58b2b2bc2b1d
SHA512 628c8b153fd065e573266736f44b0bc3f25d78251e73edc7f96b8b132c6dfde2005760d042ea2f6328ef35eaf3ff7c83374d978c744e27da76b85d0485dc8d15
SSDEEP 12288:ns5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:ns5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1494523486D6F2850D34BCA302FC39564C54668777386681B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 77dda3be8008bb7aa11d8266cbefb79994f13e083a410b3d07241d91cef4a7fe
MD5 1bbd6bbbbb64fabe9f7c83876a8c1a76
SHA1 d00e90b05a947fafba8ae666f846362e5325b739
SHA512 bb7143f442947e3bee6478448d6d273ca4898234b5332486d485269275e336f4b615304177fe6b2ceee6600849a0a54b765bfef20a716b35323aad7136da247f
SSDEEP 24576:Jfwvzk9RX6wkyAIm5T+v8zVW76r0KA3qHwg4xteLG:oMnYIeXch/3qHiXeLG
TLSH
T13085C029EBDC04E5E177823C99B3460AF6B178691B31C6CF129A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eb9cc73aa882dca1efc593d4df98d662396baa0bdfa07becce86f49fe8078814
MD5 4aac1e26fdc01cf249c34bfec241a7ec
SHA1 3fa5f9a13507f866d6c7f2798e11c8bedd7253fd
SHA512 bfbe13a5e58a88ce2c68e944b6037e9892864b99fcfde0ce8e772a5aa61e4e57a17f72fcb0c34b71c267ceb919ca7948335c663e1047cc4d2225e71bfc8b3228
SSDEEP 49152:cYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LXch/3qHiXeLG:TySzPzXA/6CIG
TLSH
T178066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fc32b446f44e05f679875c9af1db402b3ae084656fabe96a9d1336d407705c8c
MD5 30e8099f81a2ea352c163308b5e75a88
SHA1 19c7d3103078c6767a9ca4c06e3d2c188428f34b
SHA512 f4943bd405004cf0cfa223d16bb79f92169a7b1b53908be3648de9622174d0d0fb084e9814734f89d102fd56a9b5579183621cea914c270bd625ea452d49605c
SSDEEP 24576:M47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYP5T+v8zVW76r0KA3qHwg4xteLG:M47JUQjqirIhCnDHUPfF/bXch/3qHiXj
TLSH
T12D65AE1DA3EC01E5E1BAC27885558A1AEA71742E1B31CACF12B0837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 005bd047ad9a1b0591258469153c5b8183743f26593806214132cde5c7421a57
MD5 a6e5dbccb0d7b3f4a307ecfc89bcb6df
SHA1 a6aca5f220c7b479be9718992647418943f2f2fb
SHA512 627dd2baab984e644a1092b4fd6f8c4943d1686a43884cecada0b4b4ec09a17e0c14dfa3d09082fae2f1815471625b201e9bbdf14ff97e7f6ca070167604d11a
SSDEEP 12288:PpsfK5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:gK5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T16755F009D69811E8C16E8235CB924640F3237C6693E1D7CB17C1F53E1FB69A06DEAB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 d8f696d7641c9b2de5028553b900c1e67816893dfc18c868388e44669edb4146
MD5 371b8f19590b692538890b119b4f267b
SHA1 85c156b6a0204b9e857d876fa64abf02ddee54e0
SHA512 f4ddc9fa35570ff67460ce7667f54c695b30a5e4f0f2e36852a4ee436fc517288f2d78c58ab985fc7665b8d78fab0b16db12e828a162422bc38c370eb1a10b82
SSDEEP 12288:uCq6U3fSWbt/aSn7B+2WPSQcpjOuBqHZx:uC1UPZN7nBqVUjrGx
TLSH
T18A253910766AD75FC6AD40325E77C2CCA7707D41EE05AB0372C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8769efb3231c80ed95363028840e2625becae2df4518b16a6d9b9d26388edc58
MD5 781fea33b1ba2a971595018d76529c83
SHA1 2e72dae74196e4489c52668e03e2a15fcb9340e0
SHA512 979504523c621499fdbf3d5e8bc72e8d6a4ec68db8a6e6edb45e854ed805a3d35f650c7b083b7c0ae7a9c3d3b137b8479f211ca4e6d45959560c6f505674d2f5
SSDEEP 6144:5Xf60aKqXOQ9OezAD4Qw1BxAb7cf19cbVtMxGi57RHcDQxR9M4NyGzAhN/oBIGA4:qvO8vhs/G
TLSH
T14855E8815437A3CFD1FB7131472A9B4CAB64EC4273096F2663C8453AD82BB65A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8e8cd29c6f367fc58a7147242f1dbc8301f6082a642f6670790f99a5e88728a1
MD5 0ca64e5b98981f4e6fd3ac791968162d
SHA1 8e07c3c84ef21a1171c0062cb4d31390c948ce8e
SHA512 00a0d934117e795f94c37372d453f348fe06deec6407b7d30c3788d2e752602c645e37cbb69e500492d11ca31ac40981d3850bf26e7963c70d2643dfcd4d2bf2
SSDEEP 12288:i07S5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:zS5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1014523545E6E2C10E26B8A301FD79130860AB877634198DB7B4BA2237DF5CF0BC356DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b1a7de364eeff9a171ccc707f5ed4dd296bd979bbdc83213c8fae75cbefb24f6
MD5 745d5605fd62d0dff261b9cdf372d5e4
SHA1 ff8785be28aab2172b1c75e5ce3a4694320add62
SHA512 fa5eb860a92be69ef19a5ce9b0223a6662b84c97380278c7eeefaf47cf558fffbc24041be6cb840e07489e9786759d1341bca8682c16259363da133f16ca1adb
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bY45T+v8zVW76r0KA3qHwg4xteLG:Ngb4mBIBhGFlXch/3qHiXeLG
TLSH
T15F65AE1E22EC02F5E1FAD2B89DA64417D6B278161331D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ee18a2a6e32ea0eaabe1e04e321b3fc23d5e659de235b692c317fa9657463dc3
MD5 1d16f103875c5c089a31143a10110c01
SHA1 8f6ceb664cd64d8cc4954ea99e2322d0b22670c6
SHA512 33372a281967d810e5671c4c30462f68deaf43b90ef82603189095cd26a4527f452416f7af7872bb7f460366514f938a92828168cc4a7e0e83e730f6f97c6226
SSDEEP 24576:vG88u8FpJqH1vzria7/m/5T+v8zVW76r0KA3qHwg4xteLG:e7ZFPqVya7/MXch/3qHiXeLG
TLSH
T1B285F16576E501F0D47BC1388A864663F6B2B4251364EFDF07AC8B521F23AE15B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 99325cc7ee3e03af0a19e1d6514cf27b9bfd3d4165f0008b0c36880d48cbcde3
MD5 99cfd2c6ae2a56f917e0958bb733fcf1
SHA1 88b502278f18d4a8fd2e1244f1d90d9738b6478e
SHA512 c4bdbd665f81d4765835f46839b48264d913848f1b5fdbae3ccc1f10dc2541fcb09792401f02d61044dfc1cd8c4a423c8705d3c70b4c0bdbf1e537d52ffbe236
SSDEEP 24576:9PUr+NQT5T+v8zVW76r0KA3qHwg4xteLG:9JQZXch/3qHiXeLG
TLSH
T11265E11E26AD18E4E67BD17C8A828619E772B462131296CF02D1813F5F77DE8BC3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e6147202b958913cb84b3a71271515979a3bb563e32780887ecdea20790d6afd
MD5 a4bfdc79b2bc73c1693ddc9fd8276698
SHA1 8c06832e45f504f448d7ab97bfcf385f36da373c
SHA512 fadb4e1e0dc6aece57dbca2b6636e770590d734503c1da8ce52ea6fb788ae57e4654d89851e1bd531c22c5b68b3dc82795ad8c2be49a47209b28325c2dec2814
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJXch/3qHiXeLG:1G05lO43bWXA/6CIG
TLSH
T17FD5BF6E62EC11F9D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 341a4b0363fb480004e4b96e998b973f3953ec1e3be572f0b7fafe3ae654dc1f
MD5 988eb147c67dfb9eae1725ed4211ae6d
SHA1 dc147c8cf7b29b043b8ed501da95505d998fa30a
SHA512 d1fa23b4a1264b35b708d113c494cdcfb512c17f70b53855984d1170818b39a42b9a030818bbabf5365bf6c35f2899e5082e33ea5a7c76c4c71c3d575e0cc238
SSDEEP 24576:Mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnh5T+v8zVW76r0KA3qHwg4xteLG:Ua5POZ3lJt2pasx2+mxXch/3qHiXeLG
TLSH
T1B865AF5DA6FC01D5D1B9D17DC583861AE5B1342253329ACF122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 84f86a29cef323e38cdd1939cad6234d7d2cd30df97dbe3b5e03a2ab532c2eba
MD5 7c9665e27668a5411b1e42e2d6437cff
SHA1 5b17b80d88d08089501a421f389842323cea9a1f
SHA512 414f4619bc02eb25888054ef92afae1b719da84c98db8d57a9fd65ae9904328538f6065b64f977e9c95addd9e531cbedc61318d7d15a7ba585d6918fdefdb7dd
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fk35T+v8zVW76r0KA3qHwg4xteLG:mNc/zEOVHFsXch/3qHiXeLG
TLSH
T18E858C1623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 364452953b2fead7b14603166386e294b22699030de29d1ee592e3d8c0939ca8
MD5 cf30ce81f66374a17f72af437bf3bef6
SHA1 f346fecd61f559e14938806504d05d8d5da9db2b
SHA512 029079511166b964eded76ea7c67ffc449e3ed4d5f3c4f92d3afa255747af11a779efb9b7b41c6dfa804cbc96133b8a00f65b5d8003c61c33f7edf6c8da959c3
SSDEEP 24576:+zkNvNnaFeYhJNtmZBm95T+v8zVW76r0KA3qHwg4xteLG:+zMwBtOmXXch/3qHiXeLG
TLSH
T19D55AF6EBAB805E4D1FEC6B58E238512E6727461133293CB5390C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1c1292a5ad3efae42bae586e627a4251aa95825fbb0750bf975da26d1b59304b
MD5 082befc723d0662729461a41d18e8885
SHA1 05e3d773c6514d7156f76eb78ba63f6f1117fedf
SHA512 82bf72f42d50f0ae8d22b0b5ac66a032d53eb8a1ab7535ec49a4db55835eeb58daaf9fbd73f12fb4182f7af8c997b3287a6d5dfac39dca40530293122a284ebf
SSDEEP 24576:1D3FHshBIYQgAe5T+v8zVW76r0KA3qHwg4xteLG:1DVHeBIAAmXch/3qHiXeLG
TLSH
T1F675E17DEA5C04E4D57BC1BC9A938A06E77138A9032269CB02D4C1B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2100-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2100-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2100-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2100-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2596-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2596-67-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2596-271-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2596-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3096-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3096-47-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/3096-39-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/3096-60-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/3096-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3148-321-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3148-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3148-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3148-82-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3148-299-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3148-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3620-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3620-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3620-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3620-306-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3620-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3620-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3860-1-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/3860-6-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/3860-7-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/3860-77-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3860-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3960-129-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3960-127-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3960-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3960-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3960-121-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4236-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4236-22-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4236-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4236-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4560-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4560-286-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4848-320-0x0000026D09C20000-0x0000026D0A2A0000-memory.dmp

Download

memory/4848-389-0x0000026D09C20000-0x0000026D0A2A0000-memory.dmp

Download

memory/5044-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5044-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5044-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5044-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5744-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5744-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5744-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5744-238-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6060-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6060-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6060-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6060-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download